Security Thursdays by yisusvii — 2026-11-05

Table of Contents

Weekly Briefing

This edition covers Thursday, October 29 through Wednesday, November 4, 2026, in America/Mexico_City (UTC−06:00): October 29 at 00:00 inclusive through November 5 at 00:00 exclusive. Execution was captured once at 2026-11-05 08:08:13−06:00, the same instant stored in the frontmatter. Later developments are excluded.

This week’s theme: follow the trust boundary, not just the severity score. Priorities are exploited internet-facing services, a package-manager verification bypass, and upload processors that hand untrusted files to powerful native tools. Browser and mobile updates also matter: a server-only inventory misses widely deployed remote-code-execution risks.

Scope limitation: This is a selective review, not an exhaustive vulnerability inventory. Broadcom advisory data and parts of Fortinet’s advisory site were inaccessible; official feeds and CVE publisher records provided only partial alternatives. A current weekly-roundup cross-check could not be completed. The Linux entry explicitly separates verified upstream guidance from unverified appliance firmware details.

🚨 Cybersecurity News of the Week

1. APT can install a substituted package after verification

On November 4, Debian and APT’s developers disclosed CVE-2026-109518. Incorrect handling of download retries and hard links can let an attacker controlling the package-download path substitute an unverified package. Installation can then execute attacker-controlled code as root, the operating system’s administrative account. This is a verification bypass, not evidence that Debian’s signing keys were compromised. Debian DSA-6607-1; APT maintainer announcement.

Exposure requires control of HTTP download traffic, such as a malicious mirror, proxy, or on-path attacker, and nonzero Acquire::Retries. That setting defaults to 3 starting with Debian 12 and Ubuntu 22.04; older systems can also be exposed when scripts enable retries. Do not equate every Debian-derived machine with an exploitable deployment. Ubuntu advisory, dated November 4.

Who should act: OS administrators, image maintainers, and build-platform owners. Update APT through your distribution’s trusted security channel, then refresh build images. The cited primary advisories do not confirm exploitation in the wild. Package sources using HTTPS should not be treated as a complete substitute for the fix; the documented attack concerns HTTP, and malicious endpoint/proxy trust still needs assessment. Exact versions appear below.

2. PHP, Brotli, and Rails show why shared processing components matter

PHP: The vulnerabilities originally disclosed on October 21, covered in the October 22 edition, return because Tenable published original exploit-reliability research on October 29. Researchers reported that working code execution depended on the PHP build, server interface, extensions, worker behavior, and configuration. Their observed attack attempts did not compromise their five test sites by the report date. Those observations are not proof that other systems were safe. Tenable’s October 29 research.

The apparent disagreement is about portability, not whether the flaws exist: PHP documents demonstrated unauthenticated code execution, while Tenable explains why one exploit does not transfer unchanged between deployments. CISA lists both PHP CVEs as exploited, with October 26 additions—background predating this window, not new additions this week. Operators should patch exposed PHP services and seek appliance-vendor updates rather than assuming a failed probe proves safety. PHP advisory; CISA KEV.

Brotli: An omission check also surfaced CVE-2026-111497, affecting a shared decompression library bundled with Node.js. The Node fixes predate this window, but Palo Alto Networks records additional PAN-OS hotfix releases on October 29, and Siemens published an affected-product advisory on October 30. This changes the operational scope: application-runtime owners are not the only people who need to check embedded copies. Exploitation is confirmed by KEV at the component level; it is not confirmed against each downstream product. Node.js advisory; Palo Alto Networks advisory and timeline; Siemens advisory.

Rails: On November 4, Rails released 8.0.5.2 and 8.1.4.1, addressing 21 issues. Two especially important Active Storage advisories concern arbitrary file access through ImageMagick and extension-selected processing by FFmpeg/ImageMagick. These are separate from PHP2Shell and Brotli. Neither Rails advisory had a CVE identifier when checked; their GHSA identifiers are retained rather than inventing CVEs. Rails release announcement.

Who should act: Rails teams accepting untrusted attachments, especially applications retaining older ImageMagick processing defaults. Upgrade, validate the media-processing policy, and follow the advisory’s secret-rotation guidance where applicable. A patch does not recover an already disclosed secret; rotations can invalidate sessions and signed URLs. Details and configuration prerequisites follow below. Image analysis advisory; media processing advisory.

