Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
GitLab has patched a critical security flaw with a CVSS score of 10.0, the highest possible severity.
The vulnerability, CVE-2026-110264, could allow an unauthenticated attacker to execute arbitrary code on self-managed GitLab servers.
It affects GitLab versions dating back to 7.0, released in 2014.
GitLab says there is currently no evidence that the flaw has been exploited, but recommends updating to a patched version as soon as possible.
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
https://www.php.net/archive/2026.php#2026-10-21-5
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
https://www.wiz.io/blog/php2shell-php-rce
Corelight’s open-source Zeek and Suricata detection rules:
https://github.com/corelight/php2shell-detect
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
https://www.nlnetlabs.nl/projects/unbound/security-advisories/
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
Security recap from the last 24 hours that actually matters.
- PHP, 2 CVEs
- Node.js, 10 CVEs
- SSL, 8 eMudhra intermediate certificates compromised
- GitLab self-managed, 1 CVE rated 10.0
What's the problem?
PHP
- CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2
- Unauthenticated remote code execution in the PHP runtime itself
- Every PHP site serving web requests is affected, so WordPress, Laravel and Drupal too
- Exploit attempts are already being reported
Fixing PHP
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix.
Node.js
- 4 High, 3 Medium, 3 Low
- A brotli decoder bug that can lead to remote code execution
- TLS hostname checks that can be bypassed with oddly written IP addresses
- dns.resolve breaking on names with null bytes
Fixing Node.js
Upgrade to 22.23.4, 24.22.1 or 26.12.1. EOL versions stay vulnerable.
eMudhra
- 8 intermediate certificates from this CA were compromised
- That means someone could forge HTTPS certificates
- Browsers already block them, but Node apps, containers, VPNs and CI keep trusting them until you update
Fixing eMudhra
Update Node, Go, your OS CA bundle and your container base images. If your site uses an emSign certificate, get a new one.
GitLab self-managed
- CVE-2026-110264, CVSS 10.0, unauthenticated remote code execution
- Fix is 19.5.1 plus backports. http://GitLab.com is already patched.
So, have you upgraded and patched?
If not, better talk to your team today. These are serious because the impact can be
- Attackers running code on your server without logging in
- Leaked user data and secrets
- Fake HTTPS certificates silently accepted by your backend services
🚨Один день в безопасности
• PHP: удалённое выполнение кода без аутентификации → https://www.php.net/archive/2026.php#2026-10-21-5. Все PHP сайты надо обновлять, патчи не полностью протестированы
• Node.js — 10 CVE (включая удаленное выполнение кода) → https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• NGINX — 5 уязвимостей (3 критические, возможное RCE в определённых конфигах) → https://nginx.org/en/security_advisories.html
• GitLab — критический релиз с CVE-2026-110264 (CVSS 10.0, unauthenticated RCE) + ещё ~11 уязвимостей → https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/, срочно обновляйте гитлабы
• Go/Python/Node.js/Браузеры/сетевые библиотеки — обновление из-за компрометации сертификатов eMudhra, благодаря индийской конторе, которая предположительно намеренно не выполнила протоколы безопасной генерации ключей, но входит в список базовых сертификатов во всех операционных системах.
Буквально твиттер сегодня:
- php2shell
- как я сделала минет незнакомцу
- gitlab CVE-2026-110264
- хорошо ли трахаются китайцы
- привет из Индии, eMudhra, 4
- 75% Украины
Toutes nos instances GitLab sont à jour (version 19.5.1).
Cette version corrige notamment la CVE-2026-110264, avec un score CVSS de 10.0
En savoir plus sur notre offre : https://bearstech.com/contact
En savoir plus sur cette mise à jour : https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
🚨 GitLab fixed CVE-2026-110264 yesterday (Oct 21): CVSS 10.0, unauthenticated RCE on self-managed GitLab, every version since 7.0.
Upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. Oct 12 patches are not enough.
https://www.threatwire.tech/news/gitlab-cvss-10-org-mode-rce-cve-2026-110264-fixed-oct-21
#GitLab#CVE#infosec
This week the internet’s core infrastructure got hit harder than most people realize.
