In late October and early November 2026, several critical vulnerabilities were disclosed and then exploited within hours. Here are the ones that call for immediate action, what to check, and the right habits to protect yourself.
Photo: “Couple of metallic padlocks on old door frame” by Horia Varlan, licensed under CC BY 2.0.
PHP: “php2shell,” remote code execution
On October 21, PHP fixed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution. CERT-FR issued an alert (CERTFR-2026-ALE-014) and is seeing exploitation attempts; proofs of concept have been circulating since October 22.
- Fixed versions: 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
- No patch: the 5.x, 7.x, 8.0.x, and 8.1.x branches are no longer maintained. You need to migrate.
- What to do: inventory every PHP website and application, including those managed by a third-party provider, update them, and look for signs of compromise (unknown files, new administrator accounts, unusual outbound connections).
GitLab: a vulnerability rated 10 out of 10
On October 21, GitLab released patches for CVE-2026-110264: unauthenticated remote code execution, under certain conditions, affecting all self-managed versions of GitLab CE and EE since 7.0. Instances updated on October 12 remain vulnerable. GitLab offers no workaround.
- Fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- Why it matters: a software forge holds your continuous integration secrets, and therefore often the deployment keys to your production servers.
- What to do: back up the configuration and secrets, update, then rotate tokens and variables if the logs show an attempt.
OpenSSH: “sshole,” exploited in under nine hours
On November 5, OpenSSH 10.6p2 fixed CVE-2026-123158 (alert CERTFR-2026-ALE-015). On Linux systems that use the musl library without PAM, Alpine Linux first among them, accounts without a real password can be opened without authentication. A first exploitation attempt was observed less than nine hours after disclosure.
- Affected: Alpine Linux and other musl-based systems (some Docker images, OpenWrt, Buildroot, Yocto). glibc-based distributions and those that use PAM are not affected.
- What to do: apply the patch and restart sshd; otherwise the old program keeps accepting connections. Failing that, disable password authentication.
Exposed devices: access gateways and connected devices
Photo: “Switch!” by andrewfhart, licensed under CC BY-SA 2.0.
Three CERT-FR alerts remain open for devices sitting at the network edge:
- Ivanti Connect Secure (CERTFR-2026-ALE-013): three actively exploited vulnerabilities. If in doubt, isolate the device, preserve the logs, then look for lateral movement across the network.
- Citrix NetScaler ADC and Gateway (CERTFR-2026-ALE-011): several vulnerabilities, one of them exploited.
- Remote controllers for refrigeration systems (CERTFR-2026-ALE-012): numerous compromises of Danfoss AK-SC and AK-SM, Copeland, and Dixell xweb controllers reachable from the internet. CERT-FR's reminder applies to any connected device: “exposing a management interface on the internet goes against best practices.” Access should go through a VPN or a protected network, with up-to-date firmware and changed passwords.
Five habits for this week
- Keep an inventory of everything exposed on the internet, including your providers.
- Update within days of an alert, and restart the affected services.
- Never expose an administration interface: use a VPN or a protected network.
- After a late patch, look for signs of compromise and rotate your secrets.
- Test shared accounts the way a malicious user would.
Sources: CERT-FR alerts, vendor advisories (PHP, GitLab, OpenSSH). Questions about your exposure? contact@cybelia-cloud.fr.