9 newly exploited flaws this week, 3 of them zero-days (attacked before or as the fix came out). Here's what to patch first.
Patch these first
- PHP (zero-day, internet-facing, >99% chance of attack in 30 days)
Two PHP flaws let attackers take over web servers with no login
What to do: Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP. - Adobe Commerce / Magento (internet-facing, 45% chance of attack in 30 days)
Hackers have broken into hundreds of online stores through a Magento upload flaw
What to do: Install Adobe's security patch for this flaw, then check your store's CMS blocks for code you didn't add. - Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (zero-day, internet-facing)
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - Brotli / Node.js (zero-day, 83% chance of attack in 30 days)
A bug in a common compression library puts Node.js apps at risk
What to do: Upgrade Node.js; there is no workaround. Bun, Envoy, Python, .NET and PHP on Windows have also shipped fixes. - Ivanti Connect Secure (internet-facing)
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Also new this week
- Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Linux Kernel: Linux Kernel Missing Initialization of a Variable Vulnerability
- Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging Vulnerability
CISA deadlines this week
- Nov 2, 2026: Ivanti Connect Secure
- Nov 3, 2026: Plex Media Server
- Nov 3, 2026: Plex Media Server
- Nov 3, 2026: Siemens Software Center
Only care about the tech you run? Pick your products on patchsonar.com to filter the list, print a one-page brief, or get alerts in Slack, Teams or Discord.
Forward this to whoever handles your updates. Got it from a friend? Subscribe free.
General information only, not professional advice. Confirm version numbers with the vendor before you update.