CISA KEV, 20 Oct to 13 Nov 2026: 31 Exploited CVEs Ranked for AppSec

Update, 13 November 2026, evening (IST): after this post went live, CISA added two more entries to the KEV catalog on 13 November, so the count for this window is now 33, not 31. They are CVE-2026-123039, a Check Point incorrect permission assignment in Gaia OS (the DynamicCLI daemon runs as root on a world-writable local socket, so an authenticated local user can gain root on Firewall, Security Gateway, Multi-Domain Server, Scalable Platforms and SMS), and CVE-2026-114713, an UnrealIRCd delimiter injection between linked servers. Check Point customers should apply the fix in sk1000362 and restrict local shell access on the gateways and management servers until it is installed.

Between 20 October and 13 November 2026, CISA added 31 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Seven are open source components that sit inside software you build: two PHP flaws, Brotli, OpenSSH, GPUStack, FreeSWITCH and a Linux kernel bug. GitLab's entry traces back to Ruby's regex engine. Patch those first, and do it by inventory, not by memory.

The rest are appliances, browsers and desktop products where the fix comes from the vendor. This post goes deep on the entries most likely to touch an engineering team's own code and pipelines, gives a full table of all 31, and ends with a prioritisation method and ways to close the gap when a patch cannot land today. Everything was checked against the KEV JSON feed (catalog version 2026.11.10, read on 13 November 2026) and each vendor or maintainer advisory. Where a fact rests on one researcher or one outlet, we say so.

The window at a glance

A KEV listing means CISA has reliable evidence of exploitation in the wild and a clear remediation path. It does not say how widely or by whom, and it says nothing about whether the vulnerable code is present in your systems or reachable. Those two questions are yours to answer, and this post is built around them.

Which of these live in your code?

Most KEV coverage reads like a patch list for an IT team. This window is different: many entries are components engineering teams pull into their own builds, often without knowing it.

The first four rows are where SCA, SBOMs and image scanning earn their keep. PHP or Brotli does not show up on an asset list. It shows up as an image layer, a statically linked object or a deep transitive dependency.

GitLab CVE-2026-97229: a regex in CI/CD config that runs code on the server

What it is. GitLab rates CVE-2026-97229 as critical, CVSS 3.1 score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). According to GitLab's patch release notes, under certain conditions an unauthenticated user could run arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because regular expression validation was insufficient. The issue was reported through GitLab's bug bounty program by Johan Carlsson (joaxcar).

Affected and fixed versions (GitLab CE and EE).

GitLab shipped the fixes on 12 October 2026. GitLab.com and GitLab Dedicated were already patched. CISA added the CVE to KEV on 29 October 2026. GitLab's notes list no workaround.

The library underneath. The interesting part for AppSec teams is where the bug lives. The KEV entry itself notes that other products may be affected by "the same underlying Ruby/Onigmo Integer Overflow issue." On 23 October the Ruby core team published regexp fixes for the GitLab CVEs. It maps four GitLab CVEs to bugs in Onigmo, the regex engine inside Ruby:

Ruby 4.0.9, 3.4.12 and 3.3.13 each carry all four fixes. Ruby 3.3 is normally in security-only maintenance, and the team made an exception for these. Ruby's post is specific about who is exposed: applications that compile regular expressions from attacker-controlled strings through Regexp.new, Regexp.union, Regexp.compile, or interpolation into a literal such as /#{input}/. Applications that only use developer-written patterns are not affected. Two details matter for anyone hoping to mitigate without upgrading. Regexp.timeout does not protect against these bugs, and limiting pattern length is unreliable because some of them trigger with short patterns.

Why a CI/CD config is a code execution surface. GitLab CI rules can contain regular expressions, and the server compiles them when it evaluates the pipeline. Wherever users can submit a pattern that a server compiles, the regex engine is attack surface, including your own Ruby services that accept search or filter patterns.

What to do.

1. Find every self-managed GitLab instance, including the ones a team stood up for a side project. On Omnibus installs, sudo gitlab-rake gitlab:env:info prints the version, as does /opt/gitlab/embedded/service/gitlab-rails/VERSION.
2. Upgrade to the newest patch release on your line, not the first fixed one. CVE-2026-110264 was fixed later, in 19.5.1, so stopping at the minimum version leaves a sibling bug open.
3. Review GitLab's six published detections for self-managed instances, such as "Onigmo native worker crash" and "ci regexp guard rejection". Worker crashes while compiling CI regexes deserve an alert.
4. For your own Ruby code, search for dynamic regex compilation: grep -rnE "Regexp\.(new|union|compile)|/#\{" app lib. Then check the Ruby version in every image that runs that code with ruby -v, and move to 4.0.9, 3.4.12 or 3.3.13 or later.

