Oct 22: GitLab CVSS 10, PHP2Shell Exploits, QPACK Crash

The most urgent item on October 22 is GitLab CVE-2026-110264. CVSS 10.0, unauthenticated RCE via a regex vulnerability, affects self-managed GitLab going back to version 7.0. That is twelve years of installations. GitLab has released emergency patches. Self-managed instances that are reachable from the internet should be treated as actively targeted until patched.

PHP2Shell exploitation begins

PHP2Shell patches for CVE-2026-109618 and CVE-2026-109619 started deploying on October 21. By October 22, sensors were logging active exploitation attempts. The patches are available; the gap now is deployment velocity. CISA added both CVEs to the KEV catalog, with federal agencies under a patch deadline. PHP installations without the emergency patch applied are exposed.

QPACK HTTP/3 amplification

FoxIO’s research documented QPACK header decompression bugs in multiple HTTP/3 stacks. The worst case allows 4,000x memory amplification from a single connection, reaching denial-of-service without volumetric traffic. Quic-go, Cloudflare quiche, and lsquic all have patches available. Services running HTTP/3 endpoints should verify library versions.

Storm-0940 and ARTEX

Microsoft linked Storm-0940 to a supply chain compromise targeting ConnectWise’s cloud backup infrastructure. The tool in use, ARTEX, is an AI-assisted attack framework that automated the intrusion sequence. The supply chain angle matters: ConnectWise has broad reach into MSP infrastructure. Customers should review audit logs from their ConnectWise environments for the window Microsoft identified.

Operation Serengeti III

Interpol coordinated Operation Serengeti III across 21 African nations over two months, resulting in 1,462 arrests and the disruption of nearly 11,000 malicious networks. Targets included BEC fraud operations, ransomware affiliates, and investment scam infrastructure. The operation is the largest Africa-focused cybercrime enforcement action on record.