Daily threat watch, 31 October 2026: 10 exploited CVEs added this week, 6 to act on now

The short version

Start with PHP, GitLab, the Cisco ASA and FTD firewalls, the Linux kernel and the Ivanti Connect Secure privilege flaw, where CISA's deadlines are near or already past. The two PHP flaws allow remote code execution without logging in.

CISA added 10 vulnerabilities to its exploited list from 25 October 2026 to 31 October 2026. 6 have a deadline within three days or already past, 2 of them past.

Separately, 605 new CVE records were published in the last 30 hours, 124 of them scored 8.5 or higher. They are in the day's CVE highlight, not on this list, because nothing says yet that anyone is using them.

Free analysis report · 6 pagesDaily threat watch, 31 October 2026: 10 exploited CVEs added this week, 6 to act on nowThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

What the week has in common

The two PHP flaws list the same weakness ids, and the two Ivanti Connect Secure flaws are described as chainable with each other and with CVE-2026-104935. Brotli and the Cisco firewall flaw both involve an unchecked return value. The rest have little in common.

Do this today, in this order

• PHP Group PHP, CVE-2026-109618, 2 days past CISA's deadline. PHP: the record says an out-of-memory corruption flaw allows unauthenticated remote code execution. Same product as CVE-2026-109619, with the same listed weakness ids. EPSS 1.00.
• PHP Group PHP, CVE-2026-109619, 2 days past CISA's deadline. PHP: the record says a stale internal request state allows unauthenticated remote code execution. Anyone hosting PHP sites, or paying someone to, should check. EPSS 1.00.
• Linux Kernel, CVE-2026-46300, due today. Linux kernel: the record says socket buffer handling can lead to unintended changes to page-cache-backed data when ESP input is processed. Anyone running Linux servers should check. EPSS 0.16.
• GitLab Community Edition and Enterprise Edition, CVE-2026-97229, due tomorrow. GitLab: the record says an unauthenticated user can run code on the server through a crafted regular expression in a CI/CD configuration. Anyone who self-hosts GitLab should look. EPSS 0.27.
• Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, CVE-2026-76418, due tomorrow. Cisco ASA and FTD firewalls: an unauthenticated remote attacker can make the device reload, causing denial of service. Whoever runs these firewalls, or manages them, must look. EPSS 0.01.
• Ivanti Connect Secure, CVE-2026-111357, due in 2 days. Ivanti Connect Secure: a local, logged-in user can gain higher privileges because of missing authentication. The record says it chains with CVE-2026-104935 and CVE-2026-118527. EPSS 0.00.

The first hour:

• List where you run PHP, GitLab, Cisco ASA or FTD, Ivanti Connect Secure and Linux servers, including any your IT provider manages for you.
• Apply the vendor's fix to PHP and GitLab first, then the Cisco firewalls, the Linux kernel and Ivanti Connect Secure.
• Ask your IT provider to confirm each fix in writing, and whether you use Adobe Commerce, Magento, VMware ESX or software that decodes Brotli.
• Review logs on internet-facing PHP, GitLab and Ivanti systems for activity you do not recognise.

• PHP Group PHP, CVE-2026-109618 →Who is affected, what to do first, and the analysis report.
• PHP Group PHP, CVE-2026-109619 →Who is affected, what to do first, and the analysis report.
• Linux Kernel, CVE-2026-46300 →Who is affected, what to do first, and the analysis report.
• GitLab Community Edition and Enterprise Edition, CVE-2026-97229 →Who is affected, what to do first, and the analysis report.
• Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, CVE-2026-76418 →Who is affected, what to do first, and the analysis report.
• Ivanti Connect Secure, CVE-2026-111357 →Who is affected, what to do first, and the analysis report.

This week

These are not due yet, but the estimated chance of exploitation in the next 30 days (EPSS) is 0.40 or more.

• Google Brotli, CVE-2026-111497, due in 10 days. Google Brotli: a crafted compressed stream from an unauthenticated remote source can corrupt memory, leak memory contents, crash the program or run code. Software that decodes Brotli is affected. EPSS 0.83.
• Adobe Commerce and Magento, CVE-2026-48356, due in 10 days. Adobe Commerce and Magento: an unrestricted file upload can lead to code running as the current user. Shop owners and the hosts who run their shops should look. EPSS 0.45.

• Google Brotli, CVE-2026-111497 →Who is affected, what to do first, and the analysis report.
• Adobe Commerce and Magento, CVE-2026-48356 →Who is affected, what to do first, and the analysis report.

In the next patch cycle

• Broadcom VMware ESX, CVE-2026-41709, due in 11 days. VMware ESX: someone with admin access can perform certain operations without them being logged. It needs admin access first, so it matters most to anyone relying on ESX logs. EPSS 0.01.
• Ivanti Connect Secure, CVE-2026-118527, due in 13 days. Ivanti Connect Secure: a logged-in remote attacker can upload files with content they control to a known location. The record says it chains with CVE-2026-104935 and CVE-2026-111357.

• Broadcom VMware ESX, CVE-2026-41709 →Who is affected, what to do first, and the analysis report.
• Ivanti Connect Secure, CVE-2026-118527 →Who is affected, what to do first, and the analysis report.

Check it yourself in two minutes

Everything above comes from public sources. This command prints CISA's additions in the same period with their due dates:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-25" and .dateAdded <= "2026-10-31")
    | [.cveID,.dateAdded,.dueDate,.vendorProject,.product] | @tsv' | sort -k2

Run on 31 October 2026 it printed 10 rows, the ones above. A later run may show more.

What we could not confirm

• CISA records ransomware use for each entry. Where it says unknown, that means not recorded, not that none has happened.
• EPSS is a probability for the next 30 days, recalculated daily. The figures are as at 31 October 2026 and will have moved.
• The exploited list names no attacker, so we do not guess one.
• The action order is a rule on CISA's own dates and EPSS. It is not a verdict on your estate. Check what you run first.
• The sentences about what each flaw is, what the week has in common and the first hour are our interpretation of the records, not a statement by CISA or the vendors.

• Today's mission →The same list, kept current through the day.
• The day's CVE highlight →New critical records worth reading, with the conditions the score leaves out.