EPSS, FIRST's Exploit Prediction Scoring System, gave CVE-2026-97229 0.693 on 12 November 2026, the 99.4th percentile.

Cisco BroadWorks CVE-2026-20320 and the reported "Operation Snowball" AI-agent campaign

What it is. Cisco's advisory cisco-sa-bworks-xxe-uwUd7CEt (bug ID CSCwv48590) describes an out-of-band blind XML external entity (XXE) injection in the Open Client Interface (OCI) XML parser of Cisco BroadWorks. External entity resolution was enabled by default. An unauthenticated remote attacker could send a crafted XML message to the OCI-P service and read sensitive files and configuration with the privileges of the BroadWorks user. CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected and fixed. Any vulnerable release of BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform is affected regardless of configuration. The first fixed release is RI.2026.07. For the Application Delivery Platform, Cisco notes the fix applies to the Open Client Server and OCIOverSoap components. There are no workarounds.

Timeline. Cisco first published the advisory on 19 August 2026. Version 1.1, on 12 November, says Cisco PSIRT became aware of active exploitation in November. CISA added it to KEV on 10 November, close to three months after the patch.

The reported campaign. On 11 November, The Hacker News reported research from Malbear Labs describing what the firm calls Operation Snowball. Every detail that follows comes from that single researcher source, as relayed by one outlet, and has not been independently confirmed. Treat it as reported, not established.

• Malbear Labs reports that an unknown, Chinese-speaking actor ran an autonomous agent framework against a European telecom provider and 13 companies hosted on its infrastructure over about two weeks.
• The article says the framework was built on a jailbroken version of a DeepSeek Flash model. It does not attribute that specific claim to a named source.
• According to Malbear Labs, the agent exploited CVE-2026-20320 against a BroadWorks Xtended Services Platform, release 23.0.1.1075, on port 2208.
• The firm reports that the agent enumerated hundreds of assets, extracted dozens of credential sets and exfiltrated thousands of rows of subscriber billing and device records.
• Reported stolen items include the system identity private key, which authenticates traffic between BroadWorks components, three SSL credential sets and three more private keys.
• Tools named are Sliver, Chisel and Behinder web shells.
• The researchers describe a primary agent handing parallel tasks to worker agents and adapting to defences without operator input, run by an actor "who delegated the intrusion to an AI."

What engineering teams should take from it. Two lessons hold whether or not every detail does. The gap between a public patch and exploitation is the window that matters, and three months is long when an automated attacker can work through a list of known flaws; the article lists about 13 other products the agent could reportedly target. And XXE is an old bug class that keeps shipping, so it belongs in your own code review checklist.

If your services parse XML, check that external entities and DTDs are off:

• Java: set http://apache.org/xml/features/disallow-doctype-decl to true on DocumentBuilderFactory, or at minimum disable external general and parameter entities.
• Python: parse untrusted XML with defusedxml, or with lxml configured with resolve_entities=False and no_network=True.
• .NET: keep DtdProcessing.Prohibit and a null XmlResolver on XmlReaderSettings.
• PHP: avoid LIBXML_NOENT and LIBXML_DTDLOAD on untrusted input.

BroadWorks operators should upgrade to RI.2026.07 or later, restrict which networks reach OCI-P, and if exposed before patching, rotate the system identity key, certificates and stored credentials. Key material read through XXE stays valid after the patch.

EPSS gave CVE-2026-20320 just 0.008 on 12 November, the 57.7th percentile.

GPUStack CVE-2026-102895: admin takeover of an AI model-serving platform

What it is. GPUStack is an open source platform for running and serving AI models across GPU clusters. Advisory GHSA-gj9m-f8ph-pmhr, published by the maintainers on 31 July 2026, describes an authentication bypass that gives an unauthenticated attacker full administrator access over the network. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWEs 287, 290 and 346.

Affected and fixed. The PyPI package gpustack below 2.2.0 is affected. Version 2.2.0 is the fix. CISA added the CVE to KEV on 9 November 2026.

Root cause, in plain terms. In get_current_user in gpustack/api/auth.py, a request whose source counts as loopback was promoted to the built-in administrator when force_auth_localhost was False, which was the default. The source address came from a helper that could report 127.0.0.1 in two ways:

1. A reverse proxy on the same host that connects to GPUStack over 127.0.0.1 makes every remote request look local, with no header or credential needed.
2. A client could simply send the header X-GPUStack-Real-IP: 127.0.0.1.

