Run Adobe Commerce or Magento? Patch now

Week of 26 October to 1 November 2026

This week's top item: Adobe Commerce and Magento stores are under mass attack through a critical, unauthenticated file upload flaw. Run an online store on either? Patch it now. Node.js, the technology behind many business websites and apps, also needs an urgent update to fix a critical flaw in its bundled Brotli compression tool. A maximum-severity flaw in self-managed GitLab servers, a Linux kernel flaw criminals are already using, and a Cisco ASA or FTD firewall flaw round out a busy week for anyone running their own servers, developer tools or firewalls. If you patched Ivanti Connect Secure after last week's briefing, there's a further update needed too. We check CISA's Known Exploited Vulnerabilities catalogue and ASD's ACSC alerts every day this week continues, and we'll add more here as soon as something else is worth your attention.

1. 1

   Run an online store on Adobe Commerce or Magento? Patch it now27 Oct

   Any business running an online store on Adobe Commerce or Magento Open Source, whether self-hosted or through a hosting provider. If your store runs on a platform like Shopify, Wix or Squarespace instead, this doesn't apply to you.

   Adobe Commerce and Magento Open Source, the software behind many online stores, have a critical flaw that lets a criminal upload and run a malicious file on your store without logging in, taking it over completely. Security researchers have found attacks on the large majority of Magento and Adobe Commerce stores worldwide, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of actively exploited vulnerabilities on 27 October 2026. Adobe released a fix, a patch called the 2026-jul update, back in July 2026, but many stores on older versions still haven't applied it.

   Do this

   Ask whoever manages your online store: "Are we running Adobe Commerce or Magento Open Source, and have we applied Adobe's July 2026 security patch (APSB26-73) that fixes CVE-2026-48356?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Adobe Commerce and Magento flaw ↗ · Adobe security bulletin APSB26-73 ↗CVE-2026-48356 · CWE-434

2. 2

   Run a website or app on Node.js? Patch it now27 Oct

   Any business whose website, app or internal tool is built on Node.js, especially one that accepts file uploads or other data from the public. Ask your developer or host if you're unsure what your site runs on. If your site runs on a platform like Wix, Squarespace or Shopify, this doesn't apply to you.

   Node.js, a technology that runs a large share of business websites, apps and internal tools, bundles a compression tool called Brotli that had a critical flaw. Sending it corrupted data could crash it, expose sensitive information, or let a criminal take it over completely. The same flaw affects other technologies built on the same Brotli code, including Python and Microsoft's .NET. The Node.js project released a fix on 21 October 2026, and CISA added the flaw to its list of actively exploited vulnerabilities on 27 October 2026.

   Do this

   Ask your web developer or host: "Does our website or application run on Node.js, and has it been updated to version 22.23.4, 24.22.1 or 26.12.1 or later to fix CVE-2026-111497?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Google Brotli flaw ↗ · Node.js security advisory, October 2026 ↗CVE-2026-111497 · CWE-252 · CWE-787

3. 3

   Run a self-managed GitLab server? Patch it now29 Oct

   Any business running its own (self-managed) GitLab Community or Enterprise Edition server for its developers, rather than GitLab's own cloud service at gitlab.com or GitLab Dedicated. If you don't have an in-house development team, or your developers use GitLab.com or GitLab Dedicated, this doesn't apply to you.

   GitLab, software many development teams use to store and manage code, had a maximum-severity flaw in versions businesses run themselves, known as self-managed GitLab Community or Enterprise Edition. A specially crafted continuous integration and continuous deployment (CI/CD) configuration, the automated steps that build and test software, could let a criminal run their own code on your GitLab server without logging in at all. GitLab released a fix on 12 October 2026, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of actively exploited vulnerabilities on 29 October 2026.

