Security Advisory

This Week's Top 5: A Cisco Firewall Flaw Due Today, Two Exploit Chains Grow More Dangerous, and Confirmed Attacks on Adobe Commerce and Brotli

Published November 1, 2026 · Cyber One Solutions

CISA added ten vulnerabilities to its Known Exploited Vulnerabilities catalog this week, and five reach the businesses we serve most directly: an unpatched Cisco firewall flaw with a federal deadline that lands today, a deeper privilege-escalation link in the Ivanti Connect Secure chain, a Linux kernel flaw extending the "php2shell" campaign, confirmed exploitation of a patched Adobe Commerce and Magento flaw, and a critical compression-library bug reaching far beyond Node.js. Here are the five verified developments for small and mid-size businesses this week, ranked by relevance, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, October 25 through Saturday, October 31, 2026, with a research cutoff of Sunday, November 1, 2026 at 6:00 a.m. Central. It is the edition for the regular Sunday, November 1 slot. This was a week where several threads already in our coverage grew more serious rather than a week of entirely new names: two multi-vulnerability exploit chains each gained a new, more dangerous link, a widely used compression library turned out to reach far past the one project it is best known for, and a firewall vendor disclosed a denial-of-service flaw with a federal remediation deadline that lands today.

Executive Summary and Priorities

Five verified developments met our bar for inclusion this week:

A denial-of-service flaw in Cisco Secure Firewall ASA and Secure Firewall Threat Defense Software, CVE-2026-76418, that Cisco's own PSIRT says is under active exploitation, has no workaround, and carries a CISA remediation deadline of today, November 1.
A new privilege-escalation link added to the Ivanti Connect Secure exploit chain this brief first ranked on October 18, letting an attacker who already has code execution escalate all the way to root.
A Linux kernel flaw CISA says can be chained with the PHP flaws behind the "php2shell" campaign, extending a chain our October 21 advisory has already updated twice to cover, most recently on October 29, to reach any Linux server running a vulnerable kernel.
Confirmed active exploitation of a patched Adobe Commerce and Magento file-upload flaw, a reminder for any business running an online store on either platform as the holiday shopping season approaches.
A critical flaw in Google's Brotli compression library that reaches far beyond the Node.js servers it was first reported against, into any application built on a long list of platforms that bundle the same decoder.

Two additional vulnerabilities were added to the KEV catalog this week but not ranked, covered briefly below.

How We Ranked This Week's Developments

We ranked these five by how directly the affected technology sits in a commercial business's infrastructure, the strength and source of the exploitation evidence, whether a federal remediation deadline falls inside or near this window, and whether patching is the only real fix or an interim mitigation exists. One of the five, the Cisco flaw ranked first below, is new to our coverage. The other four extend advisories Cyber One Solutions has already published, in some cases just days before this window closed; where that is the case, we rank the update and its significance for the week, not the underlying flaw a second time, and link back to our fuller original coverage rather than repeat it here. These rankings are editorial judgments, not a measured risk score.

1. A Denial-of-Service Flaw in Cisco's Secure Firewall Puts Unpatched SSL VPNs at Risk, Due Today

Cisco disclosed CVE-2026-76418 on October 28, 2026, in security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75: an unauthenticated remote attacker can send a crafted request while connecting to the Remote Access SSL VPN service on Secure Firewall ASA or Secure Firewall Threat Defense software, forcing the device to reload and cutting off VPN access until it comes back up. Cisco rates it 8.6 (High) under CVSS 3.1 and traces the cause to logic errors in how the software handles secondary authentication on a VPN tunnel group. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29 with a remediation due date of November 1, 2026, today.

The exposure is narrower than "every ASA or FTD device," but it is easy to meet without realizing it. A device is vulnerable only if its SSL VPN service is enabled and reachable and a tunnel group, including the default group every device ships with, has a secondary authentication server configured, a common setup for any business layering a second factor such as a one-time code or push approval onto VPN logins. Cisco's advisory is explicit that an attacker does not need to actually log in, or even know the tunnel group's name, to reach the vulnerable code: simply reaching the login service is enough. Cisco also says it has no workaround, only two interim mitigations, each tied to how the default tunnel group is configured, and both weaken the VPN's own security posture rather than preserve it. If the default tunnel group does not use secondary authentication, disabling the connection-profile selection list helps, since it then requires every legitimate user to already know their exact profile name to connect at all; but Cisco's advisory is explicit that this does nothing to protect a device whose default tunnel group does use secondary authentication, since that group stays reachable with no profile name needed, and the applicable mitigation there is instead removing the secondary authentication requirement entirely. Cisco recommends treating either as temporary and moving to a fixed release as the real fix: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, or 9.24.1.27/9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, or 10.1.1, depending on the branch currently running. Cloud-delivered Firewall, cdFMC, Cisco Secure Access, and Secure FMC Software are not affected.