3. CISA adds GitLab and WordPress server-code-execution flaws to KEV

On October 29, CISA added CVE-2026-97229, a GitLab CI/CD regular-expression compiler flaw originally disclosed in GitLab’s October 12 patch release. GitLab describes unauthenticated server code execution under certain conditions. CI/CD means continuous integration and delivery; the vulnerable processing runs on the GitLab server, so treating this only as a runner problem misses the affected component. GitLab advisory; CISA KEV.

On November 3, CISA added CVE-2026-119977, the WordPress upgrade-window flaw fixed in 7.1.4 on October 28. Wordfence dates public disclosure to October 28; the CVE publisher record was published October 31. The weakness involves web-accessible staging during full-package core upgrades, not unrestricted code execution against every idle WordPress installation. WordPress release; Wordfence record; CVE publisher record.

Who should act: Self-managed GitLab administrators and WordPress site/hosting owners. Verify fixed versions and review incident indicators on exposed, previously vulnerable systems. GitLab says GitLab.com and Dedicated tenants were already patched for the October release. KEV establishes exploitation evidence, not that every instance was compromised, and does not provide a victim count.

4. Ivanti documents additional links in an exploited Connect Secure chain

Ivanti’s advisory was initially published October 13 and revised October 29. It now describes CVE-2026-111357 and CVE-2026-118527 alongside CVE-2026-104935. Ivanti explicitly confirms exploitation affecting a limited number of customers when the three are chained. CISA added the two additional CVEs on October 30; the initial CVE had entered KEV on October 13. Ivanti advisory; CISA KEV.

The components have different prerequisites: remote unauthenticated command execution, local authenticated privilege escalation, and remote authenticated upload to a predictable location. A medium-scored component can therefore be operationally urgent as part of an exploited chain.

Who should act: Connect Secure appliance owners. Check the exact release branch, apply a build fixing the entire disclosure, and use Ivanti’s integrity-checking and recovery guidance if compromise is suspected. Updating software is not an incident-response substitute, and a clean integrity check alone should not be treated as proof that no compromise occurred.

5. Android and Chrome updates deserve a place beside server patches

Google published the November Android bulletin on November 2. It includes a critical Framework remote-code-execution issue requiring neither additional privileges nor user interaction. The bulletin names updated AOSP branches; AOSP is Android’s open-source platform, not a promise that every device manufacturer has shipped an update. Android bulletin.

On November 3, Chrome 157’s stable release fixed critical graphics-related memory-safety issues, including CVE-2026-121156 in Dawn. Google’s CVE record describes potential code execution outside the sandbox through a crafted HTML page. That is more serious than assuming every browser crash stays inside an isolated renderer. Chrome release; Google’s CVE record.

Who should act: Endpoint administrators and individual device owners. Verify installed browser versions after relaunch and check the device’s actual Android security patch level. Neither cited Google announcement explicitly confirms active exploitation of these selected CVEs. Additional issues fixed in the same releases should be handled by the same update rollout, not separate patch projects.

🛡️ CVEs That Deserve Attention

How to read this table: Emergency means confirmed exploitation or verified immediately dangerous exposure. High means serious risk in realistic deployments; Medium depends on specific access/configuration; Monitor means available evidence does not justify urgent action. Priorities are editorial, not vendor deadlines. The list exceeds the usual seven-CVE target to preserve complete exploit chains and include broad runtime, kernel, mobile, and browser exposure.

Evidence snapshot: The directly retrieved CISA catalog was 2026.11.04, released November 4 at 20:00:05 UTC, inside this research window. KEV means Known Exploited Vulnerabilities. Absence from it is not evidence that exploitation has not occurred. Unless stated otherwise, the cited primary sources did not establish a public weaponized exploit; that is an evidence limit, not a claim that none exists. No EPSS estimates are used. Direct CISA catalog.

Ivanti chain: separate the entry point from the follow-on capabilities

• CVE-2026-104935: Ivanti’s table lists 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; resolved builds include 25.1.1.2, 25.1.3.0/25.1.3.1, and 22.8R2.5, respectively. The remote unauthenticated issue is scored 8.6, CVSS 3.0, by Ivanti.
• CVE-2026-111357: Local authenticated privilege escalation, 8.8, CVSS 3.1, by Ivanti.
• CVE-2026-118527: Remote authenticated upload of attacker-controlled content to a known disk location, 4.3, CVSS 3.0, by Ivanti.
• The latter two affect 25.1.1.2 and earlier and 22.8R2.5 and earlier in the listed branches; fixes are 25.1.1.3 and 22.8R2.6. Thus, a build that fixes the first CVE alone is not automatically sufficient for the whole chain.

