GitLab CVE-2026-97229 + 5 More: Vulnerability Digest Oct 30

On October 29, 2026 (US time), CISA added GitLab CVE-2026-97229 (CVSS 10.0) and Cisco Secure Firewall ASA/FTD CVE-2026-76418 (CVSS 8.6) to its Known Exploited Vulnerabilities (KEV) catalog. Both have a November 1 deadline for US federal agencies. If you run self-managed GitLab or an ASA/FTD SSL VPN, start updating today. This digest also covers four more KEV additions from October 26-28: PHP, Brotli (bundled in Node.js and others), the Linux kernel and VMware ESX. Of the six, GitLab has the highest official severity, and Cisco is the one where the vendor itself says it saw attacks.

This article reflects the CISA KEV catalog, NVD, vendor advisories and JPCERT/CC alerts as checked at 19:00 JST on October 30, 2026. Each CVSS score names who assigned it, and anything the primary sources do not state is marked as not stated.

According to GitLab's release notes, insufficient validation of regular expressions in CI/CD configuration lets an unauthenticated attacker run arbitrary code on the GitLab server with a crafted expression. The weakness class is integer overflow (CWE-190), which is why CISA lists it under that name even though the impact is far more serious than the label suggests.

- Severity: CVSS 10.0 (Critical), assigned by GitLab as the CNA. NVD showed it as awaiting analysis on Oct 30 and has not published its own score
- Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2
- Fixed: 19.2.8, 19.3.5, 19.4.2 or later (patch release of October 12, 2026)
- Workaround: none listed. GitLab.com and GitLab Dedicated are already patched; only self-managed instances need an update
- Exploitation: GitLab's page does not mention it. CISA added the CVE to KEV on Oct 29 with a November 1 deadline
- How to check: look up the version in the Admin Area or page footer. GitLab's page lists six detections for signs of exploitation, such as "Onigmo native worker crash" and "ci regexp guard rejection"

Plan for downtime: GitLab says single-node instances must finish migrations before starting, so they will be briefly offline. If your instance is exposed to the internet, consider restricting access to VPN-only until the update is done. Advisory: GitLab Patch Release 19.4.2

Per Cisco's advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75), when a tunnel group uses secondary authentication on the remote access SSL VPN, an unauthenticated attacker can send a crafted request and make the device reload. The result is denial of service, not data theft or takeover, but a VPN device that keeps rebooting cuts off remote work and site-to-site traffic.

- Severity: CVSS 8.6 (High), assigned by Cisco (CVSS 3.1). NVD analysis pending
- Conditions (all must apply): SSL VPN (webvpn) enabled on an interface and secondary-authentication-server-group set on a tunnel group, including DefaultWEBVPNGroup
- Not affected: Cisco Cloud-delivered Firewall, cdFMC, Secure Access, Secure FMC Software
- Fixed (ASA): 9.16 and earlier 9.16.4.104, 9.18 9.18.4.96, 9.20 9.20.4.50, 9.22 9.22.3.200, 9.23 9.23.1.48, 9.24 9.24.1.27 or 9.24.10.1
- Fixed (FTD): 7.0 and earlier 7.0.11, 7.2 7.2.13, 7.4 7.4.9, 7.6 7.6.7, 7.7 7.7.14, 10.0 10.0.3, 10.1 10.1.1
- Workaround: none that fixes the issue. A temporary mitigation is disabling secondary authentication: "no tunnel-group-list enable" if DefaultWEBVPNGroup does not use it, otherwise "no secondary-authentication-server-group" (which weakens VPN security). Cisco recommends upgrading
- Exploitation: Cisco states it became aware of exploitation in October 2026. CISA added it to KEV on Oct 29, deadline November 1

Use the Cisco Software Checker to confirm exposure for your release. On ASA, check webvpn and tunnel-group settings in the running config; on FTD, check Devices > VPN > Remote Access in FMC or Remote Access VPN in FDM. If a vendor manages the firewall for you, ask whether secondary authentication is in use and when the fixed release will be installed. Advisory: Cisco Security Advisory

The two PHP flaws that can lead to unauthenticated remote code execution were added to KEV on Oct 26. In its Oct 29 update, JPCERT/CC added that an investigation of attack activity reported signs of compromise on specific versions of a firewall product, that the attackers reportedly built an exploit chaining these PHP flaws with a Linux kernel privilege escalation, and that there were traces of lateral movement into internal networks from compromised devices. Some vendors have also updated their advisories to say they observed attacks.

- Severity: CVE-2026-109618 is 9.2 under CVSS 4.0 (assigned by PHP) and 9.8 under CVSS 3.1 (NVD). CVE-2026-109619 is 9.2 (PHP) and 8.1 (NVD)
- Affected: 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35. No fixed releases are provided for 8.1 and earlier
- Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Products that bundle PHP and distribution packages may also be affected
- Mitigation: PHP states that updating is the only complete mitigation. JPCERT/CC suggests session.upload_progress.enabled=0 plus restarting workers as an interim measure
- How to check: look for suspicious multipart/form-data requests, abnormal PHPSESSID cookies, worker crashes, and unusual processes or outbound connections

For update steps and WordPress checks, see our PHP CVE-2026-109618 / 109619 response guide. Advisories: JPCERT/CC AT-2026-0033 (Japanese), PHP GitHub advisory

Brotli is a compression library embedded in Node.js, the Python Brotli package and other software. Processing crafted Brotli data can corrupt memory, leak information, crash the application or, in some cases, allow code execution. The Node.js blog explains that an attacker who can supply Brotli data decompressed through node:zlib can corrupt process memory.