The advisory calls it trusting the network source of a request as an authentication signal. Any service that treats "came from localhost" or a forwarded-IP header as identity has the same bug shape.

Impact listed by the maintainers.

• Enumerate and change users, models, workers and configuration.
• Mint persistent administrator API keys with scope ["*"] that work from any source address.
• Read worker credentials and cloud or model-provider secrets.
• Run code on worker hosts through the admin-only POST /v2/inference-backends/from-yaml endpoint.

The advisory states that exploitation was observed in the wild against a v2.1.1 deployment, where attackers created custom inference backends that ran reverse shells. A security consultant reported the active exploitation to the maintainers.

What to do.

1. Inventory GPUStack wherever it runs. It often arrives as a research or data science team's own deployment, outside the platform team's asset list. Check installed versions with pip show gpustack in the environment or image.
2. Upgrade to 2.2.0 or later.
3. If you cannot upgrade today, set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at the edge, make sure your proxy cannot make outside traffic look like loopback, and keep the API off untrusted networks behind a VPN or edge authentication.
4. Assume exposure if a vulnerable instance was reachable. Revoke all API keys, especially any with ["*"] scope, review the list of inference backends for entries nobody recognises, and rotate every cloud and model-provider credential the platform held.

Why it matters for AI security. Model-serving platforms hold keys to cloud GPU accounts, model registries and provider APIs, and many sit outside normal patch and inventory processes. AI orchestration tools have shown up in KEV before, and we covered that pattern in AI orchestration platforms in CISA KEV.

EPSS: 0.005 on 12 November, the 44.5th percentile, the lowest score of all 31 entries in this window.

PHP CVE-2026-109618 and CVE-2026-109619: unauthenticated code execution in the runtime

What they are. The PHP project's 21 October 2026 security release fixed two flaws, each rated CVSS 4.0 score 9.2 and each allowing unauthenticated remote code execution. They have been widely nicknamed php2shell.

Affected and fixed. PHP says all installations serving web requests are at risk. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone on an earlier 8.6.0 pre-release should move to 8.6.0 RC4 or later. PHP lists the SAPIs at risk as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and rates mod_php as the highest risk because a demonstrated exploit fires before any application code runs. CISA added both CVEs to KEV on 26 October 2026, five days after the release.

Unsupported branches. PHP 8.1 and earlier get no official updates, though some distributions ship backports, and the PHP security team published minimal source backports for 7.4, 8.0 and 8.1. We come back to that at the end. PHP 8.2 itself reaches end of life on 31 December 2026, so the 8.2.35 fix buys about seven weeks.

Interim mitigations, from PHP's advisory. These are not substitutes for the update.

; CVE-2026-109618 (out of memory path)
memory_limit = -1
post_max_size = 8M        ; or 32M if uploads are needed
upload_max_filesize = 8M  ; keep below post_max_size

; CVE-2026-109619 (stale state path)
session.upload_progress.enabled = 0
fatal_error_backtraces = 0   ; PHP 8.5 only

PHP adds that these settings must be applied in php.ini, an FPM pool or server configuration, and every worker must be restarted. ini_set() and .user.ini do not count. Request limits at the web server or proxy help with the memory path. Do not use RLIMIT_AS or RLIMIT_DATA for it.

A chained entry in the same window. CISA added Linux kernel CVE-2026-46300 on 28 October. Its KEV description says the kernel bug, a missing initialisation that allows unintended changes to page-cache-backed data during socket buffer coalescing in ESP input processing, "can be chained" with both PHP CVEs to plant PHP web shells and run commands as root. So a patched PHP on an unpatched host kernel is still a problem, and the reverse is true as well.

The inventory problem. PHP appears as php:8.3-fpm in a Dockerfile, a FrankenPHP binary, the runtime under a WordPress or Magento image, or inside a vendor appliance. Finding every copy is the work. Our walk-through is Find and patch every PHP runtime after php2shell, and the vulnerability itself is explained in php2shell CVE-2026-109618 and CVE-2026-109619 explained.

A quick first pass:

# Running PHP version on a host or inside a container
php -v
docker run --rm --entrypoint php <image> -v

# Which images in a registry export carry a PHP base
grep -rlE "^FROM .*php" --include=Dockerfile* .

EPSS: 0.99999 for both CVEs on 12 November, the top of the scale.