Ivanti recommends 25.1.1.3 or later for the relevant migration path and says 25.1.3.0 or later does not contain the disclosed vulnerability; 22.8R2.6 is the fixed bridge option. The advisory explicitly excludes 22.7.x and lower from this disclosure, not from all security risk. Follow its branch table rather than comparing version strings across release lines. Emergency priority follows confirmed chained exploitation, not the individual scores. Public-exploit availability was not independently established. Ivanti’s versions, scores, and recovery guidance.

PHP: both fixed releases matter; configuration is not a complete fix

For both CVEs, affected supported branches are 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. PHP assigns each 9.2, CVSS 4.0. Distribution backports can have different package versions; PHP 8.1 and older require vendor-specific support or migration, not an assumption that an old version label proves a patch is absent or present. PHP release guidance; OOM advisory; stale-state advisory.

CVE-2026-109618 concerns out-of-memory cleanup of incompletely initialized request state. PHP documents HTTP code execution under normal Apache mod_php configurations before application code runs. FPM handles startup failures differently; the advisory considers application-specific FPM exposure possible but does not demonstrate a complete FPM exploit for this CVE.

CVE-2026-109619 involves request-owned state surviving into another request handled by the same worker. Confirmed and conditional paths depend on early diagnostics, upload progress, fatal errors, and configuration. PHP documents a validated application-dependent FPM path for this second CVE. Neither “FPM is immune” nor “every SAPI has identical exploitability” is supported.

Action: Install a fixed release/backport, rebuild affected images, and restart workers. Partial mitigations for the second CVE include disabling session upload progress before request parsing and, on PHP 8.5, fatal-error backtraces; these do not cover every state-lifecycle path. Do not casually remove PHP memory limits: PHP’s first advisory describes that as incomplete mitigation with resource-exhaustion consequences. Prefer the patch and controlled request/resource limits. Emergency priority reflects KEV plus reachable web workloads; Tenable’s October 29 portability findings refine triage without cancelling the fix.

Brotli: follow embedded copies beyond Node.js

CVE-2026-111497 affects Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. Google’s publisher record assigns 9.2, CVSS 4.0, gives an original public date of February 27, and was published October 22. Node.js released its bundled fixes on October 21; CISA added the CVE on October 27, before this edition’s window. Google’s CVE record; Node.js advisory; CISA KEV.

The prerequisite is attacker-controlled Brotli-compressed input reaching the native decoder; using Node.js alone is not enough. Node identifies affected 22.x, 24.x, and 26.x releases, with fixed builds 22.23.4, 24.22.1, and 26.12.1. The impact includes memory disclosure, denial of service, and potential code execution. Update the deployed runtime/container or the separately bundled library, not just a system package that the application does not use. Public exploit availability was not independently verified; KEV is the authoritative exploitation evidence used here.

This week’s change: Palo Alto Networks’ timeline records availability of PAN-OS 11.2.4-h23, 12.1.4-h13, and 12.1.10-h3 on October 29. Exposure requires Brotli traffic inspection and TLS/SSL decryption on the dataplane; the management interface is not affected. PAN-OS 11.1 and 10.2 are listed as unaffected. Other affected release branches have their own fixed hotfixes: use the full matrix, not these three examples as universal upgrade targets. Disabling Brotli inspection is a vendor mitigation, not a software fix, and changes inspection coverage. Palo Alto Networks’ matrix, prerequisites, and timeline.

Siemens’ October 30 advisory identifies RUGGEDCOM APE1808 running affected PAN-OS and directs owners to the corresponding PAN-OS fix and customer support. Palo Alto Networks says it is not aware of malicious exploitation of its products; this does not contradict KEV’s broader component-level evidence. Emergency priority applies to exposed vulnerable decoders, not every appliance containing a copy of Brotli. Siemens SSA-898633; Palo Alto Networks exploitation statement.

GitLab: patch the server, not just its runners

CVE-2026-97229 affects CE/EE 19.2.x before 19.2.8, 19.3.x before 19.3.5, and 19.4.x before 19.4.2. GitLab assigns 10.0, CVSS 3.1 and describes unauthenticated server code execution through insufficient validation of CI/CD regular expressions. Install the fixed release for the applicable line or a newer supported patched version, following GitLab’s upgrade requirements. GitLab advisory and detection references.

