Skip to dossier
Archived issue·11-06-2026
View latest issue
←fruition.net
verified 1w ago
The Perimeter · Issue 11-06-2026

PHP and WordPress RCEs headline a patch-heavy week

Two application-layer stories dominate: PHP patched two critical unauthenticated RCEs now on CISA's KEV list, and WordPress 7.1.4 shipped fixes for 22 core vulnerabilities including an upgrade-window RCE that attackers are already probing. Both land at the engine and CMS layers Fruition operates daily, and both have confirmed in-the-wild activity or exploitation attempts. Around them: eMudhra intermediate CA keys are compromised and partially unpatched on the public internet, a batch of node-forge fixes includes a real basicConstraints bypass, and Drupal contrib published a wave of advisories including an OIDC account-takeover path. Kubeflow and sigstore-js advisories round out the infra and supply-chain picture. Teams should recalculate patch windows for PHP runtimes and WordPress core this week, verify which trust stores still carry eMudhra chains, and audit Drupal OIDC/OAuth module configurations before assuming email-verified SSO is safe.
Published
Friday, November 6, 2026
Entries
11
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
01

Web Application

frameworks · browsers · authentication flows

portswigger.net2w

PortSwigger: six of eight popular SVG sanitizers bypassed, plus header-based XSS in Firefox

PortSwigger research tested eight widely used SVG sanitizers and bypassed six, and demonstrates that a response header can execute JavaScript in Firefox even when the response body is harmless XML. The techniques are reproducible and apply to any application that renders user-supplied SVG or sets content headers over sanitized output.

Fruition take

If your platform accepts SVG uploads for media or avatars, re-test your sanitizer against these bypasses and review Content-Type and header handling on file-serving routes rather than trusting the sanitized body alone.

02

Supply Chain

packages · build systems · dependency attacks

github.com1wCVSS 7.4

node-forge 1.4.1 fixes batch including X.509 basicConstraints bypass and AES-GCM auth bypass

node-forge 1.4.1 ships fixes for roughly a dozen advisories published this week. The most consequential: certificates with a forged deprecated-OID basicConstraints extension (2.5.29.10/2.5.29.13) are accepted as CAs by verifyCertificateChain() (CVE-2026-119190, CVSS 7.4), and an unvalidated tagLength of 0 makes AES-GCM decryption succeed on any ciphertext (CVE-2026-119186). Other fixes cover TLS client crashes, PEM regex DoS, PKCS#12 MAC forgery via zero iteration counts, and prototype pollution in cookie handling.

CVE-2026-119190CVE-2026-119186node-forge
Fruition take

Bump node-forge to 1.4.1 wherever it appears transitively, especially in build or signing tooling that verifies certificate chains or parses PKCS#12 bundles.

github.com1wCVSS 7.4

@sigstore/oci leaks registry credentials to cross-host blob-upload Location

CVE-2026-118763 (CVSS 7.4): @sigstore/oci installs registry Authorization headers as defaults on its shared HTTP client and follows the blob-upload Location header to an arbitrary host, sending Basic or Bearer registry credentials to a cross-origin server controlled by the registry response. Confirmed against current sigstore-js HEAD.

CVE-2026-118763@sigstore/oci
Fruition take

If you sign or verify OCI artifacts in CI with sigstore-js, audit for this dependency and treat exposed registry tokens as compromised until rotated.

03

Infrastructure

kubernetes · cloud · network · ingress

github.com1wCVSS 7.5

Kubeflow Pipelines run-log endpoint serves pod logs without authorization

CVE-2026-118759 (CVSS 7.5): the Kubeflow Pipelines API server's run-log handler retrieves logs without checking the caller against the run, and accepts a supplied node ID as a pod name without verifying it belongs to the run. Anyone who can reach the backend and knows a run ID can read live or archived logs with the API server's permissions, potentially harvesting workload credentials. A companion advisory covers a decompression-bomb DoS that skips namespace authorization (CVE-2026-118761).

CVE-2026-118759Kubeflow Pipelines
Fruition take

If you run Kubeflow Pipelines multi-tenant, restrict network reachability to the API server now and patch when the fixed release lands; logs routinely carry tokens.

