Exploited vulnerabilities at the end of October 2026: Linux kernel, Node.js, Magento, GitLab and Drupal
Between 27 and 30 October 2026 the US agency CISA added eight vulnerabilities to its catalogue of actively exploited flaws, and Drupal reported an exploited flaw in Commerce Core. Several concern servers, shops and tools also used by SMEs in Ticino: the fixed versions and what to check.
In four working days, from 27 to 30 October 2026, the US cybersecurity agency CISA added eight vulnerabilities to its catalogue of exploited vulnerabilities (Known Exploited Vulnerabilities, KEV). The catalogue only lists flaws with evidence of real attacks: it is not a list of theoretical risks. In the same period the Drupal security team published an advisory on an already exploited flaw in the most widely used e-commerce module.
Not all of them concern an SME. Some, however, affect very common components: the kernel of Linux servers, Node.js, Magento and Drupal shops, and self-hosted GitLab. Below, for each one, you will find who is affected and which version to install. We do not report technical details on how they are exploited.
Linux kernel: CVE-2026-46300
The flaw, made public on 13 May 2026, lets someone who already has limited access to a Linux server gain administrator (root) privileges. The CVSS score is 7.8. On 28 October 2026 CISA added it to the catalogue, stating that it is used in combination with the PHP flaws CVE-2026-109618 and CVE-2026-109619: attackers get in through the website, then take control of the whole server.
Distributions published fixed kernels some time ago. Ubuntu lists, among others, versions 5.15.0-181.191 for 22.04, 6.8.0-124.124 for 24.04 and 7.0.0-22.22 for 26.04. AlmaLinux lists kernel-4.18.0-553.124.3.el8_10 for version 8, 5.14.0-611.54.5.el9_7 for 9 and 6.12.0-124.56.3.el10_1 for 10. An often overlooked point: the new kernel only protects after the server is rebooted. An update installed in May on a machine that was never rebooted leaves the server exposed.
PHP: the link with the October flaws
The two PHP flaws were reported by the NCSC on 21 October 2026 and covered in our article of 22 October. The combination with the kernel flaw makes updating even more urgent: anyone who has not yet installed PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the equivalent fix from their provider, should update PHP and the kernel together and then check the server for unusual files and access.
Node.js and the Brotli library: CVE-2026-111497
On 27 October CISA also added a flaw in Google's Brotli decoder, a compression format used on the web. The flaw is included in Node.js: the security release of 21 October 2026 fixes it, rated high, in versions 22.23.4, 24.22.1 and 26.12.1. The risk exists when an application decompresses Brotli data sent by third parties. Node.js versions that are no longer supported (end-of-life) are vulnerable and will not receive fixes: they should be replaced with a supported line.
Online shops: Magento and Drupal Commerce
Adobe Commerce and Magento Open Source (CVE-2026-48356): the flaw allows files to be uploaded without authentication and is rated 9.6 by Adobe in bulletin APSB26-73. CISA added it to the catalogue on 27 October. The fix is in versions 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul; for Adobe Commerce also in the corresponding 2.4.5 and 2.4.4 versions. At our last check, Adobe's bulletin did not mention known attacks; exploitation is confirmed by the CISA catalogue entry.
Drupal Commerce Core (CVE-2026-118539): the advisory of 28 October 2026 rates the flaw as highly critical. Some functions are not sufficiently protected, with possible financial harm to the vendor, and the Drupal team confirms that it is being exploited. The fix is in versions 3.3.13 and 8.x-2.41. Drupal also recommends auditing orders for inconsistencies, for example amounts, discounts or statuses that do not match the payments received.
Self-managed GitLab: CVE-2026-97229
Anyone running GitLab on their own servers (self-managed) should treat this flaw as a priority: it has a CVSS score of 10 and allows code execution without authentication. GitLab fixed it on 12 October 2026 with versions 19.4.2, 19.3.5 and 19.2.8; on 29 October CISA confirmed that it is exploited. GitLab.com users do not need to do anything.
Firewalls, VPNs and virtualisation
In the same period CISA also added a VMware ESX flaw (CVE-2026-41709, 28 October), a flaw in the SSL VPN of Cisco ASA and FTD that can bring the service down (CVE-2026-76418, 29 October) and two Ivanti Connect Secure flaws (CVE-2026-111357 and CVE-2026-118527, 30 October). If your company uses one of these products, ask whoever manages it whether the vendor's fixes are installed.
What to check this week
- Inventory. Which Linux servers, Node.js and PHP versions, shops and development tools are reachable from the internet, and who manages them.
- Kernel and reboot. The kernel version actually running, not just the one installed. If the reboot was postponed, schedule it now.
- PHP and Node.js. Fixed versions installed, unsupported lines replaced.
- Shops. Magento and Drupal Commerce updated; recent orders and uploaded files checked together with whoever runs the shop.
- Providers. For managed hosting, agencies and cloud services, written confirmation that the fixes have been applied.
- Traces. After updating, check for unknown users, files and processes: the update closes the flaw but does not remove access already obtained.
Obligations in Switzerland
The Federal Act on Data Protection requires appropriate technical and organisational measures for data security (art. 8 FADP); keeping servers and applications up to date is part of that. If an attack leads to a data security breach that is likely to result in a high risk for the persons concerned, the controller must notify the Federal Data Protection and Information Commissioner as soon as possible (art. 24 FADP). Since 1 April 2025, operators of critical infrastructure also have an obligation to report cyberattacks to the NCSC within 24 hours of discovery. Other companies can report an incident to the NCSC on a voluntary basis.
Frequently asked questions
My website is on shared hosting: do I need to do anything?
The server's kernel and PHP are usually the provider's job, but the application (shop, CMS, plugins) often is not. Ask the provider whether the kernel and PHP are up to date and the server has been rebooted, and check the application side yourself or with your agency.
Why cite a US catalogue?
The KEV catalogue is one of the clearest public sources for knowing which flaws are actually exploited. The same flaws affect servers and shops in Switzerland; for local reports the reference source remains the NCSC.
I have updated: can I consider the matter closed?
Only if the system had not already been compromised. For flaws exploited before the update, a check for traces is advisable, especially on exposed servers with outdated PHP.
Our approach
ElaraTeq Sagl develops and runs websites, shops and applications for SMEs and public bodies in Ticino, with hosting in Switzerland and planned security updates, reboots included. For ongoing maintenance there is the service presented in the article on Orbit; see also our articles on Nextcloud and Collabora and on WordPress plugins. For a review of your systems you can contact us.
Sources
- CISA, alerts of 27 October, 28 October, 29 October and 30 October 2026; Known Exploited Vulnerabilities Catalog
- NIST NVD, CVE-2026-46300
- Ubuntu, Fragnesia Linux vulnerability fixes available; AlmaLinux, CVE-2026-46300, 13 May 2026
- Node.js, October 2026 Security Releases, 21 October 2026
- Adobe, Security update available for Adobe Commerce, APSB26-73
- Drupal, SA-CONTRIB-2026-254, Commerce Core, 28 October 2026
- GitLab, Critical Patch Release 19.4.2, 19.3.5, 19.2.8, 12 October 2026
- NCSC, Critical vulnerabilities in PHP, 21 October 2026; Reporting obligation for cyberattacks on critical infrastructure
- Fedlex, Federal Act on Data Protection (FADP), SR 235.1, art. 8 and 24
