October 2026 security advisories: GitLab, PHP, Node.js, and certificate trust
Recent security advisories for GitLab, PHP, Node.js, Ruby, Go and Oracle, plus Fortinet updates, the eMudhra certificate incident and Zeabur response priorities.
Updated October 26, 2026 (Taiwan time). Recent security news combines product vulnerabilities, patch releases, a certificate trust incident, disclosure questions, and a cloud platform breach. Each calls for a different response. This article reviews significant recent CVEs and related incidents against original advisories, then sets out practical priorities for enterprise teams.
Timeline
Dates are the event or publication dates in the cited source. Zeabur’s incident timeline uses UTC. A disclosure date, a patch date, and a news date are not interchangeable.
| Date | Organization or product | Event | Identifier or advisory | Operational concern | Source |
|---|---|---|---|---|---|
| Aug 27 | Zeabur | August intrusion | Security incident, not a CVE | Stored secrets may have been exposed | August report |
| Oct 12 | GitLab | Separate patch release | CVE-2026-97229 | Conditional unauthenticated RCE | GitLab |
| Oct 13 | SAP | October Security Patch Day | CVE-2026-89111 and others | Four Critical issues | SAP |
| Oct 14 | Cisco Secure Email Gateway | Vulnerability advisory | CVE-2026-76519 | Cisco confirms exploitation | Cisco |
| Oct 14 | NGINX | Security releases | Five CVEs | Assess enabled modules and configuration | NGINX |
| Oct 14–15 | Zeabur | October intrusion | Security incident, not a CVE | Rotate secrets and review logs | October preliminary report |
| Oct 17 | eMudhra / emSign | Intermediate CA private-key concern reported | Certificate trust incident | Trust stores need attention | Mozilla incident record |
| Oct 19 | Zeabur | October preliminary report published | Security incident | Rotate secrets and review logs | Zeabur |
| Oct 20–21 | Python ecosystem | Certificate trust updates | Package advisories | An old CA bundle may continue trusting affected certificates | Python announcement |
| Oct 21 | GitLab | Critical patch release | CVE-2026-110264 and other issues | Unauthenticated RCE under specified conditions | GitLab |
| Oct 21 | PHP | Security releases | CVE-2026-109618, CVE-2026-109619 | Unauthenticated RCE | PHP |
| Oct 21 | Node.js | Security releases | CVE-2026-111497 and other issues | Brotli RCE; TLS and DNS validation | Node.js |
| Oct 21 | Go | Standard-library advisory | CVE-2026-111943 | Certificate verification in certain environments | Go vulnerability database |
| Oct 21 | Oracle Java | Security Alert | CVE-2026-91403 | JSSE vulnerability | Oracle |
| Oct 21–22 | Fortinet | Coordinated security updates announced | Check individual PSIRT entries | Plan device upgrades | Fortinet |
| Oct 21 | ZDI / Linux | Upcoming items listed | ZDI-CAN identifiers, not CVEs | Inventory features and track vendor fixes | ZDI |
| Oct 23 | Ruby | Onigmo fixes released | Related to four GitLab CVEs | Check compilation of untrusted patterns | Ruby |
| Oct 23 | PHP | Advisory for unusual session configuration | CVE-2026-115560 | Interim mitigation; full advisory pending | PHP |
Eleven verified CVEs to prioritize
Scores are included only where the cited vendor advisory states them. Do not rank CVSS v3.1 and v4.0 scores as if they used the same scale. “No vendor confirmation found” is not proof that exploitation has not occurred. These eleven are a focus, not a count of every vulnerability published that week. Four Critical SAP issues appear below; the PHP issue pending a full advisory and five NGINX issues rated medium by the vendor are outside this table.
