cybr.cx Daily Digest — October 30, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-97229 | GitLab CE/EE | No CVSS listed (KEV)
An integer overflow in GitLab's CI/CD regex parser allows unauthenticated remote code execution via a crafted .gitlab-ci.yml. CISA added this yesterday with a remediation deadline of November 1 — that's 72 hours. If you're running on-prem GitLab, this is your top priority right now. Alpine Linux has already disclosed a confirmed exploitation incident against their infrastructure.

⚠️ Actively exploited — CVE-2026-109618 / CVE-2026-109619 | PHP | No CVSS listed (KEV)
Two distinct PHP RCE vulnerabilities — one an out-of-memory corruption, the other a stale internal request-state issue — are both actively exploited and had a CISA remediation deadline of October 29. If you haven't patched already, assume exposure. Any PHP application stack is in scope; prioritise internet-facing deployments immediately.

⚠️ Actively exploited — CVE-2026-46300 | Linux Kernel | No CVSS listed (KEV)
A missing variable initialisation in socket buffer coalescing causes ESP input processing to decrypt shared page-cache fragments in place, potentially exposing or corrupting memory across process boundaries. Actively exploited with a deadline of October 31. Patch your kernels today — this one touches IPsec/ESP processing at a low level and the blast radius is wide.

⚠️ Actively exploited — CVE-2026-111497 | Google Brotli | No CVSS listed (KEV)
An unchecked return value in the Brotli decompression library allows a remote unauthenticated attacker to corrupt decoder state memory via a malicious compressed stream — leading to memory disclosure, DoS, or potential RCE. Brotli is embedded in countless runtimes, browsers, CDN stacks, and HTTP libraries. Check your dependency trees.

⚠️ Actively exploited — CVE-2026-48356 | Adobe Commerce / Magento | No CVSS listed (KEV)
Unrestricted file upload in Adobe Commerce and Magento enables arbitrary code execution in the current user's context. E-commerce platforms are high-value targets; if you're running Magento in any form, patch and audit uploaded file directories for webshells now.

⚠️ Actively exploited — CVE-2026-76418 | Cisco Secure Firewall ASA / FTD | No CVSS listed (KEV)
A null pointer dereference triggered by unauthenticated remote input causes affected Cisco ASA and FTD appliances to reload unexpectedly — a network-edge DoS that could be chained with other techniques during an intrusion. Deadline is November 1. Perimeter devices under active exploitation should be treated as emergency patches.

⚠️ Actively exploited — CVE-2026-41709 | VMware ESX (Broadcom) | No CVSS listed (KEV)
An insufficient logging flaw in VMware ESX lets an attacker with admin access execute operations that leave no audit trail. Active exploitation suggests threat actors are already inside environments and using this to suppress forensic visibility. Review hypervisor audit logs for gaps.

⚠️ Actively exploited — CVE-2026-110447 | Collabora Online CODE Server (Nextcloud) | No CVSS listed (KEV)
OS command injection when the CODE server isn't running allows remote code execution. Collabora/Nextcloud self-hosted deployments should patch and verify server state monitoring. Deadline passed October 26 — check your exposure now.

CVE-2026-107326 / CVE-2026-101288 / CVE-2026-104324 / CVE-2026-110196 | IBM Langflow OSS | CVSS 8.8
Four separate high-severity RCE vulnerabilities in IBM Langflow OSS (versions up to 1.12.4), covering OS command injection, code injection, unsafe deserialisation, and privilege escalation via built-in code-execution components. If you're running AI workflow orchestration with Langflow, assume the attack surface is broad — low-privilege authenticated users can achieve server-level execution in two of these. Upgrade to the latest patched release.

CVE-2026-119144 | Frappe Framework | CVSS 8.8
Server-side template injection in Frappe (used by ERPNext and others) before 15.111.0 and 16.21.0 allows authenticated users in common operational roles to inject and execute template expressions server-side. In ERP contexts, "common operational role" means a large user population. Patch promptly and audit custom message fields.

CVE-2026-85890 / CVE-2026-85897 | Microsoft Edge (Chromium) | CVSS 8.8
A double-free and a heap-based buffer overflow in Edge's Chromium engine both allow network-accessible code execution. Browser engine memory corruption vulnerabilities are bread-and-butter for drive-by and spear-phishing delivery. Update Edge via standard Windows Update channels.

