CISA KEV catalog version 2026.10.30; Palo Alto Networks advisory updated October 30, 2026; roundup updated November 1, 2026
KEV Deadlines Land Today: Cisco ASA and GitLab Fixes Due November 1, With PAN-OS PHP Exploitation Confirmed
Two federal remediation deadlines in CISA Known Exploited Vulnerabilities catalog fall today, November 1. CVE-2026-76418, scored 8.6, is an unchecked return value and NULL pointer dereference flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software: where secondary authentication is configured on a tunnel group, an unauthenticated remote attacker can force the device to reload, dropping every remote access VPN session. Cisco published its advisory on October 28, said it became aware of active exploitation in October, and states there are no workarounds. CVE-2026-97229, scored 10.0, is an integer overflow in self-managed GitLab CE and EE that lets an unauthenticated user execute arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration; it affects versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, and GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8. GitLab.com and GitLab Dedicated are already patched. CISA also notes that other products can potentially be affected by the same underlying Ruby and Onigmo integer overflow issue. The same catalog round, updated November 1, adds a vendor confirmation on the PHP2Shell flaws: Palo Alto Networks, in an advisory updated October 30, rates CVE-2026-109618 severity 9.2 with exploit maturity listed as attacked, and states that active exploitation has been observed targeting the PAN-OS and Panorama management interface exposed to the internet, with fixed hotfixes listed for every supported branch. The next KEV deadlines are the Ivanti Connect Secure pair, due November 2 and November 13.
Executives
A deadline that falls on a Sunday is still a deadline, and both products due today sit on the network edge: the VPN concentrator staff connect through, and the code platform that holds source and build credentials. The Palo Alto confirmation in the same round carries the wider lesson: management interfaces exposed to the internet are being actively attacked through a flaw in a bundled component, not the headline product. Ask for a one-line status on each of the three product families today, not at the next monthly review.
CIO / CISO
Close the two due items first: upgrade self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8 or later and review CI/CD configuration changes from untrusted contributors, and apply the Cisco fixed release for your ASA or FTD train, checking exposure by configuration, since a device is in scope when the SSL VPN login service is reachable and any tunnel group, including the default group, uses secondary authentication. Then work the PAN-OS item: restrict the management interface to a jump host, install the hotfix for your branch, noting that on 11.2.10 the h17 hotfix, not h16, carries both the PHP and Brotli fixes, and treat any device whose management interface was internet-reachable as possibly compromised.
Engineers
Use the read-only checks before you patch: on ASA, show version and the webvpn and tunnel-group configuration to confirm secondary authentication; on GitLab, the Admin Area dashboard or gitlab-rake gitlab:env:info gives the running version; on PAN-OS, show system info and check the management interface permitted IP list. Watch ASA crashinfo for unexpected reloads, each one is a full VPN session drop and, in this context, a possible exploitation signal rather than a hardware fault.
Everyone (non-IT)
If your work VPN drops or your code platform goes into maintenance this weekend, this deadline round is the likely reason. The fixes close flaws that are already being exploited, so a short planned outage today is preferable to an unplanned one later. Reconnect through your normal channels once your IT team confirms the work is done.