- Severity: 9.8 Critical under CVSS 3.1 (NVD) and 9.2 Critical under CVSS 4.0 (Google as CNA). The Node.js blog rates it High
- Affected: Brotli 1.0.3 up to before 1.0.10, 1.1.0 up to before 1.1.1, 1.2.0 up to before 1.2.1
- Fixed: Brotli 1.0.10, 1.1.1, 1.2.1. Node.js v22.23.4, v24.22.1, v26.12.1 (Node.js 22, 24 and 26 lines are affected)
- Workaround: Google provides none, per JPCERT/CC
- Exploitation: added to KEV on Oct 27. The JPCERT/CC alert does not state whether it is exploited

Because Brotli often sits inside other products, you may be affected without having installed it yourself. If you run a Node.js app, check node -v first. For web apps built by contractors, ask which Node.js and Brotli versions are in use and when fixes will land. Advisories: JPCERT/CC AT-2026-0034 (Japanese), Node.js October 2026 security releases

A networking bug in skb_try_coalesce() loses a marker that flags shared memory fragments. The later ESP (IPsec) path can then miss it and decrypt in place over page-cache backed memory. The attacker needs a low-privilege account on the machine, so this is not a direct remote attack. It matters because it can serve as a step to gain full control after another flaw has given an attacker a foothold.

- Severity: CVSS 7.8 (High), the same value from NVD and the Linux kernel CNA. Attack vector is local (AV:L) and required privileges are low (PR:L)
- Affected (NVD CPE data): 3.9 through 5.10.257, 5.11 to before 5.15.208, 5.16 to before 6.1.174, 6.2 to before 6.6.141, 6.7 to before 6.12.91, 6.13 to before 6.18.33, 6.19 to before 7.0.10
- Fixed: stable kernels 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 or later. Distributions backport fixes, so check your vendor's advisory (for example Red Hat) for the package version
- Workaround: not found in the NVD record
- Exploitation: added to KEV on Oct 28. The kernel-side records do not state it

A kernel fix is complete only after the update and a reboot. Managed hosting and cloud services are usually patched by the provider; the main concern is Linux servers you run yourself (VPS or on-premises). Run uname -r and compare it with your distribution's advisory. Source: NVD CVE-2026-46300

An insufficient logging flaw lets a malicious administrator perform certain operations without them being logged. Broadcom rates it CVSS 2.7 (Low) because administrator privileges are required. It was nonetheless added to KEV on Oct 28, so organizations running their own virtualization hosts should schedule the update. Broadcom's advisory does not mention exploitation.

- Severity: CVSS 2.7 (Low), assigned by Broadcom (VMSA-2026-0006)
- Fixed: ESX 8.0 ESXi80U3j-25429389, 9.0 ESXi-9.0.2.0100-25595025, 9.1 ESXi-9.1.0.0-25370933. VMware Cloud Foundation 5.x 5.2.4. ESX 7.0 is not listed in the advisory matrix for this CVE
- Workaround: none, per Broadcom
- Exploitation: added to KEV on Oct 28, deadline November 11

Source: Broadcom VMSA-2026-0006

CISA's KEV catalog lists vulnerabilities with evidence of real-world exploitation, and US federal agencies get a remediation deadline for each. Today that is November 1 for GitLab and Cisco and October 31 for the Linux kernel. The deadlines do not bind companies in Japan or elsewhere, but they signal that attackers are already using the flaw. As the ESX case shows, a low score can still land in KEV, so treat KEV listing as the first criterion for priority, ahead of the score alone.

- Ask your IT person or maintenance vendor whether you use self-managed GitLab, Cisco ASA/FTD, PHP websites, Node.js apps, self-run Linux servers or VMware ESX
- For each one you use, get a firm date for the update by the end of today
- If you run a Cisco ASA/FTD SSL VPN, ask first whether secondary authentication is used and when the fixed release will be installed
- If GitLab is exposed to the internet, ask whether access can be limited to VPN until it is updated
- Warn colleagues in advance about downtime from updates (GitLab, VPN, hypervisor reboots)
- After updating, confirm the version number on screen or in settings and record the date
- If a PHP site such as WordPress may have been compromised, ask for log and file checks instead of stopping at the update

For the broader approach, see the SMB IT risk guide (Japanese), vulnerability assessment costs, UTM and firewall costs for SMBs and zero trust security guide.

Adobe Commerce / Magento CVE-2026-48356 (CVSS 9.3, added to KEV on October 27, Adobe advisory APSB26-73) was not examined in detail today and is not in the list. Magento store operators should read Adobe's advisory directly.

- CISA: Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-29)
- CISA Known Exploited Vulnerabilities Catalog
- GitLab Patch Release 19.4.2 / 19.3.5 / 19.2.8
- Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
- JPCERT/CC AT-2026-0033 (PHP)
- JPCERT/CC AT-2026-0034 (Brotli)
- PHP GitHub Security Advisory GHSA-w8hw-w9fx-j79w
- Node.js October 2026 Security Releases
- Broadcom VMSA-2026-0006
- NVD: CVE-2026-97229, CVE-2026-76418, CVE-2026-111497, CVE-2026-46300, CVE-2026-41709, CVE-2026-109618