Saturday, 24 October 2026

Ruby released 4.0.9, 3.4.12 and 3.3.13 on 2026-10-23 with fixes for the regular-expression engine bugs behind four GitLab flaws, this one included; any Ruby application that compiles attacker-controlled patterns is exposed to them, and Ruby has requested no CVE identifiers of its own.

The Ruby project published an advisory on 2026-10-23 and released Ruby 4.0.9, 3.4.12 and 3.3.13 with fixes for the bugs in its Onigmo regular-expression engine behind four GitLab flaws: CVE-2026-89078 (a double free when parsing a pattern fails after an alternation), CVE-2026-93577 and CVE-2026-97229 (an integer overflow in the size of a compiled pattern) and CVE-2026-110264 (an overflow of internal IDs in a pattern with many repeats) (Ruby, 2026-10-23). Ruby's table gives the first release of each series that carries each fix: the fix for CVE-2026-110264 first appears in 4.0.9, so 4.0.8 is not enough, and 3.4.12 and 3.3.13 carry all of them; GitLab fixed its own servers by patching the Ruby it ships (Ruby, 2026-10-23).

The advisory widens the exposure beyond GitLab to any Ruby application that compiles a regular expression from a string an attacker controls, says Regexp.timeout does not protect against these bugs and that limiting pattern length does not reliably protect, and says Ruby has not requested CVE identifiers of its own and that operators should track the issues under GitLab's identifiers (Ruby, 2026-10-23).

TeamUpdraft says the attacker entered its site with a compromised key and suspects AI-accelerated tooling, and asks users to check the sites listed in their UpdraftCentral account; Nethemba saw the stolen keys used again on 2026-10-21 after 1.26.13 shipped and reads UpdraftPlus Premium as leaving the account password stored in the site database and backups.

TeamUpdraft's updates of 2026-10-21 and 2026-10-22 say the attacker used a compromised key to access its site, that there is no evidence the attacker still has access, and that the speed of the exploits and the initially faulty backdoor plugins suggest AI was used to accelerate the attack, which is the vendor's inference and comes with no evidence (TeamUpdraft, 2026-10-19). It asks users to look at the sites listed under their UpdraftCentral account for any they did not knowingly connect since 2026-10-19, says it is seeing a pattern of unexpected Editor roles, and stresses that UpdraftPlus Premium users should check for unexpected plugins and new administrators even if they never used UpdraftCentral (TeamUpdraft, 2026-10-19).

Nethemba reports that the attacker kept going after the fix: on 2026-10-20 it tried the secret triggers of already removed backdoors on at least six sites of four administrators, and on the morning of 2026-10-21 it sent UpdraftCentral commands to two of Nethemba's sites after 1.26.13 had been released, blocked by Nethemba's own blocking plugin, with the keys no longer existing (Nethemba, 2026-10-19). A site that has a stolen key and neither updated nor deleted it by hand therefore stays exposed, and a removed backdoor is still probed. Nethemba also reads the code of UpdraftPlus Premium as storing the teamupdraft.com account password in the site database as entered and deleting it only after add-ons are claimed with a token, so it can stay in the database and in backups; a reader found it on all three of their premium sites and in backups going back to 2022, and Nethemba on one of its three, while the vendor says it is removed after the first connection and Nethemba has not found the samples it analysed reading it (Nethemba, 2026-10-19).

The Ticino cantonal fund IPCT says in a letter of 2026-10-23 that data of about 1,800 of its insured persons (about 1,700 who left in 2024 and 2025, with exit-benefit amounts and IBANs, and about 80 on disability pensions) sat on the attacked supplier server for two ongoing projects; it has no certain evidence the data were taken but finds it plausible, and it writes to all insured because it cannot exclude more.

