This is the second issue of the NT IT security weekly. It covers week 44 of 2026 (from October 26), with data read up to November 1.
The conclusion first: almost no new major vulnerability appeared this week, but the status of last week's changed. The two PHP remote code execution flaws, the Brotli decompression flaw and one GitLab flaw — all at the top of our previous issue — were added this week to the United States CISA Known Exploited Vulnerabilities catalog, which means the agency considers them in use in real attacks. If you read last week's issue and decided to wait a little, this week's news is that during the wait, attacks began.
The one new thing most people should act on this week is WordPress 7.1.4 (October 28); the first item the project lists is a weakness in the upgrade process itself that may lead to remote code execution during the upgrade window. Separately, a modified Claude Code extension was distributed through the Cursor marketplace, and installing it attempts to leave an SSH backdoor behind.
And one item is not a new vulnerability but is worth reading on its own: Symfony published a correction saying its May advisory was wrong — the fix had been written but was never merged into a maintenance branch, so for five months no release contained it. A matching version number is not proof that a fix is present; section six covers it.
[official: US CISA] The United States Cybersecurity and Infrastructure Security Agency maintains a Known Exploited Vulnerabilities catalog, known as the KEV. An entry in that catalog means the agency considers the flaw to be in use in real attacks, not merely exploitable in theory. We read the data file CISA publishes itself, version 2026.10.30, which held 1766 entries at the time.
The entries added this week — October 26 to October 30 — are below, and the first three groups are the first three sections of our previous issue:
Two things not to misread. First, the due date field in the catalog is a remediation deadline for United States federal agencies, not a legal deadline for companies in general. That is not our inference: each entry's required action points at a CISA directive, BOD 26-04, and the directive states that it applies to agency assets in any "federal information system" and names Federal Civilian Executive Branch agencies, adding verbatim that "Unless directed by the governing procurement contract, this Directive does not apply to contractors." So the date is a useful read on how urgent the agency considers the item, but it is not your contractual obligation. Second, the ransomware campaign field on these entries is set to Unknown — which is not "no", it is "no data".
[official: Singapore CSA] The Cyber Security Agency of Singapore published an alert on October 30 whose first sentence reads, verbatim, that attackers are actively exploiting a critical Brotli vulnerability affecting multiple products to execute arbitrary code remotely or disclose sensitive information on affected systems, and to patch immediately. The agency gives the flaw a CVSS v3.1 score of 9.8 and states that a proof of concept is publicly available and the vulnerability is reportedly being actively exploited.
The agency also states the precondition for exploitation: an affected application has to decompress Brotli-compressed data that the attacker controls. That qualifier matters, because it decides whether your system is in scope at all.
The affected versions it lists are Node.js 22.x prior to 22.23.4, 24.x prior to 24.22.1 and 26.x prior to 26.12.1, plus Microsoft .NET 8, 9, 10 and 11. But the agency marks that list non-exhaustive itself, and PHP is not on it.
[official: PHP] This is the one item PHP users have to act on this week. On October 26 the PHP project announced rebuilt Windows packages: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, which include Brotli 1.2.1 and fix the same CVE-2026-111497. The announcement adds three sentences, and missing any one of them leads to the wrong decision:
-1 suffix identifies a Windows package rebuild with updated dependencies, that these builds use the same PHP source releases, and that the PHP runtime versions remain unchanged. In other words, running php -v will not tell you whether you replaced it.That last point is exactly the shape that the version-comparison method in Security Basics 01 misses: what to check here is not the PHP version but the rebuild number of your Windows package, and the Brotli version inside it.
The scores still disagree, as they did last issue: Singapore's CSA writes CVSS v3.1 9.8, while Node.js labels the same CVE high in its October 21 security release. We did not find the 9.8 figure in the Node.js advisory. Whichever label you take, the patched versions are the same set.
[official: GitLab] CVE-2026-97229, the entry CISA added, is titled by the vendor as an integer overflow issue in the CI/CD regular expression compiler affecting GitLab CE/EE, rated critical at CVSS 10.0, with patched versions 19.2.8, 19.3.5 and 19.4.2 released on October 12; the vendor gives the affected range as all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
So the way to map it is this:
The vendor also published six threat detections for self-managed users to look for exploitation attempts.
[official: GitLab] GitLab shipped another patch batch this week, and it belongs to the same thread as section 7 below. On October 29 it released 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14 (the vendor also states it skipped 19.5.2 and 19.4.4). The batch addresses CVE-2026-111943, whose official title reads "GitLab has removed trust for compromised eMudhra Intermediate CA Certificates for GitLab CE/EE" — the vendor says it removed trust for eight eMudhra intermediate CA certificates whose private keys have been compromised, from the certificate stores GitLab itself ships. Affected are all releases before 18.11.14, and 19.0 through 19.5 before their respective patch versions.