| CVE | Product and issue | Published severity | Exploitation | Remediation priority |
|---|---|---|---|---|
| CVE-2026-110264 | GitLab integer overflow while compiling a regular expression; possible unauthenticated RCE | CVSS v3.1 10.0 | No vendor confirmation found | Upgrade to the fixed release for your branch; highest |
| CVE-2026-97229 | GitLab CI/CD regular-expression compiler integer overflow; possible unauthenticated RCE | CVSS v3.1 10.0 | No vendor confirmation found | Follow the October 12 patch release; highest |
| CVE-2026-109618 | PHP state corruption during out-of-memory handling; possible RCE | CVSS v4.0 9.2 | No vendor confirmation found | PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; highest |
| CVE-2026-109619 | PHP stale state across requests; possible RCE | CVSS v4.0 9.2 | No vendor confirmation found | Same fixed releases; highest |
| CVE-2026-111497 | Node.js Brotli decoder out-of-bounds write; possible RCE | High; no numeric score in cited advisory | No vendor confirmation found | Install the October 21 security release for your branch; high |
| CVE-2026-105482 | Node.js DNS name truncation at a NUL character | High; no numeric score in cited advisory | No vendor confirmation found | Same security release; high |
| CVE-2026-105483 | Node.js TLS hostname check bypass involving fullwidth digits in an IP address | High; no numeric score in cited advisory | No vendor confirmation found | Same security release; high |
| CVE-2026-106069 | Node.js TLS hostname check bypass involving a noncanonical IP representation | High; no numeric score in cited advisory | No vendor confirmation found | Same security release; high |
| CVE-2026-111943 | Go crypto/x509 verification of distrusted intermediates | Numeric score not verified here | No vendor confirmation found | Go 1.26.10 / 1.27.3; high |
| CVE-2026-91403 | Oracle Java SE / GraalVM JSSE | CVSS v3.1 9.1 | No vendor confirmation found | Follow the Oracle Security Alert patch document; high |
| CVE-2026-76519 | Cisco Secure Email Gateway arbitrary file write through AMP File Reputation; possible root-level commands | CVSS v3.1 9.8 | Cisco confirms active exploitation | Update Content Scanner Tools or AsyncOS and investigate devices; highest |
GitLab: verify the branch, then inspect for suspicious activity
GitLab says CVE-2026-110264 can allow an unauthenticated user to run code on the server under certain conditions by triggering integer overflow in regular-expression compilation. Its October 21 patch announcement provides the affected ranges. Fixed releases include 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Back up self-managed instances, upgrade using the procedure for the installation type, and review GitLab’s detection signals.
CVE-2026-97229 is also confirmed, in a separate October 12 GitLab release. It affects 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, and carries CVSS v3.1 10.0. Keep the publication dates and fixed-version boundaries for the two advisories separate.
Ruby: underlying Onigmo fixes
Ruby’s October 23 advisory says releases 4.0.9, 3.4.12 and 3.3.13 include fixes in the Onigmo regular-expression engine. GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on these underlying bugs. These are GitLab-assigned CVEs, not four additional Ruby CVEs. Some fixes had already entered Ruby 4.0.0 or 4.0.8; 4.0.9 contains all of them.
The relevant exposure is an application compiling an attacker-controlled string with Regexp.new, Regexp.compile or a similar path. Applications that only compile developer-written patterns do not meet that condition. Ruby warns that Regexp.timeout and a simple pattern-length limit are not reliable defenses. Update affected Ruby runtimes and redeploy; GitLab users must still follow GitLab’s own patch releases.
PHP: update running processes and images
The PHP security advisory identifies two issues that can lead to unauthenticated RCE. CVE-2026-109618 concerns partially initialized request data after an out-of-memory condition; CVE-2026-109619 concerns request state surviving after its backing memory is freed. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Inventory PHP-FPM, Apache modules, containers, and distribution packages with backported fixes. Rebuild images and restart workers, then check the version actually running. The CERT/CC vulnerability note provides an additional English-language assessment; the PHP advisory remains the source for upstream releases.
A separate October 23 PHP notice announces CVE-2026-115560 under an unusual combination: an application configures session.serialize_handler as php_binary or php_serialize, changes it to php at runtime before session_start(), and leaves session upload progress enabled. PHP recommends setting session.upload_progress.enabled=0 in such environments until its next regular release carries the full advisory. It is not one of the two October 21 Critical issues, and they do not share a confirmed fixed version.
Node.js and Java: separate the causes
The October 21 Node.js release includes separate Brotli, DNS and TLS vulnerabilities, alongside a CA certificate update associated with eMudhra. Treat the Brotli memory bug, hostname validation bugs and CA trust change as distinct work items. Update the deployed 22.x, 24.x or 26.x branch, rebuild runtime images, and check whether the application decodes untrusted compressed data.
