Vulnerability Briefing 5 November 2026

Edition dated November 5, 2026 | Original narrative cutoff: 12:17 UTC

Today’s priorities: verify WordPress core updates, close exposed PAN-OS management interfaces and confirm that remediation covers both PHP and Brotli. Barracuda administrators should validate appliance patches rather than assume automatic deployment succeeded.

This briefing prioritizes observed exploitation, exposure and remediation consequences. The order is an editorial assessment, not a ranking by CVSS alone.

Publication verification, 6 November 2026: This is the complete 5 November edition, with its original scoring dates retained. The six published EPSS snapshots were rechecked against FIRST’s historical 4 November data. Barracuda corrected the authentication field for CVE-2026-116606 on 5 November at 14:30 EST (19:30 UTC): no authentication is required, but the administrative interface must be reachable. The corresponding overview below reflects that correction. Barracuda’s updated advisory.

CVE summary

Scores dated November 4, 2026 · retrieved November 5 at 14:48 UTC. EPSS is a 30-day exploitation probability, not an asset-specific risk score. Known exploitation remains a priority even when EPSS is low.

Quick reference

Use the article’s table of contents to jump to a CVE section. Each section contains an overview table, explanation and evidence of exploitation.

1. CVE-2026-119977 · WordPress core upgrade window RCE

2. CVE-2026-109618 · PHP out of memory corruption RCE

3. CVE-2026-109619 · PHP stale global state RCE

4. CVE-2026-111497 · Brotli decoder out of bounds write

5. CVE-2026-116606 · Barracuda ESG authorization bypass

6. CVE-2026-111560 · Barracuda command injection

7. CVE-2026-115560 · PHP session upload watchlist

Read the signals separately: red means observed exploitation; orange means patch priority without a confirmed exploitation claim in the reviewed advisory; gray marks the watchlist. EPSS links resolve to FIRST’s live API, so future values may differ from this dated snapshot. EPSS definition

CVE-2026-119977 WordPress core upgrade window RCE

Overview

Explanation

The flaw concerns predictable, web-accessible staging paths during full-package WordPress core upgrades. An unauthenticated attacker can execute code during that upgrade window. Wordfence lists affected releases across branches beginning with 4.7; the current 7.1 branch is affected through 7.1.3. Its record also reports blocked attack attempts, which should not be confused with confirmed successful compromises. Wordfence technical record and branch matrix

Action: Update the current branch to 7.1.4. WordPress released that security update on October 28 and recommends immediate installation. WordPress release notice

For older branches, verify the applicable backport rather than treating every version below 7.1.4 as vulnerable. Examples include 7.0.8, 6.9.11 and 6.8.12; the complete branch matrix is in the Wordfence record linked above.

Confirm the installed version after deployment and retain web and upgrade logs for incident review. A successful update is evidence of remediation, not proof that the host was never compromised.

Evidence of exploitation

Canada’s Cyber Centre confirms that CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on November 3. Treat it as an exploited vulnerability, not merely a public proof of concept. Canadian Centre for Cyber Security advisory

Wordfence reports blocked attack attempts. Those detections are not a count of successful compromises. Public proof-of-concept availability was not separately verified. Wordfence record

CVE-2026-109618 PHP out of memory corruption RCE

Overview

Explanation

PHP can leave request data partially initialized when an allocation fails, then process that invalid state during cleanup. The upstream advisory describes a remote-code-execution path in Apache mod_php before application code runs. PHP OOM advisory

Upstream PHP fixes are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Earlier releases in those respective branches are affected. The two issues involve out-of-memory cleanup corruption and stale request-owned state retained across requests. PHP OOM advisory, PHP stale-state advisory

Action: Patch web-serving PHP runtimes and verify distribution backports. The PHP project describes updating as the complete solution; configuration measures only reduce specific attack paths. PHP security announcement

For PAN-OS, remove public management access and use the vendor’s branch-specific upgrade matrix. Examples of fixed releases include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13. Other maintenance branches have their own fixes.

Patch-selection trap: PAN-OS 11.2.10-h16 fixes PHP but not Brotli. The vendor identifies 11.2.10-h17 as covering both. Check the actual target release against both advisories before closing the remediation ticket. Palo Alto Networks advisory and upgrade matrix

Evidence of exploitation

Unit 42’s October 29 update confirms active exploitation against internet-exposed PAN-OS management interfaces. It also reports independently validating attacker tooling associated with a chain combining PHP2Shell and a Linux kernel privilege-escalation vulnerability. Do not generalize that observation into a claim that every PHP deployment is being exploited. Unit 42 threat brief

CISA’s ADP entry records active exploitation in its October 21 SSVC assessment and a KEV addition on October 26. This is evidence of real-world exploitation, not simply proof-of-concept publication. Public PoC availability was not separately verified. CVE record with CISA ADP

CVE-2026-109619 PHP stale global state RCE

Overview

Explanation

Request-owned memory can be freed while worker-global state still refers to it. A later request can consume the stale state before initialization resets it, enabling remote code execution. PHP stale-state advisory

