Skip to content

The Worst Security Week of 2026: GitLab 10.0, Java, NGINX, Node and 1,400 Windows CVEs

A full roundup of the vulnerabilities disclosed between October 20 and 26, 2026, beyond PHP2Shell. What each bug is, who runs the affected software, whether it is exploited, and what to patch first.

Hoceine El Idrissi7 min read
The Worst Security Week of 2026: GitLab 10.0, Java, NGINX, Node and 1,400 Windows CVEs

The Worst Security Week of 2026

PHP2Shell got the headlines, but it was one of many. In a single week we got a perfect 10.0 in GitLab, an emergency Java release caused by a certificate authority that generated a private key from the number 4, three critical NGINX bugs, a Node.js memory bug, unpatched Linux kernel reports posted publicly by mistake, and a Microsoft Patch Tuesday with more than 1,400 fixes.

Here is all of it, sorted by what you should patch first.

Worst CVSS score per product this week

Patch order, if you run a typical web stack

  1. PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  2. NGINX past 1.30.5 / 1.31.6 (or NGINX Plus past R37).
  3. Self-managed GitLab to the October 21 releases, even if you patched on October 12.
  4. Java to the October 21 Security Alert builds.
  5. Node.js on 22, 24 or 26 to the latest patch; move off Node 20.
  6. Windows October cumulative updates, then the Linux kernel when ksmbd fixes land.

GitLab: CVE-2026-110264, CVSS 10.0

  • What: an integer overflow in the Onigmo regular expression engine (the one Ruby uses). A crafted regex makes the compiler write past a buffer, and an unauthenticated attacker gets code execution on the server.
  • Reach: every self-managed GitLab back to 7.0, from 2014. That is twelve years of releases. GitLab.com is already fixed.
  • Fixed in: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13. Older versions are end of life and get nothing.
  • The trap: the October 12 release fixed a different 10.0 (CVE-2026-97229). Teams that patched then are vulnerable again. This is the fourth regex engine RCE from the same researcher in about a month.
  • Exploited? Not reported, and not in CISA's KEV list as of October 22. The release has 12 fixes in total, including a high severity LDAP auto-linking authentication bug (CVE-2026-15723).

A GitLab server holds your source code, CI secrets and deploy keys. A takeover there is a takeover of everything it deploys to. Treat this as urgent as PHP.

Java: CVE-2026-91403, CVSS 9.1, and the eMudhra key disaster

This one is a story more than a bug.

  • What happened: eMudhra, a certificate authority trusted by Chrome, Apple and Mozilla, issued eight intermediate certificates (six TLS, two code signing) whose private keys were generated with tiny secrets. One key was literally the integer 4. Others were 56, 66, 115, 155, 156, 230 and 237. Anyone could recompute them.
  • Why Java cares: with those keys an attacker can forge a valid TLS certificate for any domain and sit in the middle of HTTPS connections. Oracle shipped an out-of-band Security Alert on October 21 for the JSSE component in Java SE and GraalVM. The fix stops trusting the eMudhra certificates.
  • Fixed builds: for example 21.0.13.0.2 and 17.0.21.0.2, or your vendor's equivalent (Temurin, Corretto, Zulu).
  • Everyone else: Chrome blocked the keys within two hours, Mozilla within three (CVE-2026-113470). Go hard-coded the bad keys (CVE-2026-111943). Node's new releases distrust them too. Anything with an old root store stays exposed, and macOS's built-in curl and git do not check revocation.
  • Exploited? Not confirmed.

Oracle's regular October Critical Patch Update landed the day before. Its Java flaw (CVE-2026-91484, CVSS 7.5) needs local access and mostly hits applets and Web Start, not servers. The Oracle bug actually being attacked right now is an older one: CVE-2026-35273 in PeopleSoft, fixed in June and targeted again by ShinyHunters.