Brotli CVE-2026-111497 and WordPress CVE-2026-119977: the library inventory problem

These two look unrelated. One is a compression library, the other a content platform. They belong together because in both cases the hard part is not the fix. It is finding where the code lives.

Brotli CVE-2026-111497

What it is. The NVD record describes a buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli 1.0.3 through 1.2.0 on all platforms. A remote unauthenticated attacker with a crafted Brotli stream can corrupt adjacent decoder state, disclose memory, crash the process or potentially run code. Google, the CNA, scored it CVSS 4.0 9.2. NVD scored it CVSS 3.1 9.8. CWEs 252 (unchecked return value) and 787 (out-of-bounds write). Fixed releases are 1.0.10, 1.1.1 and 1.2.1, the last published on 21 October. CISA added it to KEV on 27 October.

The Node.js security release explains the mechanism most clearly. The decoder bundled with Node.js wrote past the end of an eight-byte internal buffer because an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending.

Where Brotli hides. Brotli is rarely a direct dependency. It ships inside runtimes, language bindings and binaries. The advisories published so far show the spread:

Sources for the table: GHSA-9v8h-qqgm-4m35, the Node.js release above and .NET announcement 494. Microsoft notes that ASP.NET Core request decompression and HttpClient automatic decompression are off by default, and that .NET Framework is not affected. The NVD record also links a release of the pure Go port andybalholm/brotli (v1.2.7, "Detect and report invalid stream earlier") and several industrial vendor advisories for products that embed Brotli. The Go port's release notes do not name the CVE, so check with its maintainer before assuming exposure either way.

Reachability matters here. The vulnerable path is the decoder fed with attacker data. A service that only compresses responses differs from one that accepts Content-Encoding: br request bodies or decompresses fetched content. That difference should decide the order in which you patch, not whether you patch.

First pass commands.

# Node.js runtime version in each image
docker run --rm --entrypoint node <image> -v

# Python environments
pip show brotli brotlicffi

# .NET runtimes on a host or image
dotnet --list-runtimes

# Native library in an image filesystem
find / -name "libbrotli*" 2>/dev/null

EPSS: 0.826 on 12 November, the 99.7th percentile.

WordPress CVE-2026-119977

What it is. The NVD record says WordPress Core 4.7 through 7.1.3 is vulnerable to remote code execution because full-package core upgrades use predictable, web-accessible staging paths. An unauthenticated attacker can run code on the server during the upgrade window. CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N), CWE-367, a time-of-check to time-of-use race. WordPress 7.1.4, released on 28 October 2026, fixes it along with a dozen other issues, and the fix is backported to every branch still eligible for security fixes, currently back to 4.7. CISA added it to KEV on 3 November.

The inventory angle. The window opens during the update itself, so do not switch off updates. Make sure the next one is the fixed release. WordPress is easy to forget because it comes in many shapes: an agency-run marketing site, a docs portal, an image with WordPress baked in, a monorepo that vendors core, or a Composer-managed install. Only some use the in-place updater the bug depends on.

What to do.

1. List every WordPress install and its version. The version is in wp-includes/version.php, or wp core version if WP-CLI is available.
2. Upgrade to 7.1.4 or the backport release for your branch.
3. Prefer immutable deploys. Build a new image with the fixed core and replace the running one, instead of upgrading in place on a live, web-reachable filesystem. That removes the window this bug depends on.
4. As general hardening, deny script execution in upload and upgrade working directories at the web server, and keep the web server user from writing to core files.

EPSS: 0.012 on 12 November, the 68.6th percentile.

OpenSSH CVE-2026-123158 "SSHole": an Alpine password bypass, exploited within two days

What it is. The NVD record says sshd in OpenSSH before 10.6p2, on Linux using musl libc without PAM, lacks a workaround for a password authentication bypass. For some account configurations, any password between 256 and 1024 characters succeeds. CVSS 3.1 8.1. Alpine Linux is the best-known platform with that combination.

Root cause. Alpine's advisory of 5 November explains it. Without PAM, sshd checks a password by hashing the attempt with crypt() and comparing it to the stored field. For an account whose stored field is too short to hold a salt, sshd borrows another account's salt. musl's crypt() returns * as an error value when the key is over 256 bytes. Since * is also the stored value for accounts with no password, the comparison succeeds. The OpenSSH 10.6p2 release notes say the root cause lies outside sshd, but sshd was hardened against it.

Affected configuration, per Alpine. All four must apply.