The meaningful change this week is October 29 KEV inclusion, not a new patch. Emergency priority follows exploitation evidence and the consequences of compromising a development platform. Ruby’s October 23 notice confirms fixes to the underlying Onigmo regular-expression engine in Ruby 4.0.9, 3.4.12, and 3.3.13. That is relevant to shared dependencies, but does not prove that every Ruby application exposes GitLab’s vulnerable path. Updating a separately installed Ruby does not replace updating GitLab’s bundled runtime. Ruby project notice.

WordPress: the upgrade window is a prerequisite, not a reason to postpone upgrades

CVE-2026-119977 affects the vulnerable releases spanning 4.7.0 through 7.1.3, excluding branch-specific patched backports. Wordfence assigns 8.1, CVSS 3.1. The attacker needs no account, but must reach predictable web-accessible staging files during a full-package core upgrade. This is a timing-dependent exposure, not a claim that any request to any WordPress page yields code execution. Publisher version ranges; Wordfence advisory.

Update to 7.1.4 or the matching fixed backport, such as 7.0.8 or 6.9.11, rather than assuming only the newest major branch received fixes. WordPress confirms backports through the eligible 4.7 branch. Keep upgrades enabled; use the host’s supported upgrade procedure and restrict public exposure during maintenance where operationally appropriate. Maintenance controls reduce exposure but do not replace the patched upgrader. Emergency priority reflects November 3 KEV inclusion, not universal exposure. WordPress security release.

APT: use distribution versions, not just upstream numbers

CVE-2026-109518, disclosed November 4, receives 7.7, CVSS 4.0, from Canonical. The on-path/HTTP and retry prerequisites above explain High rather than an unconditional Emergency rating. The maintainer announcement describes the vulnerability, not confirmed attacks or a public weaponized exploit. APT announcement; Canonical advisory.

The maintainer lists fixed stable series including 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, and 3.2.1; versions below the corresponding fixed release on those branches need remediation. Debian’s stable trixie fix is 3.0.4. Ubuntu’s November 4 advisory lists 22.04: 2.4.15ubuntu0.1; 24.04: 2.8.4ubuntu0.1; 26.04: 3.2.1ubuntu0.1; 26.10: 3.3.3ubuntu0.1. Older Ubuntu branches have separate Ubuntu Pro packages and access requirements. Do not install a different distribution’s package to satisfy a numerical comparison.

Action: Obtain the correct fixed build using your approved trusted update process, accounting for the vulnerable download path during remediation. Refresh cached base images and verify the installed package afterward. Do not disable signature verification or assume changing the retry setting is a vendor-validated complete fix. Debian security advisory; Ubuntu package matrix.

Linux kernel: a downstream notice warrants checking the actual kernel

CVE-2026-98432 was originally published October 15; this week’s change is Fortinet’s November 2 PSIRT feed notice, bringing a downstream vendor response into scope. The Linux publisher record describes a use-after-free in IPv4 TCP option handling and assigns 9.8, CVSS 3.1. Remote exposure depends on a reachable listening service and the relevant IPv4-options path; the first issue is not the equivalent IPv6 path, and the request-migration variant has additional configuration conditions. This is potential kernel disclosure/corruption or denial of service, not verified reliable remote code execution on every Linux host. Linux CVE publisher record; Fortinet’s official feed.

The publisher identifies introduction at 4.4, with fixed upstream lines including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Distribution backports require checking the distribution’s package advisory, not just uname output. Install the applicable vendor kernel update and activate it through the supported reboot/live-patch procedure. Network filtering may reduce reachability but is not a kernel fix.

Unresolved detail: The full Fortinet advisory returned a block page. Its affected/fixed firmware matrix could not be verified; no Fortinet product or firmware version is asserted here. Appliance owners must obtain that matrix from Fortinet before choosing a build. High priority reflects the shared kernel and network-reachable memory-safety impact; no authoritative exploitation confirmation was found in the accessible sources.

Android and Chrome: patch-level labels and platform-specific builds matter

CVE-2026-58868 is a heap-buffer-overflow issue in Android Framework’s FrameDecoder.cpp, published November 2. Google’s record lists Android 14, 15, 16, 16-qpr2, and 17, with no additional privileges or user interaction required for remote code execution. The bulletin places it in the 2026-11-01 patch level; 2026-11-05 or later covers the entire November bulletin. Those labels were announced November 2, not later developments inferred from the edition date. Google’s CVE record; Android bulletin.

Device-specific reachability, firmware build numbers, and rollout availability are not established by the AOSP table. Use the manufacturer/carrier update path and verify the installed patch level. No numerical CVSS score is supplied in the cited Google record; Google’s severity is Critical, while this edition’s operational priority is High absent confirmed exploitation.

