CSIRT-CAN – Centro de Respuesta a Incidentes de Seguridad de Canarias

Alerta

Weekly Cybersecurity Vulnerability and Threat Roundup

Cybersecurity vulnerabilities and threats continue to evolve. Staying informed helps organizations identify risks, prioritize remediation efforts, and strengthen the protection of applications, infrastructure, and corporate data.

This roundup highlights six security topics affecting PHP, GitLab, Cisco Secure Email Gateway, Atlassian, Apache HTTP Server, and WhatsApp. Each section summarizes the main risks, recommended actions, and official sources for further information.

1. PHP - Remote Code Execution Vulnerabilities

Reported severity: CVSS 9.2

Vulnerabilities CVE-2026-109618 and CVE-2026-109619 could allow unauthenticated attackers to execute code remotely on affected systems. An additional vulnerability, CVE-2026-115560, has also been reported. It relates to a specific combination of application code and configuration settings.

Recommended actions

  • Upgrade to the fixed PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the branch in use.
  • Migrate PHP 8.1 and earlier installations to a supported branch.
  • For CVE-2026-115560, apply the temporary mitigation recommended by PHP by setting session.upload_progress.enabled=0. Check whether the application uses the affected configuration and code combination.

Official sources

2. GitLab - Critical Remote Code Execution Vulnerability

Reported severity: CVSS 10.0

Vulnerability CVE-2026-110264 could allow an unauthenticated attacker to execute arbitrary code on an affected GitLab server.

Recommended actions

  • Upgrade GitLab Community Edition and Enterprise Edition to the fixed versions specified by the vendor.
  • Prioritize instances accessible from the Internet.
  • Review system logs and investigate potential indicators of compromise.

Official sources

3. Cisco Secure Email Gateway - Critical Vulnerability

Reported severity: CVSS 9.8

Vulnerability CVE-2026-76519 could allow an unauthenticated remote attacker to write arbitrary files and execute commands with root privileges on affected devices that meet specific configuration requirements.

These conditions include having the AMP File Reputation service enabled and using a vulnerable version of Content Scanner Tools.

Recommended actions

  • Upgrade Cisco AsyncOS to a compatible fixed version.
  • For the 15.5 branch, apply version 15.5.5-014; for the 16.5 branch, apply version 16.5.0-780, as applicable.
  • For the 16.0 branch, follow Cisco's migration instructions to move to a fixed version.
  • Ensure that Content Scanner Tools is running version 25.3.0.5525 or later.
  • Check for potential indicators of compromise and follow the vendor's guidance.

Official sources

4. Atlassian - Vulnerabilities in Third-Party Components

Atlassian's 20 October 2026 security bulletin covers vulnerabilities in third-party components used by products such as Confluence, Jira, Bitbucket, Bamboo, and Crowd.

The bulletin lists 162 high-severity and 14 critical-severity vulnerabilities in these components. Atlassian notes that the actual risk may vary depending on how the components are used within its products. Organizations should therefore assess the applicability of each advisory before determining their exposure.

Recommended actions

  • Identify deployed products and versions.
  • Consult the fixed versions specified for each affected product.
  • Assess exposure and the criticality of affected systems.
  • Apply the updates recommended by the vendor.

Official source

5. Apache HTTP Server - Security Update

Apache HTTP Server version 2.4.69, released on 1 October 2026, addresses 20 security vulnerabilities. Some flaws could lead to denial of service and, under certain conditions, remote code execution.

Recommended actions

  • Upgrade to Apache HTTP Server 2.4.69 or install the patched package supplied by the operating system vendor.
  • Verify the installed version and enabled modules.
  • Check the specific recommendations for the operating system distribution in use.

Official source

6. WhatsApp — Fraud and Account Takeover

INCIBE has warned about campaigns using fake dance competitions to deceive users and gain access to their WhatsApp accounts. It has also reported cases involving outdated WhatsApp accounts on iPhones being used to request money from victims' contacts.

Recommended actions

  • Be cautious of unexpected links, voting requests, and messages.
  • Never share verification codes with third parties.
  • Keep WhatsApp and the operating system up to date.
  • Review linked devices and log out any unrecognized sessions.
  • Notify contacts if suspicious activity is detected on an account.

Official sources

Key Security Recommendations

Security teams should consider the following measures to reduce exposure to the threats described above:

  1. Maintain an up-to-date asset inventory, including applications and deployed versions.
  2. Prioritize risks according to severity, Internet exposure, and asset criticality.
  3. Apply security patches and mitigations in line with vendor guidance.
  4. Review logs and indicators of compromise when exploitation is a concern.
  5. Verify and document remediation, ensuring that corrective measures have been applied successfully.

Effective vulnerability management does not end with installing a patch. It also requires assessing exposure, validating remediation, and detecting potential security incidents.

Conclusion

Keeping systems up to date, applying preventive measures, and continuously monitoring assets are essential to improving resilience against evolving cyber threats.

Does your organization have a defined process for identifying, prioritizing, and remediating security vulnerabilities?

Regular asset reviews and clearly assigned responsibilities help organizations manage cybersecurity risks more effectively.

Note: Consult the linked official advisories to confirm affected versions, available fixes, and applicability to your environment before implementing changes in production.