NGINX: three CVSS 9.2 bugs

F5 shipped out-of-band fixes for three memory bugs that crash workers and, in the right setup, allow unauthenticated code execution:

  • CVE-2026-15176: heap overflow in the alias and rewrite directives.
  • CVE-2026-97205: use-after-free in async I/O when combined with Server Side Includes.
  • CVE-2026-93479: heap overflow in the map directive.

Affected: NGINX Open Source up to 1.30.5 and 1.31.6, NGINX Plus R33 to R37, and NGINX-based F5 products. NGINX sits in front of a huge share of PHP, Node and Python sites, so this lands on the same servers as PHP2Shell. Workarounds until you upgrade: named regex captures, no alias inside location blocks, and turning off aio or ssi if you do not need them.

Node.js: CVE-2026-111497

An out-of-bounds write in the bundled Brotli decompressor. Researchers showed memory leaks and command execution. Fixed in Node 22, 24 and 26. Node 20 is end of life and gets no fix, which is the same lesson as PHP 7: old runtimes are where the risk piles up.

Linux kernel: ksmbd reports leaked

Trend Micro's Zero Day Initiative accidentally sent unpatched bug reports to the public Linux Kernel Mailing List. The worst are two CVSS 9.0 remote code execution bugs in ksmbd, the in-kernel SMB server common on NAS boxes and home servers. If you run it, disable it until your distro ships a fixed kernel. Most web servers do not load ksmbd at all.

Actively exploited this week (CISA KEV)

  • Collabora Online, CVE-2026-110447 (9.2): OS command injection through proxy.php when the local CODE document server is not running. Added to KEV on October 23.
  • Arista VeloCloud Orchestrator, CVE-2026-114625 (9.4): SQL injection. Added to KEV on October 23.
  • Windows Shell, CVE-2026-96951: a security feature bypass, the only exploited bug in October's Patch Tuesday.

Microsoft Patch Tuesday: 1,400 fixes

Microsoft Patch Tuesday CVE counts

October fixed more than 1,400 CVEs, after about 1,000 in September, which itself was roughly ten times a normal month. At least 78 are critical, mostly remote code execution that needs little or no user interaction. Microsoft passed 4,000 CVEs in 2026 with two months left.

Why the explosion? Vendors and researchers are now running AI code review across entire codebases. PHP2Shell itself was found with AI help: Ryan Austin of Calif used OpenAI's GPT-5.6 Sol, and Wiz Research used Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas. Expect more weeks like this one, not fewer.

The rest of the week, briefly

  • Pillow, CVE-2026-112900: crafted EPS images run OS commands through Ghostscript. Any Python app that thumbnails uploaded images should update.
  • Plex2Shell: four chained Plex Media Server bugs give unauthenticated RCE.
  • Broadcom WiFi WPS: a bug from at least 2010 gives a root shell on routers over the air with no password. Broadcom refused a CVE. Rough math puts 1.5 million vulnerable gateways in Belgium alone. Turn off WPS.
  • HTTP/3 QPACK: 7 of 10 implementations tested fell to decompression bombs. One 1MB request packed about 160,000 headers. Bun, the h3 Rust crate and aioquic are still unpatched.
  • UpdraftPlus vendor breach: customer database stolen, including UpdraftCentral keys that can control WordPress sites. Update to 1.26.12 / 2.26.12, which disconnects old keys.
  • AI agent attacks: one attacker used the open-source agent framework Cairn to breach over 100 websites, each in about 23 hours, with instructions under 100 characters long.

What this week tells us

Look at the chart again. Almost every bar is red, meaning no login required, and almost none of the bugs live in application code. They live in runtimes (PHP, Java, Node), in infrastructure (NGINX, the kernel, GitLab) and in trust (a CA key). The teams that had a calm week are the ones that can rebuild and redeploy their whole stack in minutes, on supported versions.

That is also the honest answer to the question many PHP developers asked me this week, which I cover in the next post: should you leave PHP, and is Laravel safer than plain PHP?

Sources