• openssh-server built without PAM, or openssh-server-pam with UsePAM no.
• PasswordAuthentication yes, which is the OpenSSH default.
• At least one account with * in the password field, such as root in Alpine base images since about 3.16, key-only users, directory users, or the alpine user in tiny-cloud images.
• At least one local account with a $5$ or $6$ password hash.

Not affected: containers that do not run sshd, PasswordAuthentication no, UsePAM yes, locked accounts (!), glibc distributions using PAM, and cloud-init images that turn password login off.

Fixed Alpine packages.

Fixed point releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Alpine warns that tiny-cloud images from 3.18.11 through 3.24.3 are vulnerable, and that upgrading the package does not replace the running daemon: restart sshd after apk upgrade -U -a.

What GreyNoise reports. GreyNoise runs sensors that log internet attack traffic. Its SSHole event page records the first exploitation against its sensors at 00:46:51 UTC on 7 November 2026, about 1 day and 8 hours after the CVE reached NVD. Early coverage cited six source addresses and 18 attack chains. By the page's 13 November update, GreyNoise listed 42 confirmed successful exploitation chains and 10 attacker addresses in confirmed post-exploitation activity, seven of them in a cluster it tracks as GT10. The counts are still moving, so quote the live page, not a snapshot.

Behaviour GreyNoise reports after login:

• Reconnaissance commands (id, uname, reading /etc/os-release), then reads of /etc/passwd and /etc/shadow.
• Queries to cloud metadata services at 169.254.169.254 and 100.100.100.200, and attempts to read root's SSH keys through doas.
• New keys added to authorized_keys for alpine and root.
• A new server_manager account and a doas rule allowing root without a password.
• A Python implant at /opt/py3/tac_agent.py, which GreyNoise calls TAC Agent, trying to enrol with tac.vpnla[.]org. GreyNoise says enrolment never succeeded on its sensor.
• Persistence through tiny-cloud-agent and tiny-cloud-sync init scripts.

Addresses GreyNoise ties to specific actions include 183.220.91.15, 79.116.138.30, 140.245.33.114, 196.128.138.201, 157.15.77.139, 103.140.130.248 and 20.255.63.133; use them for log searches, not as a complete block list. SANS Internet Storm Center documented scanning, and The Hacker News summarised reports of botnet and miner activity.

The image angle. Most production Alpine containers do not run sshd. The ones that do are the ones nobody remembers: a debug sidecar, a bastion, a CI runner, a dev container. With SBOMs for your images, a query answers this in seconds. Without them, it is a hunt.

# Is openssh-server installed in an Alpine image, and which version?
docker run --rm --entrypoint sh <image> -c "apk info -v 2>/dev/null | grep -i openssh"

# Is password login on?
docker run --rm --entrypoint sh <image> -c "sshd -T 2>/dev/null | grep -i passwordauthentication"

# Signs of use on a running host
grep "Accepted password for" /var/log/messages

If a vulnerable host was reachable, Alpine's guidance is to treat it as compromised when a login cannot be ruled out: review doas use, new users, new files and every authorized_keys file.

EPSS: 0.189 on 12 November, the 97.3rd percentile.

One cross-reference: Outlook CVE-2026-124194

Microsoft Outlook CVE-2026-124194, a spoofing flaw that leaks NTLMv2 hashes when a user opens a crafted message file, joined KEV on 10 November. We cover it in a separate post, and the Microsoft advisory has the fixed builds.

All 31 KEV additions, 20 October to 13 November 2026

Descriptions are summarised from the KEV feed. EPSS is the FIRST score and percentile on 12 November 2026. "Open source component" means CISA's entry flags it as a component that other products may include. Fixed versions are given where we read them in the vendor advisory; otherwise follow the vendor link.

Notes on entries not covered in depth:

• Plex. The vendor says the flaws were "being actively and widely exploited" after a public proof of concept on 16 October, and that internet-reachable servers older than 1.43.3.10861 should be assumed possibly compromised.
• Collabora CODE. The flaw fires only while the built-in CODE server is not running, and disabling the app does not help. Upgrade or remove it. See Collabora CODE CVE-2026-110447.
• Adobe Commerce. Adobe's 14 July bulletin said it knew of no exploits then. The 27 October KEV addition means that changed.
• Ivanti Connect Secure. Both entries chain with CVE-2026-104935, covered in Ivanti Connect Secure CVE-2026-104935.
• Chromium. Electron apps and anything else that embeds Chromium need their own update, on their own schedule.

How to prioritise: KEV, EPSS and reachability together

Thirty-one entries in three and a half weeks is more than most teams can treat as emergencies. The answer is not to pick one signal. It is to use three signals for three different questions.