CVE-2026-121156, published November 3, affects Chrome before 157.0.8103.38. Google’s record describes a Dawn buffer overflow reachable through crafted HTML with potential code execution outside the sandbox. The stable fixes are 157.0.8103.38 on Linux and 157.0.8103.38/.39 on Windows and macOS; use the current fixed build offered for the platform. Android Chrome’s corresponding release is 157.0.8103.38. Do not apply those version instructions to iOS or assume another Chromium-based browser ships Google’s release simultaneously. Chrome desktop release; Chrome Android release; Google CVE record.

Google rates the Chrome issue Critical, without a numerical CVSS score in that record. High priority follows realistic web-content exposure and possible sandbox escape, not a claim of confirmed exploitation. Relaunch the browser and verify the installed version; an update download alone does not establish that the running process is fixed.

Rails advisories without CVEs: do not wait for an identifier

Both November 4 advisories affect activestorage < 8.0.5.2 and >= 8.1, < 8.1.4.1. Fixed releases are 8.0.5.2 and 8.1.4.1. Older Rails lines are unsupported; the release announcement says 8.0 security support ends November 7, so remediation also needs a supported-line migration plan. Rails announcement.

• GHSA-f3w6-w445-fwh9: Rails assigns 9.8, CVSS 3.0. Exposure requires untrusted uploads, ImageMagick processing through :mini_magick, and a policy not already blocking dangerous coders. The advisory says Debian/Ubuntu’s packaged policies do not block those coders. Attaching a file is sufficient to invoke analysis; a separate preview request is not required. Arbitrary writes are possible; with Disk storage, readable application files and secrets may also be exposed. The fix installs a restrictive ImageMagick policy and requires mini_magick >= 5.1 for that processor. Custom MiniMagick environment/shell overrides can bypass policy application. Image analysis advisory.
• GHSA-v924-7rp8-4mxh: Rails assigns 8.8, CVSS 3.1. Exposure requires untrusted uploads and the affected audio/video analysis, previews, or ImageMagick processing. The described AviSynth code-execution path additionally requires an FFmpeg build enabling AviSynth and the AviSynthPlus runtime; common upstream/distribution/Homebrew packages do not enable it. Other extension-selected decoders can remain reachable. The fix checks the temporary filename extension against the recorded content type. Media processing advisory.

Action: Upgrade, test ordinary uploads and formats your application supports, and confirm the shipped policy is effective. If you cannot upgrade, use the advisories’ narrowly scoped processing restrictions/policy workarounds; disabling one FFmpeg capability does not fix ImageMagick exposure. Follow their secret-rotation guidance for affected Disk/AviSynth configurations. Rotating secret_key_base expires sessions and invalidates signed/encrypted artifacts; plan that operational impact instead of retaining an exposed fallback key. These are High-priority configuration-dependent flaws, not evidence that every Rails application is compromised.

🔧 Basic Security Tool of the Week

zizmor — offline CI/CD security analysis. Developers and platform engineers can inspect GitHub Actions definitions for unsafe permissions, credential handling, and injection patterns without executing workflows. It is free, open source, and MIT-licensed; local offline use requires no account or token. This differs from the secret-pattern scanning in the previous published edition’s Gitleaks exercise. Official repository; license.

Maintenance check: The latest listed release was v1.32.0, November 2, 2026 UTC; the official commit feed showed activity on November 3. This release adds experimental workflow-lockfile support and audit fixes. The example uses stable, documented offline behavior, not experimental lockfile guarantees. Release feed; release notes; activity feed.

Installation and one safe example: On Linux/macOS, use an existing Python installation with venv and pip. PyPI access is needed for installation, but the audit is offline. The following creates a fresh scratch directory and a deliberately over-permissioned local fixture; it does not create or run a real GitHub workflow.

workdir="$(mktemp -d)"
cd "$workdir"
python -m venv .venv
.venv/bin/python -m pip install 'zizmor==1.32.0'
cat > workflow.yml <<'YAML'
name: Local audit fixture
on: workflow_dispatch
permissions: write-all
jobs:
  example:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Local fixture only"
YAML
.venv/bin/zizmor --offline --persona=pedantic workflow.yml

The PyPI installation, --offline, and persona options were checked against installation documentation and usage documentation. The equivalent fixture was executed locally on Linux with v1.32.0: it reported excessive-permissions, anonymous-definition, and concurrency-limits, returning exit code 14 for the High-severity finding. That nonzero result is expected, not a tool crash.