CVE-2026-49142 | OpenEMR before 8.5.0 | CVSS 8.8
Authenticated SQL injection in OpenEMR's Syndromic Surveillance module via the form_icd_codes[] POST parameter enables read/write access to the entire database for Clinician-level users. Healthcare data stores are a persistent high-value target. Upgrade to 8.5.0 and review audit logs for unusual query patterns.

Headline News

40,000 DHS Employees Exposed — Including Undercover ICE Agents
A significant data leak has exposed personal information on more than 40,000 Department of Homeland Security employees, with the dataset prominently including identities of undercover ICE agents whose operational security depends entirely on anonymity. The data was published to a leak site and quickly circulated, meaning the exposure is effectively irreversible for the individuals named. For practitioners, this is a stark reminder that insider data aggregation — even across ostensibly siloed HR and operational systems — creates catastrophic de-anonymisation risk when centralised stores are compromised. The incident raises immediate questions about whether the source was an exfiltrated personnel database, a misconfigured data warehouse, or a malicious insider. Field agents whose identities are now public face physical safety risks that extend well beyond typical PII breach consequences.

GitLab CI/CD Integer Overflow Exploited in the Wild — CVE-2026-97229
A critical unauthenticated RCE vulnerability in GitLab's CI/CD pipeline regex parser has moved from disclosed to actively weaponised, with at least one confirmed public victim in Alpine Linux, which disclosed a security incident directly attributable to exploitation of this flaw. The vulnerability stems from an integer overflow triggered by a specially crafted regular expression embedded in a CI/CD configuration file — meaning any actor with the ability to submit a merge request or push a .gitlab-ci.yml to a reachable repository can potentially execute code on the GitLab server without authentication under certain configurations. For organisations running self-managed GitLab instances, the risk is compounded by how deeply CI/CD runners are trusted within deployment pipelines — a compromised GitLab server is frequently a direct pivot into production environments. CISA's November 1 remediation deadline reflects the severity of active exploitation. Patch immediately, restrict public repository access where possible, and audit runner permissions.

Chained PHP2Shell Exploit Compromises 25 Servers Including US Government Systems
A chained exploit campaign leveraging PHP vulnerabilities — almost certainly including the actively exploited CVE-2026-109618 and CVE-2026-109619 — has successfully rooted at least 25 servers, with confirmed victims including US government infrastructure. The attack chain uses PHP memory corruption and stale request-state flaws in sequence to drop webshells (the "PHP2Shell" technique), achieving persistent unauthenticated access. This confirms that the PHP CVEs listed in CISA's KEV are not theoretical — they are being operationalised at scale against high-value targets right now. Practitioners managing PHP-based stacks should treat unpatched instances as actively compromised until proven otherwise, conduct webshell hunts across web roots, and review web server logs for anomalous POST traffic to unexpected file paths.

Schrödinger's Feed

Research from Alice & Bob has refined the qubit estimate required to break RSA-2048 using a fault-tolerant quantum computer down to approximately 22,593 logical qubits — a figure that continues to shrink as error-correction algorithms improve. Meanwhile, BlueQubit and EPFL have demonstrated measurable quantum computational advantage on IBM's 120-qubit hardware for random-circuit sampling tasks, with classical simulation estimated to require over a century to replicate the result. These two data points together illustrate how quickly the gap between "theoretical threat" and "engineering milestone" is closing on the cryptographic side. Practitioners managing long-lived secrets, PKI infrastructure, or anything relying on RSA or ECC should be actively tracking PQC migration timelines — NIST's finalised algorithms are available, and the window for comfortable transition is narrowing faster than most roadmaps assume.

/dev/random

The "PHP2Shell" campaign that rooted 25 servers — including US government boxes — apparently got its name from the attack chain's elegance: an out-of-memory corruption bug in PHP is used to destabilise the allocator just enough to coerce a stale internal request-state into treating attacker-supplied input as an executable code path, at which point a minimal PHP webshell drops cleanly without touching disk in the conventional sense. Researchers describing the chain noted it's the kind of exploit that makes you appreciate how much of the internet is, at some layer, PHP all the way down. On the bright side, at least the webshell was written in PHP, which means it probably has its own latent vulnerabilities. The circle of life.