This batch is not a remote-code-execution fix, but it has three follow-ups that are easy to miss, all three stated by the vendor: upgrading GitLab does not update Runner, so a self-hosted Runner must also be upgraded to 19.5.1; the AI Gateway must be upgraded separately (the vendor lists 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 or later); and any CI/CD job image that ships its own ca-certificates package has to be rebuilt — the certificate store lives inside the image, so upgrading the server does not replace it. GitLab.com is already running the patched version, and GitLab Dedicated tenants on 19.4.3-internal0 or later already include the fix and need no action.
How we found this is worth writing down, because the listing page is unreliable: GitLab's patch release listing page returned no entries at all on our side, which is why the earlier version of this paragraph said the question could not be confirmed. The official patch release feed (https://docs.gitlab.com/releases/patch-releases.xml) does carry the data, and the feed's own updated timestamp is October 29, so the 19.5.3 batch is also the newest batch on the feed. To track GitLab patches, track the feed, not that page.
[official] WordPress released 7.1.4 on October 28, and it is the one new item this week that most people should act on. The project lists thirteen fixes, the first of which reads, verbatim, as a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window. Most of the rest are stored cross-site scripting issues across block markup, the Interactivity API, Customizer selective refresh, the Categories block, user logins, playlist and image blocks and comment pagination blocks, plus a stored denial of service issue in the Interactivity API and a permission issue where notes can be read by privileged users that lack access to edit the post the note is attached to.
One of the thirteen belongs to section seven: the project writes that this release also updates the bundled root certificates because of the eMudhra revocation. So the reach of that incident is not limited to browsers and server-side language runtimes; the trust store a CMS ships with is in it too.
[official: Cursor] On October 29 a modified Claude Code extension was distributed through the Cursor marketplace. The vendor states that the extension runs malicious code that attempts to install a persistent SSH backdoor, while also collecting host and user information and attempting to add an attacker-controlled SSH key.
This has the same shape as the LiteLLM incident in the previous issue, and together they make one very concrete point for both procurement and operations: whether what you installed has been tampered with depends on the security of the distribution channel, not on how well the project's code is written. That last step — rotating credentials from a trusted system — is the one most often skipped, and changing a password on a machine that may already carry a backdoor hands the new password over as well.
[official: Symfony] On October 29 Symfony published a note on the security entries in the October 28 releases (5.4.55, 6.4.49, 7.4.22 and 8.1.10), and part of it is a self-correction. The project writes that CVE-2026-45070, published in May, is an email header injection through the names of parameters in Mime headers, that it had said the flaw was fixed in 5.4.52, 6.4.40, 7.4.12 and 8.0.12, and that this was wrong — the fix was committed, but that commit was never merged into a maintenance branch, so no release contained it.
[official: Symfony] The flaw itself: the project's CVE page explains that the component responsible for serializing structured headers such as Content-Type and Content-Disposition validates and properly encodes parameter values but does not validate parameter names — the supplied name is emitted verbatim into the serialized header. So an application that derives a parameter name from untrusted input can place line-break bytes inside the name, terminating the current header and injecting additional headers. That page gives the affected range as versions below 5.4.55, the 6 series below 6.4.49, the 7 series below 7.4.22 and the 8 series below 8.1.10, and it now carries a correction of its own, stating verbatim that the versions it previously listed as fixed — 5.4.52, 6.4.40, 7.4.12 and 8.0.12 — do not contain the fix.
It is fixed now: 5.4.55, 6.4.49, 7.4.22 and 8.1.10. The project also notes that Symfony 8.0 is no longer maintained, so 8.0 users have to upgrade to 8.1.10. The test for whether to upgrade is stated precisely: upgrade if your application builds Mime headers with parameter names that come from user input.
The changelogs of the same releases also list CVE-2026-109413 (Yaml), CVE-2026-108082 (HttpFoundation) and CVE-2026-109449 (ExpressionLanguage), but the project states plainly that these releases change nothing for them: their fixes were released earlier on each branch — 6.4.45, 6.4.46 and 6.4.48 on the 6.4 line, 7.4.18, 7.4.19 and 7.4.21 on the 7.4 line, 8.1.6, 8.1.7 and 8.1.9 on the 8.1 line; on 5.4, all three were fixed in 5.4.54, released on October 15. A CVE appearing in a changelog does not mean a fix has just become available to install, and that paragraph exists to prevent exactly that misreading.
What this means for operations outweighs its severity rating: "the vendor says that version is fixed" and "that version actually contains the fix" are two different things. The method we gave in Security Basics 01 is to compare version numbers, and this time comparing version numbers returns the wrong answer. The only thing that closes that gap is verifying after patching, rather than reading what the advisory says.
Section three of the previous issue covered the leaked private keys of eight eMudhra intermediate certificates. There is a tracking report this week.
