Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-97229 in GitLab Community Edition And Enterprise Edition is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-29; federal remediation due 2026-11-01). NVD rates it 10 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-30)
- CVE-2026-109618 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-30)
- CVE-2026-109619 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-28)
- CVE-2026-118527 in Ivanti Connect Secure is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-30; federal remediation due 2026-11-13). It was not yet in the NVD; details came from the source articles. (checked 2026-10-31)
TL;DR
WordPress Core remote code execution attempted 63,000 times in 24 hours. GitLab's maximum-severity flaw is now exploited in attacks. PHP vulnerabilities affecting ~70% of websites have working exploits circulating. Patch immediately and monitor for signs of compromise.
Executive Summary
- WordPress Core remote code execution flaw is under active attack, with threat actors attempting exploitation approximately 63,000 times in the first 24 hours after vendor patches were released.
- GitLab Community Edition and Enterprise Edition maximum-severity integer overflow vulnerability (CVE-2026-97229) is now being exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog.
- Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) impact approximately 70% of websites globally, with working public exploits available and targeted attacks already observed.
- TeamViewer patched a flaw that allows a compromised or malicious remote host machine to initiate attacks against the controlling computer in a remote session.
- Chinese state-sponsored threat actors are deploying an AI-powered penetration testing framework called ARTEX to target more than 200 organizations simultaneously.
Top Threats Today
1. WordPress Core Remote Code Execution — 63,000 Attack Attempts in 24 Hours
Severity: HIGH Affected: Technology, Retail
A high-severity remote code execution flaw in WordPress Core versions 4.7 through 7.1.3 has drawn approximately 63,000 attack attempts within 24 hours of patch release [1]. The vulnerability, which lacks a CVE identifier, is a case-sensitive race condition that allows unauthenticated attackers to execute arbitrary code ⚠[1][2]. Threat actors began exploitation immediately following vendor disclosure, indicating rapid weaponization of the flaw [1].
Sources:[1] The Hacker News[2] SecurityWeek
Recommended Action
- Immediately update all WordPress installations to version 7.1.4 or later.
- Monitor web server logs and WAF signatures for exploitation attempts targeting the race condition.
- Review access logs for unexpected POST requests and PHP execution patterns dating back to patch release.
- Consider temporarily blocking WordPress admin endpoints from untrusted networks pending patch deployment.
2. GitLab Maximum-Severity Flaw Exploited in Active Attacks
Severity: HIGH Affected: Technology
Attackers have begun exploiting CVE-2026-97229, a maximum-severity integer overflow vulnerability in GitLab Community Edition and Enterprise Edition, according to the US Cybersecurity and Infrastructure Security Agency [1]. The vulnerability allows an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration [2]. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 29, 2026, with a federal remediation deadline of November 1, 2026 [2]. This represents an escalation from awareness to confirmed active exploitation [1].
Sources:[1] BleepingComputer[2] CISA KEV
Recommended Action
- Prioritize patching of all GitLab instances to the latest security release immediately.
- Review CI/CD pipeline configurations for suspicious or anomalous regular expressions.
- Enable audit logging on GitLab to capture code execution and authentication events.
- Restrict CI/CD runner execution to isolated environments until patching is confirmed.
3. Critical PHP Vulnerabilities Affecting ~70% of Websites — Exploits Active
Severity: HIGH Affected: Technology, Retail, Finance
A pair of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) impact approximately 70 percent of websites and have working public exploits in circulation [1]. Over 22.6 million potentially affected instances have been exposed ⚠[2]. Reports indicate the flaws allow attackers to seize full control of affected servers [1]. The PHP2Shell attack campaign has been observed targeting Palo Alto Networks firewalls and other enterprise infrastructure, though WordPress installations appear to have defensive protections that limit exploitation [2].
Sources:[1] Krebs on Security[2] SecurityWeek
Recommended Action
- Update PHP to the latest patched version across all web servers and applications immediately.
- Deploy web application firewalls (WAF) with rules specifically blocking PHP2Shell payloads and suspicious file upload patterns.
- Monitor for outbound network connections from PHP processes to command-and-control infrastructure.
- Implement strict file upload policies and disable PHP execution in user-writable directories.
- Plan for potential website outages; prioritize patching by business criticality.
4. TeamViewer Flaw Allows Compromised Hosts to Attack Controllers
Severity: HIGH Affected: Technology
TeamViewer has released a patch for a vulnerability that allows a malicious or compromised remote host machine to initiate attacks against the computer that connected to control it [1]. In a typical TeamViewer session, the computer that connects to take control is the viewer, and the machine it controls is the host; this flaw reverses that trust relationship [1].
Sources:[1] The Hacker News
Recommended Action
- Update TeamViewer to the patched version on all endpoint machines immediately.
- Review TeamViewer session logs for suspicious activity originating from remote hosts.
- Restrict TeamViewer access to trusted networks and implement multifactor authentication for sessions.
- Consider disabling TeamViewer on systems that do not require remote access.
5. Chinese State-Sponsored Actors Deploy AI-Powered ARTEX Framework
Severity: HIGH Affected: Government, Finance, Technology
Chinese state-sponsored threat actors are using a Go-based artificial intelligence-powered penetration testing framework called ARTEX in coordinated attacks targeting over 200 high-value organizations simultaneously [1]. The activity has been attributed by CrowdStrike to a China-based threat actor [1].
Sources:[1] The Hacker News
Recommended Action
- Cross-reference your organization against publicly available target lists and increased threat intelligence collection if your sector is named.
- Enhance endpoint detection and response (EDR) monitoring for suspicious Go-based process execution and network reconnaissance activity.
- Review firewall and proxy logs for connections to known command-and-control infrastructure associated with Chinese state-sponsored actors.
- Coordinate with law enforcement and threat intelligence partners for indicators of compromise.
Today’s Action Checklist
- ☐ URGENT: Patch WordPress Core to 7.1.4+; monitor logs for the numerous-per-day attack volume.
- ☐ URGENT: Update all GitLab instances; review CI/CD pipelines for malicious regex patterns.
- ☐ URGENT: Patch PHP immediately; deploy WAF rules against PHP2Shell; prepare for potential site outages.
- ☐ URGENT: Update TeamViewer on all machines; review session logs for suspicious host-initiated activity.
- ☐ HIGH: Cross-reference organization against ARTEX campaign target lists; enhance EDR monitoring for Go-based processes.
- ☐ HIGH: Segment networks and restrict remote access tools to isolated subnets pending full patch deployment.