If your business's remote access runs through an ASA or FTD device, this week's action is to find out from whoever manages that firewall, in-house staff or a managed provider, whether secondary authentication is configured on any tunnel group (including the one nobody actively chose, the default group) and whether the device is already on one of the fixed releases above. Today's federal due date is a signal of urgency for every organization, not just those bound by it directly: CISA sets that deadline when it has evidence of real-world exploitation, and an unauthenticated, no-login-required denial of service against a VPN gateway is the kind of outage that can stop remote staff from reaching the network at all, with no advance warning before it happens.

2. A New Escalation Path Deepens the Ivanti Connect Secure Attack Chain

CISA added two more Ivanti Connect Secure vulnerabilities to its KEV catalog on October 30: CVE-2026-111357, which lets a local authenticated attacker escalate privileges to root, and CVE-2026-118527, which lets a remote authenticated attacker upload a file to a known location on disk. CISA's own catalog entries describe both as chainable with CVE-2026-104935, the initial-access flaw at the center of the Connect Secure advisory we first published on October 15 and have updated twice since as the picture of this attack chain grew clearer. This is the same mechanism Volexity's research, already cited in that advisory, described: a root-level appliance service called dsinvoked trusts configuration data from an internal cache without verifying it came from a legitimate source, so an attacker who already has code execution through CVE-2026-104935 can use CVE-2026-111357 to escalate to full root control of the appliance, and CVE-2026-118527 gives a second path to plant a file for persistence once inside.

What makes this an update worth flagging rather than a new, separate item is what it changes about the risk calculation for anyone who has not yet patched: the chain is no longer "unauthenticated access to something," it now reaches all the way to full root control of the appliance, which is a materially worse outcome for incident response and for any compliance obligation that turns on whether an incident counts as a reportable breach. CVE-2026-111357 carries a November 2 federal due date, one day after this brief's publication; CVE-2026-118527's due date, November 13, falls after it. If your organization or IT provider has not already confirmed Connect Secure is patched against this full chain, that confirmation cannot wait for the later deadline.

3. CISA Flags a Linux Kernel Flaw Extending the PHP RCE Webshell Campaign to Any Vulnerable Linux Server

CISA added CVE-2026-46300, nicknamed "Fragnesia," a Linux kernel flaw in how the system handles encrypted network packets (IPsec ESP) carried inside a TCP connection, to its KEV catalog on October 28. CISA's own catalog entry says the flaw "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root," the same two PHP memory-corruption flaws behind the "php2shell" campaign our October 21 advisory first covered and has already updated twice since, on October 27 to confirm its KEV catalog listing and on October 29 to add this exact kernel-chaining detail. CVE-2026-46300 itself requires only local, unprivileged access through user and network namespaces to trigger, a configuration available by default on most modern Linux systems, and a vendor-independent technical FAQ on the flaw notes the kernel fix shipped back in May 2026, well before this chain made it a live KEV entry; an interim mitigation short of a full kernel update is available by blocking the esp4, esp6, and rxrpc kernel modules.

The practical effect for a business running a PHP website is that this is no longer purely a web-application patching question. Patching PHP itself closes the original remote-code-execution path this campaign used to get in, but a server whose underlying Linux kernel is also unpatched gives an attacker who gets in through some other means, or who already has a toehold, a documented path to full root rather than whatever limited access the web server process itself has. If your website or IT provider already patched PHP in response to our October 21 advisory, this week's reminder, carried in that advisory's October 29 update, is to confirm the server's own operating system and kernel are current too, since this specific chain shows why that second layer matters even after the first is handled.

4. Active Exploitation Confirmed on a Patched Adobe Commerce and Magento Flaw

CISA added CVE-2026-48356, an unrestricted file-upload flaw nicknamed "PolyShell" in Adobe Commerce and Magento, to its KEV catalog on October 27, the subject of our October 28 coverage after we verified the facts directly against CISA's catalog entry, NVD's record, and Sansec's own research. The flaw itself was patched by Adobe in July 2026; what earned it a KEV listing months later is confirmed, ongoing exploitation of stores that never applied that patch. Sansec's own findings, which our existing coverage already details and continues to track, point to opportunistic exploitation of already-missing patches rather than any new vulnerability: a new malicious loader domain found on dozens of affected stores, most of which were previously identified victims.

We are not re-ranking the underlying flaw a second time here; our existing article is the fuller, current source. The reason it belongs in this week's priorities at all is timing: any business running an online store on Adobe Commerce or Magento is heading into the highest-revenue weeks of the year, and a compromised storefront during that window is a worse outcome, in lost sales and customer trust, than the same compromise in a slower month. If your business or web provider has not confirmed Adobe's July patch is applied, this is the week to do it, before holiday traffic makes any resulting downtime more costly.

