Weekly Threat Briefing (Oct 26–Nov 1): Patch GitLab, Cisco ASA, PAN-OS

The week of Oct 26–Nov 1, 2026 brought exploited flaws in edge and DevOps systems: PHP2Shell on Palo Alto Networks management interfaces, a max-severity GitLab CI/CD flaw, and a Cisco ASA/FTD VPN denial-of-service bug, all confirmed exploited. Supply-chain compromises hit LiteLLM and ConnectWise cloud backup customers, while the FBI attributed the record Binance theft to North Korea's TraderTraitor. Exploitation also began against Drupal Commerce and a WordPress Core race condition within days of fixes.

What were the major exploited vulnerabilities this week?

1. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — Palo Alto Networks says attackers are exploiting the PHP2Shell flaws against internet-exposed Palo Alto Networks management interfaces. Restrict management interfaces to trusted networks and patch. Full analysis: PHP2Shell technical analysis.

2. GitLab CVE-2026-97229 (CI/CD RCE, KEV Oct 29) — An unauthenticated CVSS 10.0 flaw, exploited in attempts against Alpine Linux and added to CISA KEV on Oct 29. The Oct 12 fix is not enough: install the Oct 21 releases, which also fix CVE-2026-110264. Full analysis: GitLab CVE-2026-97229 exploited.

3. Cisco ASA/FTD VPN DoS (CVE-2026-76418, KEV Oct 29) — An unauthenticated request can reload ASA/FTD devices that use secondary authentication on a tunnel group; no workaround. Full analysis: CVE-2026-76418 Cisco ASA/FTD.

4. Also exploited: Plex, Arista, VeloCloud and Collabora issues — see Exploited this week: Plex2Shell, Arista, VeloCloud, Collabora.

5. Drupal Commerce Core (CVE-2026-118539) — Drupal says this missing-authorization access bypass is "actively exploited in the wild" and "may financially impact the vendor." Affected: 0.0.0 through 2.41 and 3.0.0 through 3.3.13 (Drupal SA-contrib-2026-254). Upgrade to the fixed release listed in the advisory.

6. WordPress Core race-condition RCE (GHSA-4w3m-c66w-69mg, CVSS 8.1) — Affects WordPress 4.7 through 7.1.3; unauthenticated attackers can race full-package core upgrades via the predictable wp-content/upgrade staging directory. Fixed in 7.1.4 (Oct 28). Wordfence blocked 62,969 attempts in 24 hours.

Which supply-chain and breach incidents matter?

7. LiteLLM 1.107.0 compromise — A leaked LiteLLM master key let attackers steal GitHub tokens and hijack the release pipeline. Check for 1.107.0 in AI gateway deployments and rotate keys it handled. Read: LiteLLM 1.107.0 supply-chain compromise.

8. Storm-0940 / ConnectWise cloud backup — Read: Storm-0940 and the ConnectWise cloud backup compromise.

9. Railway and Zeabur breaches — PaaS providers holding customer secrets. Read: Railway and Zeabur breaches.

10. DHS "Icepick" leak — 41,000 staff records reportedly taken. Read: DHS Icepick leak.

11. Binance theft attributed to TraderTraitor — The FBI attributed the theft of more than $6 billion (The Hacker News: $6.43 billion) from Binance to North Korea's TraderTraitor (also Jade Sleet, UNC4899, Slow Pisces) and published laundering wallet addresses. $2.85 billion has been frozen on-chain. Reported tradecraft includes trojanized Terraform providers delivering a Bash loader, and job-themed lures aimed at security, AI and blockchain staff.

Patch first

GitLab self-managed — CVE-2026-97229, CVE-2026-110264
Cisco ASA / FTD — CVE-2026-76418
Palo Alto Networks management interfaces — CVE-2026-109618 / CVE-2026-109619
WordPress Core → 7.1.4
Drupal Commerce Core — SA-contrib-2026-254

Hunt for

Unexpected CI/CD pipeline jobs, new runners or token creation on GitLab since mid-October.
Unexplained ASA/FTD reloads or VPN service crashes.
Requests to PAN-OS management interfaces from untrusted IPs.
Requests to wp-content/upgrade/ paths and repeated polling of setup-config.php.
LiteLLM 1.107.0 in container images or lockfiles.
Developer installs of unvetted Terraform providers, and recruiter-style approaches to engineers (TraderTraitor tradecraft).

From the archive

CISOs in the CISO Platform community are comparing notes on GitLab and edge-device exposure this week. Join 6K+ security leaders →

FAQ

Which exploited vulnerabilities should I patch first this week?
GitLab CVE-2026-97229 and Cisco CVE-2026-76418 are both in CISA KEV as of Oct 29, 2026; PHP2Shell is being exploited against Palo Alto Networks management interfaces.

Is the WordPress Core flaw exploited?
Wordfence reported 62,969 blocked attack attempts in 24 hours; the fix is WordPress 7.1.4.

Who was behind the Binance theft?
The FBI attributed it to North Korea's TraderTraitor group.

Handled an incident like this or run a red team that found it? Write it up for CISO Platform peers →

All Articles