Interpretation: excessive-permissions identifies the fixture’s write-all token scope. In an authorized real workflow, replace unnecessary broad grants with the specific permissions each job needs. The pedantic persona intentionally surfaces additional code smells; the default persona suppressed these fixture findings in the local check. Permissions audit; personas and exit codes.

Limits: Static findings need human review. Offline mode deliberately skips audits needing online information; a clean scan does not prove actions, runners, dependencies, or the repository are uncompromised. Do not use autofix or submit workflow changes without reviewing their effect on builds and releases.

💡 Security Tip of the Day

Today’s tip: Spend 5–10 minutes recording the installed APT version on one authorized Debian/Ubuntu host and comparing it with that host’s distribution-specific fixed version.

Why: A base-image tag or upstream version alone cannot establish whether the APT verification fix is deployed. Ubuntu and Debian use different package revisions, and older supported channels may require subscription access. Debian advisory; Ubuntu advisory.

Apply and verify: Read the host’s OS-release information and use its package manager’s installed-package details to record the full APT package version, including the distribution suffix. Compare it with the matching row in the advisory—not a row from another OS release—and assign an owner if it is behind. Repeat the inventory after the approved update. No exploit test, third-party scan, root shell, or repository-configuration change is needed for this inventory step.

Operational impact: The inspection is read-only. Updating APT or rebuilding images is a separate controlled change; inventory does not protect the download path or prove that prior package installations were trustworthy. Do not disable package authentication to obtain the fix.

✅ Security Actions for This Week

1. Handle exploited services first: Verify Ivanti’s entire chain is fixed, patch affected self-managed GitLab and WordPress, and start incident assessment where indicators or exposure history warrant it. A patch alone does not remove a prior foothold.
2. Finish shared-runtime remediation: Patch PHP and exposed Brotli/Node.js decoders, refresh images, and restart affected workers. Check appliance-vendor builds too: October 29 PAN-OS hotfixes extend the Brotli response beyond applications. Treat PHP exploit-portability research as triage evidence, not permission to leave vulnerable runtimes deployed.
3. Protect the update path: Install vendor-fixed APT through a trusted process, then refresh base images. Check kernel package advisories and obtain Fortinet’s missing firmware matrix before selecting appliance updates.
4. Review upload-processing boundaries: Upgrade Rails Active Storage, verify the ImageMagick policy and MiniMagick prerequisite, and follow applicable secret-rotation guidance with a session/URL invalidation plan.
5. Verify endpoint rollouts: Confirm running Chrome versions after relaunch and manufacturer-provided Android patch levels. Record devices for which a supported update is not yet available rather than assuming an announcement equals deployment.

Sources

• CISA: direct Known Exploited Vulnerabilities catalog.
• Debian: DSA-6607-1, November 4 APT security update.
• APT maintainers: November 4 security announcement and fixed series.
• Canonical: CVE-2026-109518 and Ubuntu package matrix.
• PHP: October 21 advisory and fixed releases.
• PHP: OOM corruption advisory.
• PHP: stale global-state advisory.
• Tenable: October 29 PHP exploit-reliability research.
• Node.js: October 21 security releases, including Brotli.
• Google CVE publisher record: Brotli CVE-2026-111497.
• Palo Alto Networks: Brotli impact, configuration requirements, and dated hotfix timeline.
• Siemens: October 30 SSA-898633 for RUGGEDCOM APE1808 with PAN-OS.
• GitLab: October 12 critical patch release and detection guidance.
• Ruby: October 23 underlying regular-expression engine fixes.
• WordPress: October 28 release of 7.1.4.
• Wordfence: WordPress upgrade-window vulnerability record.
• CVE publisher record: WordPress CVE-2026-119977.
• Ivanti: October 13 advisory, revised October 29.
• Rails: November 4 security releases.
• Rails: Active Storage ImageMagick file access.
• Rails: Active Storage extension-selected media processing.
• Linux CVE publisher record: CVE-2026-98432.
• Fortinet: official PSIRT feed, including November 2 kernel notice.
• Google: November Android security bulletin, published November 2.
• Google CVE publisher record: Android CVE-2026-58868.
• Google: November 3 Chrome stable desktop release.
• Google: November 3 Chrome Android release.
• Google CVE publisher record: Chrome CVE-2026-121156.
• zizmor: repository, license, v1.32.0 release, release feed, and activity feed.
• zizmor: installation, usage, personas, and exit codes, and permissions audit.