Briefing · 2026-11-02

Nov 2: Desk Briefing

November 2 desk briefing on the latest published coverage: Ivanti KEV remediation, GitLab and Drupal exploitation, Cisco patches, and November 1 disclosures.

November 2, 2026

tldr.txt

CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV. Fixes for the full exploited chain are now out in 25.1.1.3 and 22.8R2.6.
CISA added GitLab's CVSS 10.0 RCE to KEV after an attempted attack on Alpine Linux's instance. Federal deadline is Nov 1. Patch, then check for crashes.
Drupal says CVE-2026-118539, a highly critical Commerce Core access bypass, is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit your orders.
CVE-2026-76418 lets unauthenticated attackers crash Cisco ASA and FTD firewalls via SSL VPN. Cisco confirmed active exploitation; patches released October 29.

The November 2 desk starts with the latest reports already published. The Ivanti KEV remediation date is today; the other items below retain the status stated in their linked coverage.

Ivanti Connect Secure Chain Fixes Ship, KEV Due Nov 2. CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV. Fixes for the full exploited chain are now out in 25.1.1.3 and 22.8R2.6. Source: CISA KEV catalog.
GitLab CVE-2026-97229 Hit Alpine Linux, Now in KEV. CISA added GitLab’s CVSS 10.0 RCE to KEV after an attempted attack on Alpine Linux’s instance. Federal deadline is Nov 1. Patch, then check for crashes. Sources: Alpine’s incident report, CISA KEV catalog.
Drupal Commerce Core Bypass Exploited, Patch 3.3.13. Drupal says CVE-2026-118539, a highly critical Commerce Core access bypass, is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit your orders.
Cisco Patches ASA/FTD VPN Zero-Day, Active Attacks. CVE-2026-76418 lets unauthenticated attackers crash Cisco ASA and FTD firewalls via SSL VPN. Cisco confirmed active exploitation; patches released October 29.
Android ‘SMS of Death’ Crash Fix Exists, but Patch Coverage Is Unclear. Google’s Android source contains a fix for a remote telephony crash. The October bulletin does not identify the issue, so device patch coverage remains unconfirmed. Sources: Google source commit, October security bulletin.
Prefab UI sandbox escape fixed in 0.21.0. CVE-2026-120338 affects Prefab UI’s optional Generative UI sandbox in versions 0.14.0 through 0.20.2. The 0.21.0 release contains the fix. Sources: published CVE-2026-120338 record, released that version on October 26, NVD entry.
Three Command Injection CVEs Affect WAVLINK WN553X1-B. Three published CVE records identify command injection flaws in WAVLINK WN553X1-B firmware. All carry a CNA CVSS 3.1 score of 9.9. Sources: CVE-2026-120238, CVE-2026-120239, CVE-2026-120240.
Chainalysis Confirms Breach by ‘Agentic’ Attacker. Chainalysis confirms an external actor reached internal tools and customer contact data using ‘offensive agentic techniques’. Entry point and dwell time unconfirmed.

Sources