IT security 2026-10-24

Level Critical — 89/100 — 2026-10-24

Critical day: 26 stories ranked, 5 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: GitLab patches unauthenticated code execution through crafted regular expressions (82/100).

1. GitLab patches unauthenticated code execution through crafted regular expressions — 82/100 (CVE-2026-110264)
2. PHP2Shell: critical unauthenticated RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619) require immediate updates — 81/100 (CVE-2026-109618)
3. Emergency distrust of eMudhra root and intermediate CAs after key generation flaw made private keys brute-forceable — 76/100
4. Critical OS Command Injection in Collabora Online Built-in CODE Server — 75/100 (CVE-2026-110447)
5. Arista VeloCloud Orchestrator SQL Injection Vulnerability — 74/100 (CVE-2026-114625)
6. Brotli decoder flaw has demonstrated Node.js code execution and affects multiple software stacks — 70/100 (CVE-2026-111497)
7. Leaked LiteLLM Master Key Exposes GitHub Tokens — 70/100
8. Metasploit adds six Langflow modules covering an authentication bypass and unauthenticated RCE flaws — 70/100
9. BlackX UEFI Bootkit Bypasses Secure Boot — 70/100
10. HPE releases ArubaOS updates addressing authentication bypass and code execution flaws — 70/100