What this window teaches about EPSS. GPUStack had the lowest EPSS of the 31 on 12 November (0.005), though its maintainers reported exploitation and CISA had listed it. Cisco BroadWorks sat at 0.008 two days after listing. PHP scored 0.99999. EPSS forecasts from observed activity, and niche products and targeted campaigns produce less of that signal. When KEV and EPSS disagree, KEV wins, because it records what already happened. More on how the three signals interact is in our CVSS vs EPSS vs KEV guide.

A working order of operations.

1. KEV, present and exposed: act now. The component is in your inventory, the version is affected, and the service is reachable from where attackers sit. For this window that might be an internet-facing PHP-FPM pool, a GitLab instance that accepts outside sign-ups, or an Alpine image running sshd with password login on.
2. KEV, present, reachability unproven: patch on a short clock. Present in the build, but your analysis cannot show the vulnerable path is called or the service exposed. Brotli in a service that only compresses responses is an example. Patch it in the next routine release, not the next quarter. Exposure changes when someone adds a feature.
3. KEV, present, proven unreachable: record it and still fix. Document why it is not exploitable today, use the record to explain the decision to auditors and customers, and remove it with the next image rebuild. Unreachable is a reason to reorder work, never a reason to keep a known exploited component forever.
4. Not on KEV, high EPSS, reachable: treat like KEV. EPSS is often early for widely deployed open source.
5. Not on KEV, low EPSS: normal cadence, ranked by reachability and asset value.

Where exposure overrides everything. For appliances, edge devices and anything with an admin interface on the internet, reachability is "yes" by default. The Barracuda, Ivanti, SonicWall, Cisco and Arista entries in this window go straight to the vendor patch, plus a check for signs of earlier compromise.

Watch the chains. Nine of the 31 KEV descriptions say the flaw can be chained with another entry. Score the chain, not the link. A local privilege escalation with a low score becomes urgent when the same KEV batch carries a remote foothold that leads to it, as the Linux kernel and PHP pairing shows.

Measure speed, not volume. Track the time from KEV listing to "we know where it is", and from there to "fixed in production". Current SBOMs for every image make the first step fast; see using SBOMs to find affected products fast.

Where Safeguard fits

Safeguard did not discover any of these vulnerabilities. The researchers and maintainers credited in each advisory did. What Safeguard does is shorten the time from a KEV alert to a fix in production for the software you build and ship.

SCA and SBOMs that track KEV. Safeguard's SCA builds a full transitive inventory across npm, PyPI, Maven and Gradle, Go, Cargo, NuGet, Composer and Bundler, plus container image layers. It generates SBOMs in SPDX and CycloneDX and scans on push, on a schedule or on release. Vulnerability matching draws on NVD, GHSA, OSV, CISA KEV and vendor bulletins, and enriches every match with EPSS and KEV status. When a runtime like PHP or a library like Brotli lands in KEV, the platform shows which projects and images contain the affected component and version, so the first question in the order of operations above has an answer before anyone starts grepping.

You can also scan from a terminal with the Safeguard CLI. safeguard scan builds an SBOM for a repository, a container image or an SBOM you already have, and matches it against vulnerability databases. Run safeguard scan --help for the options in your installed version.

Reachability. Safeguard's static reachability analysis traces whether your code can call the vulnerable function, and combines that with EPSS, KEV and asset context into one priority. For this window that is the difference between Brotli in a service that decodes untrusted request bodies and Brotli in a service that only compresses responses. How much it reorders your backlog depends on your codebase, so measure it on your own repositories during an evaluation.

Policies and gates. Policies turn your rules into findings, and gates enforce them in build, CI and release with block, warn or notify actions, and exceptions can require approval. A sensible gate for this window: block a release when an image carries a KEV-listed CVE on a reachable path, and warn where reachability is unproven. Policies can be written from plain English prompts.

DAST for the bug classes, in your own apps. Several entries in this window are classic bug classes: XXE in BroadWorks, trusting a forwarded-IP header as authentication in GPUStack, unrestricted file upload in Adobe Commerce, SQL injection in VeloCloud Orchestrator. Safeguard's DAST runs safe, scoped dynamic tests against targets you have verified you own. It is meant for your own web applications and APIs, where the same classes show up, not for testing a vendor's product. SAST looks at the code side of the same classes before deploy.

