Patch Sonar

Zero-days under active attack, explained in plain English

The Monday Patch List

Draft for Monday, Nov 2, 2026. It fills in as the week goes on. Covers flaws listed Oct 26, 2026 to Nov 1, 2026.

How to send it (2 minutes)
  1. In Kit, go to Send → Broadcasts → New broadcast.
  2. Click Copy on the subject line below and paste it into Kit's subject. Do the same for the preview text.
  3. Click Copy email, click into Kit's email body and paste. Add a line of your own at the top if you like.
  4. Choose All subscribers, then Send (or schedule it for 7 a.m.).
  5. Copy the LinkedIn post and share it.
Subject line
Preview text
Email

6 newly exploited flaws this week, 3 of them zero-days (attacked before or as the fix came out). Here's what to patch first.

Patch these first

  1. PHP (zero-day, internet-facing, >99% chance of attack in 30 days)
    Two PHP flaws let attackers take over web servers with no login
    What to do: Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP.
  2. Cisco ASA and FTD firewalls (zero-day, vendor-confirmed, not yet on CISA's list, internet-facing)
    Cisco says attackers are exploiting a flaw in ASA and FTD firewalls
    What to do: Upgrade to the fixed software release in Cisco's advisory. Cisco's advisory also lists signs of compromise to check for.
  3. Adobe Commerce / Magento (internet-facing, 59% chance of attack in 30 days)
    Hackers have broken into hundreds of online stores through a Magento upload flaw
    What to do: Install Adobe's security patch for this flaw, then check your store's CMS blocks for code you didn't add.
  4. Brotli / Node.js (zero-day, 88% chance of attack in 30 days)
    A bug in a common compression library puts Node.js apps at risk
    What to do: Upgrade Node.js; there is no workaround. Bun, Envoy, Python, .NET and PHP on Windows have also shipped fixes.
  5. Linux Kernel (10% chance of attack in 30 days)
    Linux Kernel Missing Initialization of a Variable Vulnerability
    What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.

Early warnings

The vendor says these are under attack, and CISA hasn't listed them yet:

Also new this week

CISA deadlines this week

Only care about the tech you run? Pick your products on patchsonar.com to filter the list, print a one-page brief, or get alerts in Slack, Teams or Discord.

Forward this to whoever handles your updates. Got it from a friend? Subscribe free.

General information only, not professional advice. Confirm version numbers with the vendor before you update.

LinkedIn post