   Do this

   Ask whoever manages your GitLab server: "Are we running a self-managed GitLab Community or Enterprise Edition server, and has it been updated to version 19.4.2, 19.3.5 or 19.2.8 to fix CVE-2026-97229?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: GitLab flaw ↗ · GitLab security release, October 2026 ↗CVE-2026-97229 · CWE-190

4. 4

   Run your own Linux servers? This month's kernel patch matters28 Oct

   Any business running its own Linux servers, virtual machines or network storage (NAS) devices, hosted or on your own premises, rather than relying entirely on a cloud or SaaS provider that manages patching itself. If you only use Windows and Mac computers plus cloud services like Microsoft 365 or Google Workspace, this doesn't apply to you.

   A flaw in the Linux kernel, the core software every Linux server and device runs on, lets someone who already has basic access to a Linux machine escalate themselves to full administrator (root) control. Researchers have shown it chained with two other flaws to plant hidden backdoors and run commands as administrator, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of actively exploited vulnerabilities on 28 October 2026. The major Linux distributions, including Red Hat, AlmaLinux and Rocky Linux, have already released patches.

   Do this

   Ask your IT provider: "Have our Linux servers been patched for the kernel vulnerability CISA added on 28 October 2026 (CVE-2026-46300)?"

   Essential Eight: Patch operating systemsISM: System patching

   Sources: CISA KEV: Linux Kernel flaw ↗ · Red Hat: CVE-2026-46300 ↗CVE-2026-46300 · CWE-456

5. 5

   Run a Cisco ASA or FTD firewall for VPN access? Patch it now29 Oct

   Businesses using a Cisco Secure Firewall ASA or Secure FTD device to let staff connect in remotely over VPN, especially if logging in requires a second authentication step on top of a password. If your firewall isn't a Cisco ASA or FTD, or you don't offer remote access VPN, this doesn't apply to you.

   Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) devices, often used to let staff connect to the office network remotely over a virtual private network (VPN), have a flaw that lets a criminal crash the device over the internet without logging in, cutting off that remote access. It only affects firewalls where a second authentication check, such as a one-time code alongside a password, is configured for VPN logins. Cisco says criminals are already using this flaw and has released updated software to fix it.

   Do this

   Ask whoever manages your network: "Is our firewall a Cisco ASA or Secure FTD device, and has it been updated to fix CVE-2026-76418?"

   Essential Eight: Patch operating systemsISM: Network security

   Sources: CISA KEV: Cisco Secure Firewall ASA and FTD flaw ↗ · Cisco advisory: cisco-sa-asaftd-tunnel-dos-s6mgkb75 ↗CVE-2026-76418 · CWE-690

6. 6

   Run Ivanti Connect Secure for VPN access? There's a second patch30 Oct

   Businesses using Ivanti Connect Secure as their VPN gateway for remote access. If you already applied last week's patch (to version 25.1.1.2 or 22.8R2.5), that's not enough on its own, a further update is needed. If your staff connect to the office through a different VPN product, this isn't yours.

   Ivanti has released a further fix for Ivanti Connect Secure, the VPN gateway covered in last week's briefing over a different, actively exploited flaw. Two new flaws, one letting someone already logged in take full administrator control and the other letting them plant a file in a predictable location on the device, can be chained together with that earlier flaw. Ivanti has confirmed criminals are using this combination against a small number of customers, and the US Cybersecurity and Infrastructure Security Agency (CISA) added both new flaws to its list of actively exploited vulnerabilities on 30 October 2026. The fix is a newer update than the one recommended last week.

   Do this

   Ask whoever manages your VPN: "Is our Ivanti Connect Secure gateway updated to version 25.1.1.3 or 22.8R2.6, the fix released after last week's patch?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Ivanti Connect Secure flaws ↗ · Ivanti security advisory: CVE-2026-104935 chain ↗CVE-2026-111357 · CVE-2026-118527 · CWE-306 · CWE-862 · CWE-345 · CWE-340

Latest ISM release: ISM September 2026: What Changed and What to Check →What the ISM is and how we assess it →