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

wordfence.com1w
▲ headline

WordPress 7.1.4 patches unauthenticated upgrade-window RCE; exploitation attempts observed

WordPress 7.1.4, released October 28, fixes 22 security vulnerabilities, the most serious being an unauthenticated race condition in the core update process that can lead to remote code execution. Wordfence reports threat actors are already attempting exploitation post-release. Site owners should verify their branch has the corresponding security release.

WordPress
Fruition take

Verify core is actually on 7.1.4 (or the branch backport) across every managed site today, and check that auto-update and maintenance windows are not leaving the upgrade endpoint exposed longer than necessary.

drupal.org2w

Drupal OpenID Connect Client allows takeover of unlinked accounts via email

SA-CONTRIB-2026-287 (CVE-2026-118554): the Drupal oidc module below 2.3.1 links a new OIDC login to any existing account with a matching email address, including admin accounts other than user 1. Exploitation requires a provider that does not verify user email addresses. Also in this week's wave: OAuth Login (CVE-2026-118572) allows logging in as any user whose email is known, and Single Content Sync (CVE-2026-118562) has a deserialization RCE requiring the import permission.

CVE-2026-118554Drupal oidcDrupal oauth_login_oauth2Drupal single_content_sync
Fruition take

Upgrade oidc to 2.3.1+, oauth_login_oauth2 to 3.1.1+, and single_content_sync to 1.4.19 this week, and confirm your identity provider enforces email verification before treating any email-linked SSO as trusted.

05

Identity & Auth

oauth · saml · iam · session attacks

unit42.paloaltonetworks.com2w

eMudhra intermediate CA keys compromised; Cloudflare finds only four sites fully patched

Unit 42 disclosed that eight eMudhra intermediate CA private keys are compromised, enabling unauthorized TLS signing and MITM interception. Cloudflare's follow-up found only four unpatched connections had been remediated across the exposed population and documented attempted exploitation, leaving much of the internet still trusting the affected chains.

eMudhra
Fruition take

Pin or block the affected eMudhra chains at your ingress and outbound TLS layers, then inventory anything that maintains its own trust store (JVMs, mobile apps, embedded clients) rather than relying on the OS store.

06

Threat Intel

active exploitation · breaches · ransomware

nvd.nist.gov2wKEV
▲ headline

PHP critical unauthenticated RCEs CVE-2026-109618 and CVE-2026-109619 added to CISA KEV

PHP contains a memory corruption flaw (CVE-2026-109618) and a stale internal request-state flaw (CVE-2026-109619), both enabling unauthenticated remote code execution. Both are now in CISA's Known Exploited Vulnerabilities catalog. Snyk also tracks a third issue, CVE-2026-115560, in the same request-lifecycle area. Fixed releases and vendor backports for older branches are available.

CVE-2026-109618CVE-2026-109619PHPPHP-FPMWordPressDrupal
Fruition take

This is a patch-the-runtime problem, not a patch-the-app problem: update PHP on every K8s image and shared host this week and restart the pods, since updating WordPress or Drupal does not update PHP. Confirm your base images actually rebuilt.

nvd.nist.gov2wKEV

GitLab unauthenticated RCE via crafted CI/CD regex added to CISA KEV

CVE-2026-97229: GitLab CE and EE contain an integer overflow that lets an unauthenticated attacker execute arbitrary code on the GitLab server via a specially crafted regular expression in CI/CD configuration. CISA added it to the KEV catalog with a required-action deadline under BOD 26-04.

CVE-2026-97229GitLab CEGitLab EE
Fruition take

Self-hosted GitLab instances need the vendor patch immediately; check runner-facing instances that accept pipelines from external contributors first.

nvd.nist.gov2wKEV

Adobe Commerce and Magento arbitrary file upload RCE added to CISA KEV

CVE-2026-48356: Adobe Commerce and Magento contain an unrestricted upload of dangerous file types that permits arbitrary code execution in the current user's context, potentially escalating to account or session control. CISA added it to the KEV catalog, indicating confirmed exploitation.

CVE-2026-48356Adobe CommerceMagento
Fruition take

Any Commerce/Magento estate in your fleet needs the vendor patch now, with a log review for unexpected file writes in web-accessible directories.