Actively Exploited Flaws: October 23–30 Roundup

Between October 23 and 30, 2026, CISA added several vulnerabilities to the Known Exploited Vulnerabilities catalog. The affected systems cut across edge devices, CI/CD infrastructure, and widely used platform components. This roundup focuses on what to patch first, what official deadlines apply, and where defenders should look for signs of prior access.

Notable CVEs

Product	CVE	CVSS	Exploitation status
Collabora Online Built-in CODE Server	CVE-2026-110447	9.2	Web shell dropped on Nextcloud
Arista VeloCloud Orchestrator	CVE-2026-114625	9.9	SQL injection requiring Enterprise Read Only session
GitLab CE/EE	CVE-2026-97229	10.0	Attempt against Alpine Linux, October 20–21
Cisco ASA/FTD	CVE-2026-76418	8.6	Remote unauthenticated denial of service
Ivanti Connect Secure	CVE-2026-111357, CVE-2026-118527	8.8/4.3	Chain leading to unauthenticated root
Google Brotli (Node2Shell)	CVE-2026-111497	critical	Active exploitation, potential RCE
PHP (PHP2Shell)	CVE-2026-109618, CVE-2026-109619	critical	High-complexity unauthenticated RCE

The table is not the full KEV catalog, but it reflects systems common in many enterprise environments: VPN and firewall appliances, self-hosted GitLab, PHP applications, and web services that parse Brotli. Most of the flaws enable remote access or privilege escalation after an attacker obtains a valid session.

Edge device chains: Ivanti and NetScaler

The most urgent item in this batch is the Ivanti Connect Secure exploit chain. According to The Hacker News, CVE-2026-111357 and CVE-2026-118527 were added to KEV on October 30, 2026. They were chained with authentication bypass CVE-2026-104935, which entered KEV on October 13, to achieve unauthenticated root-level code execution.

Volexity observed the previously undocumented actor UTA0576 using the chain to extract credentials and limited Active Directory metadata, perform host reconnaissance, and search for administrator passwords and BitLocker recovery keys, rather than deploy the usual web shells. Ivanti fixed the exploited chain in ICS 25.1.1.3 and 22.8R2.6. CISA set FCEB deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527. Enterprises with internet-facing ICS should treat this as same-day work and review logs for unusual credential-access patterns.

On Citrix NetScaler ADC and Gateway, CISA’s alert covers ten vulnerabilities. CISA added CVE-2026-88771 and CVE-2026-88772 to KEV on September 27 and CVE-2026-88779 on October 4. CVE-2026-88779 can independently create a denial-of-service condition when NetScaler is configured as a SAML Service Provider or Identity Provider, and in unpatched deployments may force a reboot to accelerate code execution previously injected through CVE-2026-88771. CISA recommends forwarding NetScaler logs to a SIEM, preserving forensic evidence before patching, restoring from a known-good backup, and rotating local passwords, key-encryption keys, and SSL certificates.

GitLab and Cisco: CI/CD and firewall exposure

CVE-2026-97229 is a CVSS 10.0 integer overflow or wraparound in GitLab CE/EE. According to The Hacker News, CISA added it to KEV on October 29. Alpine Linux said an unknown actor attempted to exploit the flaw against its unpatched instance on October 20 and 21, causing GitLab worker processes to crash eight times and downloading the GitLab container image. Maintainers treated the instance as compromised and rebuilt it from scratch, even though they found no evidence the attack fully succeeded. FCEB fixes were due by November 1. Teams should review CI/CD configuration anomalies, look for repeated GitLab process crashes, and restrict network access to GitLab APIs if they cannot patch immediately.

CVE-2026-76418 in Cisco Secure Firewall ASA and FTD is an unchecked return value to NULL pointer dereference with CVSS 8.6. It allows a remote unauthenticated attacker to force a reload, causing a denial-of-service condition. Cisco confirmed active exploitation but has not disclosed the attacker, victim count, or post-access actions. The practical impact is availability loss on a security device, which can disrupt traffic or force failover at a bad moment. Operations teams should track the official Cisco patch and watch for unexplained reloads.

Platform components: Brotli and PHP

CVE-2026-111497, tracked as Node2Shell, Broccoli2Shell, or HTTP2Shell, is a critical flaw in the Brotli decoder. BleepingComputer reports that a crafted Brotli-compressed stream can corrupt adjacent decoder state, disclose memory, cause denial of service, or potentially execute arbitrary code. It affects Node.js and vulnerable HTTP servers and clients. Microsoft issued an emergency .NET update because the flaw could be used to escalate privileges. CISA added the flaw to KEV and applied BOD 26-04 with a November 10 patch deadline.

If patching cannot happen immediately, block incoming Brotli-compressed requests at the proxy or firewall level, or disable Brotli decoding until updates are applied. After patching, restart affected processes and rebuild and redeploy affected container images.

PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities added to KEV after exploit attempts began before the October 21 patches. According to BleepingComputer, unprivileged attackers can gain remote code execution in high-complexity attacks. PoC code that leaked before the patches was not functional, and multiple security vendors saw pre-patch attempts as unsuccessful. PHP powers roughly 70% of all websites, according to W3Techs. VirusTotal estimates more than 5.1 million exposed PHP hosts and some 3.8 million instances with at least one open port. Teams should update PHP, watch for anomalies against Apache mod_php, and review the PHP team’s mitigation for CVE-2026-115560, an unpatched issue that applies only to an unusual combination of configuration and application code.

Immediate actions

• Map internet-facing assets to the KEV catalog, prioritizing VPN, gateway, GitLab, PHP, and any service using Brotli.
• For Ivanti and NetScaler, review logs and IOCs before patching and preserve forensic artifacts.
• For Brotli and PHP, apply updates, restart services, rebuild containers, and use proxy/WAF mitigation where patching is delayed.
• Forward relevant logs to a SIEM and use CISA’s SIGMA rule for NetScaler where applicable.

When the list of affected systems is too large to assess manually, a risk-based penetration test of the kind RiskForge provides can help separate genuinely exploitable gaps from noisy CVSS scores before patching.