[official: Cloudflare, for its own network] Cloudflare's October 30 post states how weak the keys were: where a 115-digit number was expected, the eight values were 4, 56, 66, 115, 155, 156, 230 and 237. It writes that this incident is fundamentally different from past certificate authority compromises, because the affected intermediate private keys could be recovered almost instantly by anyone from the public certificates themselves. It also notes that eMudhra announced it is exiting the public certificate authority business and has claimed a mistake in a key generation script, but has not yet shared that script.
What it measured — limited to Cloudflare's own connections, over the week after logging finished rolling out on October 21 — was about 22,000 attempted handshakes using the weak keys, two thirds of them fetches of test sites. About 160 stood out: the subject alternative names on those certificates named other organizations' domains, unrelated to the server name requested in the handshake, and some were domains related to consumer IoT devices; those forged certificates were made after the keys leaked and some were valid for over two years, longer than any public certificate authority may issue.
Two sentences that belong together: Cloudflare states there is no evidence so far of the weak keys being used to intercept its connections, and the same paragraph states that this does not exclude carefully targeted interception. The detail most worth remembering is not a count but a time: one of the forged certificates it saw was dated October 20 at 18:19 UTC, less than an hour after Mozilla's bug report was made public.
To estimate how many clients remain unpatched, Cloudflare sent probe connections from its challenge pages, about 50 million probes over the week. It states its own caveat first, and that caveat belongs with the numbers: traffic to those pages is highly skewed by design, there are many unconfirmed bots in it, and only clients that execute JavaScript send probes. On those terms, its observation is that up-to-date modern browsers are mostly patched while bots and old browsers are not, and embedded browsers such as Android WebView lag behind, with 30 to 40 percent still accepting those certificates.
If your site is used inside an app's web view, or your client devices are IoT equipment, that paragraph is closer to you than the browser one.
[official] The stable and extended stable channels moved to 156.0.8078.79/.80 on Windows and Mac and 156.0.8078.79 on Linux, rolling out over the coming days and weeks. This update includes 21 security fixes, of which the only one rated critical is CVE-2026-76024, described as memory corruption in MediaStream. Most of the rest are rated high, concentrated in FileSystem, Quota, Skia, V8 and Blink, with one rated medium. This release note makes no mention of any flaw being exploited in the wild.
[official] LiteLLM's follow-up (October 30): section eight of the previous issue covered the compromise of LiteLLM's release pipeline on October 21. This week the project published a review titled around what it is changing after October 21, covering why the controls built after March did not stop that release, and the identity, credential and detection changes it is making. If your system depends on that AI gateway, this one matters more than the original incident report — it is about whether the same pipeline will fail again.
The same project announced a private registry on October 27, whose purpose is to give certain users access to fixes for severe vulnerabilities before public release. That is a design worth thinking through on the procurement side: it means patch timing becomes a tiered service. We did not verify its terms or pricing, and only note here that it exists.
[official] GitHub (October 28): GitHub's changelog carried no security incident this week, but two entries are relevant to operations: Dependabot alerts can be prioritized with reachability analysis — that is, whether the vulnerable code is reachable from your project at all — and push protection for leaked secrets now extends beyond predefined patterns. Neither is a patch; both make the question of what to fix first easier to answer.
8dbb08b on 12.x. The advisory gives its affected range as below v12.68.0 and below 13.29.0, and the first of those has no lower bound — so 10.x and 11.x are not excluded by that range, yet the advisory lists no patched version for them. We read the code: 11.x's v11.56.1 (August 25) contains a single fix commit, which changes user() and validate() in TokenGuard.php to check that the token is a string, and adds two tests — the same shape as the 12.x commit the project named. But no official text states that 11.x is fixed, so that identification is ours, inferred from the same change rather than stated by the project; anyone on 10.x or 11.x has to check against that version rather than the advisory date.This weekly runs once a week against a fixed source list, and every issue lists both what we checked and found nothing on and what we could not confirm — readers cannot see what we missed, so we have to say it ourselves. The next issue covers the week from November 2, and one item is already scheduled: the Next.js November security release on November 3.
NT IT is a systems software company with a custom development background, now working on the long-term maintenance of AI systems. If you are not sure which of your systems should follow this week's security updates, a system health check is a place to start.
Want to bring these practices into your own company?
Security
Asking what others budget for security, or what percentage of revenue it should be, tells you nothing about your own company. What actually sets your ceiling is working out what one day of downtime, or one breach, costs you. This piece gives owners a four-step calculation they can run themselves.
Security
Think your company is too small and has no confidential data, so nobody would come after you? Attack code scanning the internet does not look at company size, only at whether a door is shut. This piece breaks down why four things a small company holds are worth money: compute on your host, your domain and mailbox, your customer list and supply-chain trust, and the pressure of not being able to trade.
Security
The website, the admin panel, the mailbox, the third-party services — if you cannot list them, you cannot protect them. You do not need to understand the technology, but you do need one list that shows every outward-facing entrance. This piece covers four categories that get missed, with an inventory table an owner can fill in alone.
We build long-term relationships with a select few partners worth going deep with.
Need help?
Message us directly on LINE