The Ticino cantonal pension fund IPCT has put numbers on its exposure in a letter of 2026-10-23 to its roughly 17,000 active insured and 10,000 pensioners (IPCT, 2026-10-23). PK Softech told it in the late afternoon of 2026-10-14 that the authorities had established that personal data were taken from the supplier's servers, without saying which funds the data belonged to, and the fund's checks to date found among the documents on the attacked server data of about 1,800 persons, held there for two ongoing projects of spot checks and recalculations (IPCT, 2026-10-23). About 1,700 are persons who left the fund through resignation or death in 2024 and 2025: surname, first name, postal address, date of birth, AHV number and insured number, the exit-benefit amount and the receiving fund with its bank account (IBAN), and the personal IBAN for about 50 who were paid out directly, with no e-mail address or telephone number (IPCT, 2026-10-23). About 80 are insured persons on a disability pension whose passive pension data was being updated: name, date of birth, AHV number, insured number, passive insured salary, passive retirement assets, degree and start of invalidity, with no contact data (IPCT, 2026-10-23).

The fund says it has no certain evidence that these data were taken but that it appears plausible, that savings capital and pensions of all insured are untouched, that the cantonal administration's IT centre hosting the fund's infrastructure was not breached, and that it filed a criminal complaint against unknown persons and was recognised as private plaintiff, while the Federal Prosecutor's Office and the federal police investigate (IPCT, 2026-10-23; Ticinonline, 2026-10-23). It decided to send the letter to all insured because its information is partial, the analyses are still evolving and it may never have certainty, and it asks them to watch for unexpected e-mails, calls and messages over the coming weeks and never to disclose passwords, access data or personal data unless sure of the requester (IPCT, 2026-10-23). The letter names PK Softech's other customers as Publica, large cantonal public funds such as Bern and Zurich and company funds such as Migros and Post, for hundreds of thousands of insured persons in total (IPCT, 2026-10-23).

The maintainers' root-cause post of 2026-10-23 replaces the earlier log-leak hypothesis: a master key committed to a public repository on 2026-05-27 and never revoked gave the attacker an organization owner's GitHub CLI token on 2026-10-10, eleven days before the release, and Socket independently found secret-stealing workflows running that day.

The maintainers published a root-cause post on 2026-10-23 that supersedes the earlier hypothesis that the tokens were read from the logs of an internet-exposed internal deployment: their request logs show the first token came from a different service, an experimental agent platform whose master key had been committed to a public repository on 2026-05-27 and never revoked (LiteLLM, 2026-10-23). The attacker used the key on 2026-10-10 to obtain an organization owner's GitHub CLI token, so access began eleven days before the release, and the same day throwaway branches in two repositories ran workflows that posted CI secrets to an external capture endpoint and were deleted minutes later, yielding the tokens of two further maintainers (LiteLLM, 2026-10-23).

Socket found the same activity independently from the repository's Actions performance metrics, including a second run on 2026-10-12 that took 14 further secrets, and says it has not established how the attacker first obtained access (Socket, 2026-10-23). On 2026-10-21 three credentials did different jobs: the owner's token overrode branch protection and later force-pushed the history clean, a second maintainer's token approved the production gate and a third maintainer's token deleted the run records, after the maintainers had relaxed the release rule earlier that week so that any two engineers could trigger and approve a release (LiteLLM, 2026-10-23). The maintainers say they are revoking every token tied to every internal system and vendor platform, and that the attacker's activity on other systems focused on upstream inference API tokens (LiteLLM, 2026-10-23).

Palo Alto Networks' advisory now lists the WildFire appliances WF-500 and WF-500-B as unaffected, a correction its timeline dates 2026-10-23, has no separate Panorama row while a note keeps Panorama in scope, and extends the Threat Prevention coverage; the PAN-OS hotfix dates of 2026-10-26 to 2026-10-30 and the exploitation statement are unchanged.

Palo Alto Networks' advisory now lists the WildFire appliances WF-500 and WF-500-B, which an earlier revision of 2026-10-23 had listed as affected, as unaffected, a correction its timeline dates 2026-10-23, and the table no longer distinguishes Panorama while a note says the issue applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series) and the mitigation text covers PAN-OS and Panorama together (Palo Alto Networks, 2026-10-24). The estimated hotfix dates for PAN-OS, 2026-10-26 to 2026-10-30, the CVSS-B scores of 8.7 and 7.1, and the statement that Palo Alto Networks is not aware of malicious exploitation against its products are unchanged; on 2026-10-24 the advisory added updated threat-signature and content-version details, and the Threat Prevention coverage now lists twenty further Threat IDs, from 97643 to 97678 (Palo Alto Networks, 2026-10-24).