Oracle’s CVE-2026-91403 Security Alert concerns JSSE in Java SE and GraalVM and assigns CVSS v3.1 9.1. The alert provides affected versions and a patch route. The cited Oracle alert does not establish a causal link to eMudhra. Track JVM patching and certificate trust updates separately.
Cisco, SAP and NGINX: assess the deployment conditions
Cisco Secure Email Gateway: exploitation confirmed
Cisco’s October 14 advisory assigns CVE-2026-76519 CVSS v3.1 9.8. With AMP File Reputation enabled and Content Scanner Tools older than 25.3.0.5525, a crafted email attachment can allow an unauthenticated attacker to write arbitrary files and execute commands as root. Cisco confirms active exploitation. Prioritize Content Scanner Tools 25.3.0.5525 or later, or the applicable fixed AsyncOS release, and investigate affected appliances. If compromise is suspected, preserve forensic evidence before following Cisco’s physical or virtual appliance recovery guidance; a routine upgrade alone does not establish that the device is clean.
SAP: a separate October 13 patch day
SAP’s October Security Patch Day lists four Critical issues: CVE-2026-89111, OAuth2 SSRF in Cloud SDK for Python before 0.45.2 (SAP score 10.0); CVE-2026-89110, access control in NetWeaver Visual Composer (9.9); CVE-2026-89107, code injection in S/4HANA (9.9); and CVE-2026-89108, missing authorization in Manufacturing Integration and Intelligence (9.1). These were published on October 13, not alongside the October 21 GitLab and PHP releases. Match affected products to SAP Security Notes and patches; do not rank these numbers against another CVSS version without checking the vector.
NGINX: five issues rated medium by the vendor
The October 14 NGINX release note and security list identify CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629 and CVE-2026-97205. They concern alias with rewrite, script evaluation, HTTP/3, TLS session tickets and asynchronous file I/O, respectively. NGINX rates all five medium and lists stable 1.30.6 and mainline 1.31.7 as fixed. Check the running version and enabled modules; do not treat a social-media “all 9.2” label as the vendor score.
Fortinet: a coordinated release is not one confirmed CVE
Fortinet’s October 21 announcement lists affected branches and fixed versions for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Examples of first fixed releases are FortiOS 7.2.14, 7.4.13, 7.6.8 and 8.0.2, and FortiMail 7.4.9, 7.6.7 and 8.0.2. Plan the actual upgrade using the device model and Upgrade Path Tool. Fortinet says individual public PSIRT advisories are planned for November 10; the version table does not establish each CVE, CVSS score or exploitation status. Candidate FG-IR-26-175 and FortiMail CVE-2026-104286 still need item-by-item PSIRT confirmation.
Export configurations and inventory versions before upgrading. Check the device against Fortinet PSIRT and the Upgrade Path Tool. FortiGate 90G is a hardware model; exposure depends on its FortiOS version and enabled features. Restrict Internet access to management interfaces. For HA clusters, confirm peer versions, compatibility, backups and rollback procedures before the maintenance window.
ZDI and Linux kernel: disclosure and fix status require separate checks
The ZDI Upcoming list includes Linux items dated October 21, including ZDI-CAN-33549 and ZDI-CAN-34076. A ZDI-CAN number is a tracking identifier, not a CVE. The list alone does not show that a full exploit was published or an intrusion occurred. Claims that reports were sent prematurely to the public Linux kernel mailing list need the original Message-ID, recipients, private reporting route and maintainer responses. Those were not fully verified here.
Mainline Linux, stable branches and distribution kernels do not necessarily receive the same change on the same day. Distributions may backport a fix without switching to the newest mainline release. Record uname -r, the distribution package version and whether a relevant feature is enabled, then consult the distribution advisory. ksmbd is an in-kernel SMB server, distinct from the user-space Samba server; installing Samba alone does not establish exposure to a ksmbd issue.
eMudhra / emSign: review every trust store in use
The Mozilla incident record documents an October 17 report and proof of control over eight eMudhra intermediate CA private keys. The Python ecosystem announcement describes unusually weak elliptic-curve private-key values. This is a key and trust incident. It does not by itself prove a CA server intrusion or confirmed malicious certificate use.
