PHP flaws let attackers run code on web servers without a login
Cloudflare and Arctic Wolf have seen exploitation attempts, and PHP fixed both flaws in releases for its four supported branches.
Daily Brief
Thursday, October 22, 2026
Added to KEV
No additionsNo additions to the catalog in this edition’s window.
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.21
Vulnerabilities and patches
4 itemsGitLab flaw lets attackers run code on servers without a login
Every self-managed version back to 7.0 is affected, and GitLab has released fixes but hasn’t said whether anyone has exploited the flaw.
Java’s trust in eMudhra’s compromised certificate authorities now has a fix
OpenJDK says , which Oracle rates 9.1, concerns the eight intermediates, and the incident site lists patched Node.js releases too.
Fortinet schedules FortiOS fixes for Oct 22 and holds the details until Nov 10
Fortinet rates the flaws critical and high severity but hasn’t said what they let attackers do, and FortiMail and FortiAuthenticator fixes came out Oct 21.
Breaches and campaigns
2 itemsAttacker used LiteLLM’s release pipeline to ship a credential stealer
LiteLLM believes the attacker took developers’ GitHub CLI tokens from an internet-exposed internal deployment’s logs, and 1.107.0 was on PyPI for about 2 hours.
ConnectWise Cloud Backup
Microsoft Microsoft 365
Storm-0940 used AI agents to abuse ConnectWise’s app, Microsoft says
Microsoft says the China-state aligned group’s ARTEX agents tried to sign in to more than 2,250 tenants and changed app credentials and roles in some.
Coming up
3 itemsRuby on Rails 8.0 stops getting security fixes on Nov 7
The Rails maintenance policy gives the 8.1 series security fixes until Oct 10, 2027, and 8.0 stopped getting bug fixes on May 7.
Windows 11 23H2 and .NET 8 and 9 reach end of support on Nov 10
Microsoft says they get no more security updates after that, and the Windows date covers its Enterprise, Education and IoT Enterprise editions.
ColdFusion 2021 reaches end of support on Nov 10
Adobe stopped security patches for ColdFusion 2021 when its core support ended on Nov 10, 2025, and points customers to ColdFusion 2025.
Worth reading
1 itemCisco Talos
Cisco Talos on lures sent through trusted platforms’ notification emails
Talos saw abuse of more than 25 legitimate platforms in a year, including Staples order emails that passed DMARC and pushed recipients to call an attacker’s phone number.
Read: Cisco Talos on lures sent through trusted platforms’ notification emailsCorrections
1 correctionThis edition first went out without Fortinet’s Oct 21 notice of fixes due Oct 22, which it should have carried. Item 4 adds it.