1. PHP2Shell (CVE-2026-109618 & CVE-2026-109619)
→ Two critical unauthenticated RCEs in PHP core (use-after-free / OOM corruption tied to request handling and session.upload_progress)
→ CVSS 9.2 — fixed Oct 21 in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 after details leaked early
→ Exploitation attempts observed in honeypots (some before public disclosure)
→ Highest risk on internet-facing PHP, especially Apache mod_php
2. Node.js Brotli (CVE-2026-111497)
→ High-severity out-of-bounds write in the Brotli decoder that the project says permits remote code execution
→ Fixed Oct 21 in 22.23.4 / 24.22.1 / 26.12.1
→ Triggered when decompressing untrusted Brotli data (including via fetch() or certain body parsers)
→ No public exploits or confirmed in-the-wild exploitation reported as of Oct 22
3. LiteLLM supply-chain (v1.107.0)
→ Active compromise of the release pipeline
→ Malicious litellm==1.107.0 (all 7 PyPI wheels + matching Docker images) was live for roughly two hours on Oct 21
→ Credential stealer + remote code loader that executes on Python startup (even without importing the package)
→ Artifacts removed. Previous versions are safe. Stolen credentials were observed being used
4. eMudhra intermediate CA keys
→ Eight intermediate CA private keys generated with extremely weak entropy (some single-byte or tiny integers) and recoverable in seconds
→ Key-generation ceremony flaw from April 2025 — not a root-key compromise or infrastructure breach
→ Browsers blocked them starting around Oct 17–20. Non-browser TLS clients and system trust stores still need updates
5. GitLab (CVE-2026-110264)
→ CVSS 10.0 unauthenticated RCE via integer overflow in the regex compiler (Onigmo)
→ Affects self-managed GitLab CE/EE from version 7.0. Fixed Oct 21 across multiple branches (including 18.11.13 and the 19.x series)
→ Requires specific conditions. gitlabdotcom was already updated
6. PwnEscape (CVE-2026-99999)
→ Guest-to-host escape through the Linux host’s IPv4 networking stack (checksum offload metadata), not a bug in KVM itself
→ CVSS 9.3
→ Memory leak demonstrated against production sandboxes; full RCE shown in lab environments
→ Kernel patches available
Independent issues that surfaced in the same news cycle (multiple projects shipped security releases around Oct 21; PHP’s was accelerated by a leak).
If you’re exposed, move now:
PHP (anything public) → LiteLLM (rotate secrets if you installed 1.107.0 or pulled affected Docker tags) → GitLab self-managed → Node.js (if processing untrusted Brotli) → trust stores and kernel (if running untrusted guests)
Most teams will miss at least one of these. Don’t be one of them.
CRITICAL: GitLab CVE-2026-110264 (CVSS 10.0) allows unauthenticated RCE on every self-managed release since 7.0. The October 12 patch is NOT enough. Upgrade now. Need help? Contact FORTBRIDGE. #GitLab#CyberSecurity#InfoSec https://t.co/fBA163X1gJ
🔥 Take a look at the CVE-2026-110264 airdrop, featuring the $GitLab token in the Solana memecoin scene. Explore crypto with $SOL.
CA=8p1RGJ45rviUKce27bVzzkXGqf8WdAPGLXCyDMXAEGA8
https://drops-onsol.netlify.app/?cve2026110264=8p1RGJ45rviUKce27bVzzkXGqf8WdAPGLXCyDMXAEGA8
Patch Now | Oct 22
PHP2Shell: confirmed exploited 19 min after yesterday's patch. Update now.
GitLab (CVE-2026-110264, CVSS 10.0): second max severity RCE in 9 days, reaches back 12 years.
UpdraftPlus: hidden admin accounts planted via cloud service abuse. https://t.co/s46aGSLu9o
🔥 Take a look at the CVE-2026-110264 airdrop, featuring the $GitLab token in the Solana memecoin scene. Explore crypto with $SOL.
CA=8p1RGJ45rviUKce27bVzzkXGqf8WdAPGLXCyDMXAEGA8
https://drops-onsol.netlify.app/?cve2026110264=8p1RGJ45rviUKce27bVzzkXGqf8WdAPGLXCyDMXAEGA8