Unit 42 reports a confirmed intrusion of a European government entity with agentic post-exploitation, from its own telemetry and without naming the victim or the flaw that gave the foothold, while CrowdStrike, Sophos and Wordfence report no successful exploitation; PHP adds an informational advisory for a third code-execution path, CVE-2026-115560, that the October releases do not fix, and advises session.upload_progress.enabled=0 until its next regular release. VulnCheck's exploit now covers PHP 8.5.10 and 8.5.11 as well as 8.4.10 to 8.4.26, and Cisco, Splunk and Palo Alto Networks revised their product statuses.

Palo Alto Networks' Unit 42 updated its brief on 2026-10-23 to report a confirmed intrusion: attackers using agentic AI attack platforms for post-exploitation against a government entity in Europe reached password hashes and multi-factor authentication secrets within two hours of the initial exploitation, set up an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation (Unit 42, 2026-10-23). Unit 42 reads the markers as those of an agentic attacker: each command batch is wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, the tasks are short and serially spaced, and the attacker pivots quickly after failures (Unit 42, 2026-10-23). The account rests on Unit 42's own telemetry; it names no victim and does not say which flaw gave the foothold (Unit 42, 2026-10-23).

It sits against reports of no successful exploitation. CrowdStrike has not observed any in the wild or in its honeypots and expects a reliable exploit only against a specific deployment profile, such as a fixed Docker image (CrowdStrike, 2026-10-23); Wordfence knows of no compromise among the more than 74,000 attempts its firewall intercepted (Wordfence, 2026-10-22); and Sophos corrected on 2026-10-22 its earlier report of successful exploitation to scanning and a small number of failed attempts, one of them a blocked attempt to deliver a likely Mirai-derived botnet variant (Sophos, 2026-10-22). VulnCheck's exploit now covers PHP 8.4.10 to 8.4.26 and 8.5.10 and 8.5.11 on AMD64 and ARM64 with default settings and display_errors off under mod_php, and WordPress on default Docker installs, as of 5:30 PM ET on 2026-10-23 (VulnCheck, 2026-10-21). Neither flaw is in CISA's KEV catalog as of version 2026.10.23 (CISA KEV, 2026-10-23).

PHP posted an informational advisory on 2026-10-23 for a third code-execution path, CVE-2026-115560, that the October releases do not fix: it needs an application that sets session.serialize_handler to php_binary or php_serialize, switches it to php with ini_set() before session_start(), and leaves session upload progress enabled (PHP, 2026-10-23). PHP calls it an unlikely vector, issues no emergency release, suggests session.upload_progress.enabled=0 until the next regular bugfix release, says a host that applied that setting from the 2026-10-21 advisory should keep it, and will publish the full advisory with the next release (PHP, 2026-10-23). PHP has not stated affected versions or a severity score, and no exploitation is reported (The Hacker News, 2026-10-23).

Vendor statuses moved. Cisco's advisory, revised on 2026-10-23, now describes a workaround for Expressway in its bug record, keeps the fixed release 15.5.21 undated, lists Ultra-Reliable Wireless Backhaul with a fix in 27.1.1 (February 2027), exploitable there only by an authenticated administrator and with a workaround described, and lists Duo Access Gateway with fixed release 3.2.0 (Cisco PSIRT, 2026-10-23). Splunk now lists only Smartlook as under investigation (Splunk, 2026-10-23). Palo Alto Networks' advisory now lists WF-500 and WF-500-B as unaffected, a correction its timeline dates 2026-10-23, its table no longer distinguishes Panorama, and a note says the issue applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama; the PAN-OS hotfix dates of 2026-10-26 to 2026-10-30 are unchanged (Palo Alto Networks, 2026-10-24).