Autonomous remediation and Gold. When a fixed version exists, Griffin, Safeguard's security model, opens a policy-gated pull request and your own CI runs your tests on it. Gold Open Source at gold.safeguard.sh gives free CVE intelligence with affected and fixed versions. Both are described in full in the next section but one.

Vendor patches still come from the vendor. The appliance, browser and desktop entries, and kernels on hosts you do not build as images, are fixed by the vendor's or distribution's patch. Safeguard shows where an affected component sits inside the images and dependencies you build, so you know which of those patches touch your own releases.

To try it on your own repositories, download the CLI from https://safeguard.sh/download and follow the CLI documentation.

FAQ

How many vulnerabilities did CISA add to KEV between 20 October and 13 November 2026?

Thirty-three: six on 20 October, two each on 23, 26, 27, 28, 29 and 30 October, one each on 3, 4 and 6 November, four on 9 November, six on 10 November and two on 13 November (Check Point CVE-2026-123039 and UnrealIRCd CVE-2026-114713), which CISA added after this post first went live.

Which of the 31 should a software engineering team handle first?

The ones inside code you build. PHP CVE-2026-109618 and CVE-2026-109619, Brotli CVE-2026-111497, OpenSSH CVE-2026-123158 in Alpine images, GitLab CVE-2026-97229, GPUStack CVE-2026-102895, WordPress CVE-2026-119977 and the Linux kernel CVE-2026-46300. Rank them by whether the affected version is present and reachable in your services.

Is the "Operation Snowball" AI-agent campaign confirmed?

No. It is reported. The details come from one research firm, Malbear Labs, as relayed by The Hacker News on 11 November 2026. Cisco has confirmed active exploitation of CVE-2026-20320 and CISA listed it in KEV, but the attribution, the AI model and the victim counts are the researchers' claims.

Does a low EPSS score mean a KEV entry can wait?

No. EPSS forecasts exploitation activity, while KEV records exploitation that already happened. In this window GPUStack scored 0.005 and Cisco BroadWorks 0.008 while both were confirmed exploited. Use EPSS to rank vulnerabilities that are not on KEV, and use reachability and exposure to order the KEV entries.

Are all Linux systems affected by the OpenSSH SSHole flaw?

No. It needs sshd on Linux with musl libc and without PAM, password authentication on, an account with * as its password field and at least one local account with a $5$ or $6$ hash. Alpine Linux is the main example. glibc distributions using PAM, key-only setups and containers without sshd are not affected.

How do I know if Brotli CVE-2026-111497 affects my services?

Check every place Brotli lives: the C library (1.0.3 through 1.2.0 are affected), the PyPI brotli and brotlicffi packages, Node.js 22, 24 and 26, and .NET 8, 9 and 10 runtimes. Then check whether the service decodes Brotli data an attacker controls. Services that only compress output are lower priority but should still update.

Did Safeguard find any of these vulnerabilities?

No. Each was reported by the researchers and maintainers named in the vendor advisories. Safeguard helps after disclosure: tracking KEV and EPSS against your inventory, ranking by reachability, gating releases and opening fix pull requests.

Closing the gap between a published fix and production is mostly a process problem, and the same process works for the next KEV batch.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Griffin, Safeguard's security model, opens a policy gated pull request that moves the affected dependency to the safe version, and your own CI runs your tests on it before anyone merges. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Auto-merge is a separate switch and stays off by default, so your team decides what merges on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Safeguard Gold rebuilds patched versions of open-source packages and images from source, signs each build, attaches an SBOM, SLSA provenance and VEX, and serves them from registry.safeguard.sh to your organization. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Compensating controls for this KEV window

A compensating control removes the attacker's path to a bug, or limits what they get, until the patch lands. Each one below comes from the vendor advisory or follows from the root cause. Give each an expiry date so it does not become permanent.

If a component was exposed before its control went in, rotate the secrets it held and look for persistence.

Virtual patching at the edge

Virtual patching is a rule in a web application firewall, reverse proxy or API gateway that blocks the requests a known vulnerability needs. It works when the exploit has a visible network shape:

• Header spoofing (GPUStack). Drop or overwrite client-supplied identity headers such as X-GPUStack-Real-IP at the first proxy you control. The same rule protects any internal service that trusts X-Forwarded-For or X-Real-IP too much.
• Content encoding (Brotli). Reject Content-Encoding: br on request bodies at the edge for services that do not need it.
• XML entities (BroadWorks and your own XML endpoints). Reject request bodies that contain a DOCTYPE declaration on endpoints that never need one.
• Request size and shape (PHP). PHP itself recommends proxy limits on decoded size, field counts, multipart parts, header counts and nesting depth, including requests without a usable Content-Length.