TLS clients validate a path from the server certificate through intermediate CAs to a trusted root. Applications may use an OS store, a bundled CA file or a custom trust store. Updating a browser alone does not ensure that server-side applications have stopped trusting an affected intermediate. See the site’s certificate-chain guide for the trust model.
The Python guidance recommends certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1. In particular, pip uses its vendored certifi; updating the OS trust store alone may not suffice. Check existing virtual environments, container images, CI runners and custom CA bundles.
The Go advisory explains that in some environments a system trust-store update does not fully address distrusted intermediates. Go therefore added a denylist in crypto/x509, fixed in 1.26.10 and 1.27.3. Applications built with an older Go toolchain may need rebuilding and redeployment. Node.js provides its CA update in the security releases; it is separate from the Brotli CVE.
Zeabur: keep the August and October investigations distinct
Read Zeabur’s August incident report separately from its October preliminary report. The October report says an attacker used leaked internal credentials on October 14–15 to access shared clusters, some dedicated servers and the platform database. Commands were run in 865 database services, not necessarily successfully in all 865; 101 GCP Dedicated Servers received root logins. Logging gaps limit what can be established about query results and later use of the data.
Zeabur says long-lived credentials left unrotated after August and plaintext storage widened the October impact. Its proposed path from the GitHub App private key exposed in August to the October starting credentials remains an unconfirmed hypothesis. The site’s earlier August note gives background; use Zeabur’s latest report for current response guidance.
Affected teams should revoke old API keys, database passwords, OAuth and cloud credentials, and signing keys; create replacements and redeploy; then inspect GitHub, cloud, database and billing logs. Changing a Zeabur environment variable does not change a password inside a database. Treat access that cannot be ruled out as potential exposure without claiming every queried record is confirmed exfiltrated.
Enterprise response priorities
| Role | First actions |
|---|---|
| SOC | Investigate with vendor detection signals and asset exposure; preserve timestamps and logs; distinguish a PoC, a scan and confirmed exploitation. |
| IT administrator | Inventory GitLab, PHP, Ruby, JVM, Node.js and Go versions; apply the appropriate branch fix and verify the running version. |
| Network engineer | Restrict Fortinet management access; plan HA compatibility, backup and upgrade path using PSIRT guidance. |
| Mail administrator | Check Cisco SEG AMP File Reputation and Content Scanner Tools; preserve logs and assess compromise because exploitation is confirmed. |
| DevOps / SRE | Rebuild images and CI runners; update CA bundles; rotate secrets and inspect cloud and billing records. |
| Software developer | Assess handling of untrusted Brotli and TLS inputs, then test compatibility after upgrades. |
| Security leader | Prioritize by reachability, privileges, business impact and credible exploitation evidence. |
These read-only commands can start an inventory. A displayed version does not replace a distribution vendor’s backport information:
1
2
3
4
5
6
7
uname -r
php -v
node --version
ruby --version
python3 --version
go version
java -version
Remediation checklist
- Record product, release branch, deployment method, exposure and owner.
- Check CVE, CVSS version, affected releases and fixed releases against original advisories.
- Back up and verify rollback before upgrading GitLab, PHP, Node.js and the relevant JVMs.
- Check whether Ruby compiles untrusted patterns, and update affected runtimes.
- Inventory Cisco SEG settings and Content Scanner Tools; preserve evidence first if compromise is suspected.
- Match SAP products and NGINX modules to their original advisories and fixed releases.
- Use Fortinet PSIRT and its Upgrade Path Tool for device and HA plans.
- Update Python tools, CA bundles, Go toolchains and affected container images.
- Revoke potentially exposed secrets before creating replacements and redeploying.
- Preserve audit logs and review unusual access, deployment changes and bills.
- Keep unresolved ZDI and LKML claims under review through vendor announcements.
Conclusion
The response spans three kinds of work: patching verified product CVEs, correcting certificate trust across application ecosystems, and responding to a cloud-platform breach. Confirm exposure from original advisories, then prioritize upgrades and credential rotation.
Fact-check record
Checked October 26, 2026 (Taiwan time). “Not verified here” does not mean that an issue does not exist. Recheck items when vendors publish more detail.