Use the fixed PHP versions and PAN-OS branch-specific hotfixes in the overview. Both PHP CVEs are addressed by the released PAN-OS fixes; restrict management access while remediating. PAN-OS guidance

Evidence of exploitation

Unit 42’s October 29 update attributes observed PAN-OS management attacks to the PHP2Shell vulnerabilities. That report discusses the pair, rather than establishing that every observed incident used this CVE independently. Unit 42 threat brief

For this CVE specifically, CISA’s ADP records active exploitation on October 21 and KEV addition on October 26. Public PoC availability was not separately verified. CVE record with CISA ADP

CVE-2026-111497 Brotli decoder out of bounds write

Overview

Explanation

In Node.js, attacker-controlled Brotli data passed to the bundled decoder can cause an out-of-bounds write, potentially producing a crash, memory disclosure or remote code execution. The October security release covers the 22.x, 24.x and 26.x lines, with fixed releases 22.23.4, 24.22.1 and 26.12.1. Node.js rates this issue High. Node.js October security release

Upstream Brotli 1.2.1 addresses the vulnerability. Google Brotli release

Action: Inventory embedded decoders, not just packages named “brotli.” Rebuild and redeploy affected images and bundled applications using vendor-supported fixes.

PHP’s Windows packages illustrate why version checks need care: updated builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 include Brotli 1.2.1, while the PHP runtime version itself remains unchanged. The exposed path involves cURL automatic response decompression when enabled. PHP Windows rebuild notice

Evidence of exploitation

CISA’s October 27 bulletin explicitly lists this Brotli vulnerability as a new KEV addition based on evidence of active exploitation. That establishes exploitation of the vulnerability, not exploitation of every product that embeds the library. CISA bulletin

CISA’s October 23 SSVC assessment records exploitation active, automatable no and technical impact total. Public PoC availability was not separately verified. Google CVE record and CISA ADP

CVE-2026-116606 Barracuda ESG authorization bypass

Overview

Explanation

Barracuda’s November 2 advisory describes an authorization bypass affecting Email Security Gateway and a command-injection issue affecting ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Combined on an affected product, the vulnerabilities could yield root access. Attackers need access to its administrative interface.

The advisory reports CVSS scores of 9.3 and 8.6, respectively; it does not specify the CVSS version in the displayed metadata.

Action: Restrict management interfaces to trusted networks and confirm installation of the applicable patch:

• ESG: BNSF-40425 for 9.4.017 and later, or BNSF-40430 below 9.4.017.

Evidence of exploitation

No confirmed exploitation evidence was established in the reviewed sources. Barracuda’s November 2 advisory describes the vulnerability, chain and patches, but does not report observed attacks. KEV and public PoC status remain unverified; this is not a claim that exploitation has never occurred. Barracuda advisory

CVE-2026-111560 Barracuda command injection

Overview

Explanation

This command-injection vulnerability extends beyond ESG to ADC, Message Archiver, WAF Control Center, WAF and WSG. Chaining it with the ESG authorization bypass can yield root access. Barracuda advisory

• ADC and WAF: BNADC-16586.

• Message Archiver: BNMA-32468.

• WAF Control Center: BNWF-60060.

• Web Security Gateway: BNYF-24789.

These are patch identifiers, not standalone fixed-firmware versions. Barracuda also recommends current firmware and manual application if automatic patching has not occurred. Barracuda security advisory

Evidence of exploitation

No confirmed exploitation evidence was established in the reviewed sources. Barracuda’s November 2 advisory provides remediation rather than a report of observed attacks. KEV and public PoC status remain unverified. Barracuda advisory

CVE-2026-115560 PHP session upload watchlist

Overview

Explanation

PHP’s October 23 notice identifies CVE-2026-115560 under an unusual combination of session serialization configuration and runtime changes. It recommends disabling session upload progress for the affected configuration pending the regular bugfix release. This is a watch item, not a claim of observed exploitation. PHP session-upload notice

Evidence of exploitation

No confirmed exploitation evidence was established in the reviewed sources. PHP’s October 23 notice describes an unusual configuration and mitigation, not an observed attack campaign. KEV and public PoC status remain unverified. PHP notice

Remediation checklist

1. Record the running build and patch state, not just the deployment job’s success.

2. Recheck management-interface exposure after appliance changes.

3. Confirm embedded dependencies in rebuilt and redeployed artifacts.

4. Keep compromise assessment separate from patch completion where exploitation is known.

5. Assign an owner and deadline to exceptions that remain exposed.

Scoring note: The individual tables include FIRST EPSS probabilities dated November 4, retrieved November 5, for all six main CVEs. The PHP watchlist CVE remains unverified because its EPSS retrieval failed; this does not establish that no score exists. CVSS values retain their named source and version where verified. The original narrative cutoff is 12:17 UTC; the tables were enriched after checks at 14:48–14:52 UTC. No item is classified as exploited solely because a proof of concept exists.