5. A Critical Compression-Library Flaw Reaches Far Beyond Node.js

CISA added CVE-2026-111497, a flaw in Google's Brotli compression library, to its KEV catalog on October 27, the subject of our October 28 coverage. NVD rates it 9.8 (Critical) under CVSS 3.1; Google, as the vulnerability's assigning authority, rates it 9.2 under CVSS 4.0. Node.js's own October 2026 security release confirms the flaw reaches its 22.x, 24.x, and 26.x release lines, crediting researchers Khai Tran and Sylvie Mayer for identifying it, and Microsoft separately disclosed that its own .NET runtime bundles an affected copy of the same decoder, rated 8.1 under a different CVSS vector for that implementation. Our existing coverage, which we continue to treat as the fuller source rather than repeating here, also documents independent confirmation that this is not theoretical: security researchers reproduced working remote code execution against the official Node.js container image, and threat-intelligence reporting has already observed scanning traffic consistent with active probing.

The reason this flaw outranks a typical single-product advisory is scope: Brotli is not a product a business chooses to run, it is a compression format bundled inside web servers, browsers, and application runtimes most businesses never evaluate directly. Any custom web application, internal tool, or API built on Node.js or ASP.NET in the affected version ranges inherits this exposure whether or not anyone involved in running it has ever heard of Brotli by name. If your business has a developer, agency, or IT provider maintaining a custom web application or API, this week's question for them is specifically whether its Node.js or .NET runtime version is current, not just whether "the website" in general has been patched.

Also Added to the KEV Catalog This Week

CISA also added two vulnerabilities we did not rank. CVE-2026-41709, an insufficient-logging flaw in Broadcom's VMware ESX, was added October 28 with a November 11 due date; NVD rates it only 2.7 (Low), and it requires an attacker who already holds administrator-level access to the hypervisor, so it is an audit-trail gap for an insider or an already-compromised admin account rather than a route in for an outside attacker, and the underlying advisory itself dates back to July 2026. CVE-2026-97229, an integer-overflow flaw in GitLab Community and Enterprise Edition that an unauthenticated attacker can trigger with a crafted regular expression in a CI/CD configuration to achieve remote code execution, was added October 29 with a November 1 due date; GitLab fixed it in version 19.4.2. We did not rank it because self-hosted GitLab is developer tooling outside the commercial service portfolio we cover week to week, but any business that does self-host GitLab Community or Enterprise Edition, rather than using GitLab's own cloud service, should treat today's federal deadline as real and confirm it is on 19.4.2 or later now.

Do Now

If your business's remote access VPN runs through Cisco ASA or FTD, confirm today whether secondary authentication is configured on any tunnel group and whether the device is on one of the fixed releases listed above; there is no workaround, so patching is the only durable fix.
If you have not already responded to our Ivanti Connect Secure coverage, treat CVE-2026-111357's November 2 deadline as immediate: this chain now reaches full root, not just initial access.
If your website or server runs PHP, confirm both the PHP version and the underlying Linux kernel are current; the kernel flaw covered above shows why patching PHP alone is no longer enough for this specific campaign.

Plan Next

Confirm with your web provider or in-house developer whether any custom application depends on Node.js or .NET, and get a specific version number back, not just a general assurance that "it's updated."
If your business runs Adobe Commerce or Magento, verify the July 2026 patch is applied before holiday traffic increases the cost of any resulting downtime.
Ask whoever manages your firewalls and VPN appliances how they track vendor advisories that carry no workaround at all, so the next one does not wait for a weekly or monthly review cycle to surface.

Watch List

Whether CISA or Cisco report confirmed intrusions tied to CVE-2026-76418 beyond the denial-of-service impact already described.
Whether the Ivanti Connect Secure chain gains further links, or whether CISA or Ivanti disclose confirmed compromises resulting from the full chain now in place.
Whether Brotli exploitation moves from reproduced proof-of-concept and scanning activity to confirmed compromises of production applications.

The Bottom Line

Four of this week's five priorities are not brand-new names; they extend advisories Cyber One Solutions has already published, in some cases just days before this brief's cutoff, and that pattern is worth sitting with: a flaw that looked contained when first disclosed can still earn a second or third look weeks later as researchers and CISA connect it to something else. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions keeps firewalls, VPN gateways, and servers patched and monitored through managed cybersecurity, and builds and maintains business websites and online stores through our website development and support services. If you are not sure where your business stands on any of this week's five items, our free cybersecurity risk score self-assessment is a quick way to find out.