Confirmed
| Item | What the original source establishes |
|---|---|
| GitLab CVE-2026-110264 | Patched October 21; conditional unauthenticated RCE; CVSS v3.1 10.0. GitLab |
| GitLab CVE-2026-97229 | Separate October 12 patch; conditional unauthenticated RCE; CVSS v3.1 10.0. GitLab |
| Ruby Onigmo | October 23 releases 4.0.9, 3.4.12 and 3.3.13 contain the underlying fixes related to four GitLab CVEs; these are not four additional CVEs. Ruby |
| Cisco SEG CVE-2026-76519 | October 14 advisory; CVSS v3.1 9.8; Cisco confirms exploitation. Cisco |
| SAP October patches | Four Critical CVEs published October 13. SAP |
| NGINX October 14 updates | Five CVEs rated medium by NGINX; fixed in 1.30.6 / 1.31.7. NGINX |
| PHP CVE-2026-115560 | October 23 informational notice; unusual session configuration; full advisory pending. PHP |
| PHP CVE-2026-109618 and CVE-2026-109619 | October 21 fixes; possible unauthenticated RCE; CVSS v4.0 9.2. PHP, CERT/CC |
| Node.js CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 | Listed as High in the October 21 release; different Brotli, DNS and TLS issues. Node.js |
| Go CVE-2026-111943 | crypto/x509 denylist and fixes in Go 1.26.10 / 1.27.3. Go |
| Oracle CVE-2026-91403 | Separate JSSE alert; CVSS v3.1 9.1. Oracle |
| Fortinet release plan | October 21 announcement lists affected branches and fixed releases; individual PSIRT advisories are scheduled for November 10. Fortinet |
| eMudhra and Zeabur | Mozilla records proof of control over eight intermediate keys; Zeabur documents its October intrusion with stated logging limits. Mozilla, Zeabur |
Not yet verified or excluded from the CVE table
| Lead | Reason |
|---|---|
| Eleven other GitLab candidate CVEs | CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-15723, CVE-2026-16255, CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-112212, CVE-2026-112326 and CVE-2026-112378 appear in the GitLab release, but have different severities and causes. They must not all be called critical RCEs. |
| Fortinet FG-IR-26-175; FortiMail CVE-2026-104286, score and KEV | A complete matching PSIRT record was not verified. Do not infer CVE mapping or exploitation; the October 21 Fortinet article does give fixed branches. |
| ZDI-CAN-33549, 33774, 34068, 34076, 33367, 33887 and LKML claims | Only some tracking numbers could be checked in ZDI Upcoming. Original mail records, component mappings and kernel fixes need checking. |
| eMudhra “six TLS and two code-signing intermediates,” individual fingerprints and misuse | Individual certificates and trust-store actions were not fully checked. Continue with Mozilla’s record. |
| Zeabur 321,810 accounts and 3,218,965 environment-variable records | Definitions were not individually verified against the preliminary report. The 865 figure counts database services where commands ran, not proven successful reads of all databases. |
| Zeabur August NextChat / MCP / Legacy API Key chain | Individual steps need confirmation against the August report. |
| Dell, Microsoft, other Cisco/SAP products, Citrix, IBM, other NGINX and Linux KVM candidates | These were not checked individually; the confirmed Cisco SEG, four SAP and five NGINX items appear above. |
Keep identifiers and causes separate: a CVE is a vulnerability identifier; GHSA is an advisory identifier; ZDI-CAN is a tracking number. A Zeabur intrusion or certificate-trust incident is not automatically a new CVE. Oracle’s JSSE alert is not shown to be caused by eMudhra, and Zeabur itself labels the proposed link from its August key leak to October’s initial credentials a hypothesis. When adding a pending item, retain the original advisory, first publication date, affected and fixed versions, CVSS version, exploitation evidence and date checked.
References
Sources revisited October 26, 2026 (Taiwan time). Advisories may change after publication.
- GitLab critical patch release
- GitLab October 12 patch and Ruby Onigmo fixes
- PHP security advisory and CERT/CC vulnerability note
- PHP October 23 session upload progress notice
- Cisco SEG CVE-2026-76519, SAP October Security Patch Day, and NGINX security advisories
- Node.js October 21 security releases
- Go GO-2026-6809
- Oracle Security Alert CVE-2026-91403
- Fortinet coordinated-update announcement and PSIRT
- ZDI Upcoming
- Mozilla eMudhra incident and Python guidance
- Zeabur August report and October preliminary report