Zarro Technology · Security briefing
Security developments for 19–25 October 2026 include active exploitation affecting business networking and PHP, alongside important enterprise-software and application-runtime updates. The following items highlight affected services, practical checks and remediation.
CVE-2026-114625 (9.4)
Arista disclosed CVE-2026-114625 on 22 October and confirms active exploitation. An authenticated user, including an Enterprise Read Only user, can escalate to operator privileges on affected on-premises orchestrators. Hosted and Dedicated services were affected but have already been patched by the vendor.
Arista identifies 74.82.197.86 and 38.54.50.151 as attack sources. Check VCO web access logs for these addresses, unusual encoded paths, references to internal services and unexpected administrator activity. Preserve relevant logs if compromise is suspected.
Read-only Linux log search — replace the path with your uncompressed VCO access-log file; protected logs may require administrator access:
grep -nE '(^|[[:space:]])(74[.]82[.]197[.]86|38[.]54[.]50[.]151)([[:space:]]|$)' /path/to/vco-access.logUpgrade affected 5.2.x, 6.1.x or 6.4.x installations to 5.2.3.18, 6.1.3.10 or 6.4.2.12, respectively, or a later fixed build in that train. Restrict the management interface to trusted administrative networks while patching. IoC matches warrant investigation; no matches do not establish that the system is clean.
Sources: Arista Security Advisory 0199
CVE-2026-109618 (9.2), CVE-2026-109619 (9.2), CVE-2026-115560
PHP released fixes on 21 October for CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated code execution. Websites, WordPress installations, business applications and embedded PHP runtimes may be exposed. AWS reports exploitation attempts, including activity before public disclosure.
AWS recommends examining captured POST bodies for PHP_SESSION_UPLOAD_PROGRESS and correlating this with unexpected processes or file changes. This is a hunting lead, not proof of compromise; normal access logs generally omit request bodies. Review the vendor’s published source-IP list and investigate suspicious activity.
Apply PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the distribution’s equivalent backported patch. Update container images and bundled runtimes, then confirm the web service is running the corrected build.
PHP’s 23 October notice additionally recommends the following server-level setting for a separate, unusual session-handling vector, CVE-2026-115560. Restart affected workers after applying it; it does not replace the original patches.
session.upload_progress.enabled=0Sources: PHP security notices · AWS exploitation and investigation guidance
CVE-2026-91323 (9.8), CVE-2026-83399 (9.8)
Oracle’s 20 October Critical Patch Update covers multiple business-software families. Examples include WebLogic Server flaws CVE-2026-91323 and CVE-2026-83399, rated 9.8 and remotely exploitable without authentication. The risk matrix lists affected WebLogic releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 for these issues.
Inventory Oracle applications and embedded components, compare each installed version and patch level with the product-specific risk matrix, and apply the relevant October CPU patches using Oracle’s installation instructions. Include database, middleware and Java estates where listed. There is no single fixed version covering all Oracle products. Prioritise exposed services and unauthenticated attack paths. The patch advisory alone does not establish active exploitation of these specific WebLogic flaws.
CVE-2026-111497 (9.2), CVE-2026-105482 (7.4), CVE-2026-105483 (7.4), CVE-2026-106069 (7.4)
The 21 October security release addresses high-severity issues in Node.js 26.x, 24.x and 22.x. CVE-2026-111497 can corrupt memory when an application decompresses malicious Brotli data, potentially enabling code execution. Other fixes address DNS-name truncation and TLS hostname verification, including CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069. Exposure depends on application behaviour.
Update to 26.12.1, 24.22.1 or 22.23.4, or a later fixed release on your supported branch. Check the runtime actually used by the service, including packaged applications and containers. This read-only command reports the Node executable in the current environment; it does not inventory every running service:
node --versionThe cited release notice does not establish active exploitation. Investigate abnormal application crashes and unexpected DNS/TLS behaviour as leads, not definitive IoCs; no issue-specific compromise signature is supplied here.
Sources: Node.js October security release
CVE-2026-89078 (9.9), CVE-2026-93577 (9.9), CVE-2026-97229 (10.0), CVE-2026-110264 (10.0)
GitLab’s 21 October critical update addresses CVE-2026-110264, which can allow unauthenticated code execution under certain conditions. Ruby’s 23 October releases fix this and related underlying regular-expression bugs. Applications compiling attacker-controlled patterns should assess exposure; developer-defined patterns alone are outside Ruby’s stated affected use case.
GitLab links detection guidance for Onigmo native-worker crashes and bursts of Org-mode rendering errors. These are investigation leads, not conclusive evidence. The cited notices do not establish active exploitation of this specific issue.
Use GitLab 19.5.1, 19.4.3 or 19.3.6, or the vendor-listed fixed backport for an older release line, following the supported upgrade path. Standalone Ruby applications should use 4.0.9, 3.4.12 or 3.3.13, or later fixed releases. Updating system Ruby alone does not patch GitLab’s bundled runtime. If a Ruby upgrade is delayed, avoid compiling untrusted patterns; timeouts are not sufficient.
Sources: GitLab critical patches and detection links · Ruby regular-expression fixes
Zarro Technology