Virtual patches can be bypassed with encodings the rule did not expect, do nothing for code paths that never cross the edge, and are easy to forget. Log each one next to its CVE and remove it once the real fix is in production.

Fork and patch for the libraries in this list

For open source libraries there is a third option between waiting and accepting the risk: apply the fix to your own copy and build from it. This window has three good examples.

• PHP 7.4, 8.0 and 8.1. PHP no longer supports these branches, but its security team published minimal source backports of both fixes for them. A team that builds PHP from source can apply those backports to its own branch and rebuild its images while it plans the move to a supported version.
• Ruby's Onigmo fixes. Ruby made an exception and shipped 3.3.13 with the fixes. If you run an older Ruby that you build yourself, the fixes are tied to public Ruby bug numbers (#13332, #19020, #16801), which makes the patch easy to find and review.
• Brotli. The fixed releases cover the 1.0, 1.1 and 1.2 lines. Projects that vendor Brotli source, such as native extensions and embedded firmware, can update the vendored copy to a fixed tag instead of waiting for a downstream package.

Fork and patch has costs. You own the fork until upstream catches up, and you need tests that prove the patch broke nothing, signed builds, and an SBOM plus VEX statement saying the component is patched so scanners do not flag it. Without those, a private fork is a new untracked risk. With them, it is the job Gold's fork and patch does for the packages it covers.

See how Safeguard would have helped

These demos show the product, not these incidents. Each is a flow you would use on the entries above.

The first demo shows the Safeguard CLI fixing a lodash CVE in a repository: it reads the finding and the advisory, asks before any command that changes something, edits package.json, runs the install and the tests, and prints a summary without pushing. For this KEV window, you would run the same flow against a service whose base image carries PHP 8.3.35 or Node.js with the old Brotli decoder and ask the assistant to bump the base image tag and rerun your tests.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. That is the setup you would use to scan the Alpine images you suspect still run sshd with password login, using the local runner CLI.

Click through it at your own pace, or open it full screen.

The third demo is a real desktop app session. The CLI session shows in the conversation list, you ask for work on your computer, pick the folder, then approve or deny each command and file edit, and it ends with the upgrade done and tests passing. For GitLab CVE-2026-97229 or the Ruby regex fixes, that is how you would ask for the Ruby version bump across a service and keep every change under your approval.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA Known Exploited Vulnerabilities catalog and KEV JSON feed, catalog version 2026.11.10, read 13 November 2026
• FIRST EPSS and the EPSS API, scores dated 12 November 2026
• GitLab patch release 19.4.2, 19.3.5, 19.2.8
• Ruby: regexp fixes for GitLab CVEs, 23 October 2026
• NVD CVE-2026-97229
• Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt
• The Hacker News: Cisco BroadWorks and Openwave flaws, Operation Snowball (Malbear Labs research), 11 November 2026
• GPUStack advisory GHSA-gj9m-f8ph-pmhr
• PHP news archive, 21 October 2026 security release
• PHP Foundation: today's PHP security release
• NVD CVE-2026-111497 and GHSA-9v8h-qqgm-4m35
• Google Brotli v1.2.1 release
• Node.js October 2026 security releases
• .NET announcement 494, Brotli decoder out-of-bounds write
• andybalholm/brotli v1.2.7 release
• NVD CVE-2026-119977
• WordPress 7.1.4 security release
• NVD CVE-2026-123158
• Alpine Linux: OpenSSH password authentication bypass, 5 November 2026
• OpenSSH release notes, 10.6p2
• GreyNoise SSHole event page, updated 13 November 2026
• SANS Internet Storm Center: scans for Sshole vulnerability
• The Hacker News: active exploitation of OpenSSH, GPUStack, FreeSWITCH and Aspera Faspex flaws
• Plex Media Server security update thread
• Collabora advisory GHSA-g3vx-3m76-fghh
• Adobe security bulletin APSB26-73
• FreeSWITCH advisory GHSA-mg63-h38w-8p9p
• Barracuda trust notice: pre-authentication authorization bypass and command injection
• Chrome stable channel update, 9 November 2026
• Microsoft advisory CVE-2026-124194
• Vendor advisories linked in the full table above for EG Secure Solutions, Siemens, Arista, Broadcom, the Linux kernel, Cisco ASA/FTD, Ivanti, Apple, SonicWall, IBM and Openwave

Last reviewed: 13 November 2026. This is a developing story, so check the linked advisories for the latest status.