⚡ THE ONE THING TODAY
Inventory your customer firewalls (PAN-OS, FortiGate, FortiWeb) and web infrastructure (PHP, GitLab) right now and segment by criticality — then start outbound calls before your ticket queue explodes.
WARNING: PHP Emergency RCE Patches (CVE-2026-109618 & CVE-2026-109619) — Active Exploitation Attempts Observed
PHP released emergency fixes on October 21, 2026, for two critical unauthenticated remote code execution flaws (CVSS 9.2 each): CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state). watchTowr confirmed active exploitation attempts in the wild as of October 21, though no confirmed successful breaches have been reported. Workaround: Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately; for CVE-2026-109619 set session.upload_progress.enabled=0 and restart workers if patching is delayed.
WARNING: GitLab CVE-2026-110264 — Critical Unauthenticated RCE Affecting All Versions Back to 7.0 (2014)
GitLab patched CVE-2026-110264 (CVSS 10.0) on October 21, 2026 — an integer overflow in the regex compiler exploitable without authentication, affecting every GitLab CE/EE version from 7.0 onward. Organisations that patched the previous October 12 critical (CVE-2026-97229) are still exposed to this new flaw. Workaround: Update to the latest GitLab CE/EE release immediately; restrict public network access to GitLab instances as an interim measure.
CRITICAL: PHP2Shell Hits All PAN-OS & Panorama Versions — No Fix Shipped Yet; Fortinet Investigating 12 Products
Palo Alto Networks confirmed on October 22, 2026, that all versions of PAN-OS and Panorama are affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619), critical unauthenticated RCE flaws, with no fixed PAN-OS releases yet available. Risk is highest when management interfaces are exposed to the internet. Workaround: Restrict PAN-OS management interface access to trusted internal IPs only; apply Threat ID 543004 (Frontier Virtual Patching) and IPS signatures 97622–97625 for interim protection.
CRITICAL: Active Campaign Targeting FortiGate, FortiWeb & Palo Alto GlobalProtect — 70,000+ Credentials Exposed
Group-IB and NyxLab published findings on October 21, 2026, identifying threat actor 'k0t' actively breaking into FortiGate, FortiWeb, and Palo Alto GlobalProtect systems using a mix of exploits and credential attacks, with over 70,000 credentials including LDAP and AD details exposed. FortiWeb is exploited via CVE-2025-64446 (path traversal, unauthenticated admin command execution), and GlobalProtect via CVE-2026-0257 (authentication bypass). Workaround: Immediately audit admin accounts, rotate all credentials, restrict management interface exposure, and check FortiGate configs for use of default encryption keys.
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.