This week in security: Cisco ASA, Linux kernel and PeopleSoft

Edge devices and web platforms dominated the week of 2026-W44: CISA added 12 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, among them Cisco ASA and FTD, the Linux kernel, PHP and Ivanti Connect Secure. This weekly security digest rounds up the posts we published and the KEV additions that matter most for patching.

Top stories

• Cisco ASA and FTD SSL VPN DoS flaw CVE-2026-76418 exploited: CISA lists it with a 1 November due date; Cisco’s mitigations and a check for unexpected reloads are the next steps.
• Linux kernel CVE-2026-46300 added to CISA KEV: The KEV deadline is 31 October, so kernel patching and webshell hunting cannot wait.
• Oracle PeopleSoft PeopleTools flaw CVE-2026-35273 is three chained bugs: ZDI describes a zero-day exploited by ShinyHunters as three chained flaws; PeopleTools 8.61 and 8.62 owners should check the Oracle fix.
• Adobe Commerce and Magento CVE-2026-48356 added to CISA KEV: Exploited in the wild, with a 10 November deadline for stores to apply mitigations.
• PHP2Shell: PHP RCE flaws CVE-2026-109618 and CVE-2026-109619: Two critical PHP flaws with public proof of concept and live attacks; both are in KEV.
• Arista VeloCloud Orchestrator flaw exploited (CVE-2026-114625): A SQL injection in an SD-WAN management plane, added to KEV with a 26 October deadline.
• Collabora CODE Server flaw exploited in Nextcloud (CVE-2026-110447): A command injection in the built-in CODE Server; our post covers the fixed version.
• LiteLLM supply chain attack traced to leaked master key: A key committed to a public repo in May was never revoked, so check your LiteLLM installs.
• Firewall and VPN breaches by actor k0t expose 70,000+ credentials: Group-IB and NyxLab link the actor to attacks on FortiGate and GlobalProtect edge devices.

Newly exploited vulnerabilities

These are the vulnerabilities CISA added to the KEV catalog this week, with the federal remediation due date. KEV status means exploitation has been observed, so treat the due date as a ceiling rather than a target.

Why this matters

Analysis: the week’s list is heavy on internet-facing and management-plane software: VPN and firewall appliances, an SD-WAN orchestrator, an ERP platform, a storefront and a web runtime. These are the systems attackers reach first and defenders often patch last. Two items from this week’s KEV list, the PHP flaws and the Arista and Collabora bugs, already carry due dates that have passed or fall within days, so they belong at the front of the queue.

What to prioritise next week

• Patch or mitigate anything in the table whose due date has passed or falls before 2 November: the PHP, Arista, Collabora, Linux kernel, Cisco, GitLab and Ivanti (CVE-2026-111357) entries.
• Inventory your Cisco ASA and FTD devices and check for unexpected reloads, as covered in our Cisco post.
• If you run PeopleSoft PeopleTools 8.61 or 8.62, confirm the Oracle fix and hunt for web shells, as described in our PeopleSoft write-up.
• Review Adobe Commerce and Magento stores against the vendor mitigations before the 10 November deadline.
• Audit LiteLLM installs and rotate any exposed master keys, per our supply chain report.

The KEV list above is drawn from the CISA KEV catalog. Open each linked post for affected versions and fixes.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

All stories this week

• MFA fatigue attacks: how push bombing works and how to stop it
• Mitsubishi Electric GENESIS64 flaws incl. CVE-2026-16436 (9.2)
• Windows Error Reporting RCE flaw CVE-2026-83519 rated 9.8
• Eye Security disables abandoned Popcorn Time updater (CVE-2026-30612)
• Microsoft Teams adds AI phishing detection for external chats

Sources

• CISA Known Exploited Vulnerabilities Catalog
• Cisco ASA and FTD SSL VPN DoS flaw CVE-2026-76418 exploited
• Linux kernel CVE-2026-46300 added to CISA KEV