Late October roundup: notable vulnerabilities and personal data leaks

Security NEXT's headlines reported that multiple vulnerabilities were found in Cisco Systems' video-conferencing product line, the Cisco Expressway series, and that a fixed release was published because some of the flaws include the ability to execute arbitrary commands without authentication. At the same time, serious vulnerabilities were discovered in GitLab and PHP; in particular, PHP planned to release a fixed version on October 21 and users were urged to prepare for early updates.

Oracle published its quarterly "Critical Patch Update (CPU)" on October 20, 2026, providing a large update that includes a total of 1,295 fixes. With such large-scale patch releases from vendors, administrators are in a position where rapid application of high-priority fixes is required.

In the new articles list, reports include many vulnerabilities in HPE's wireless LAN OS with 33 issues rated critical, concerns about RCE related to Brotli compression handling in Node.js, vulnerabilities affecting Snort 3 and Cisco products, and continued reports of personal data leaks and unauthorized access involving domestic companies and government agencies. These matters require both vendor-side fixes and prompt action by users.

The set of articles simultaneously covers multiple topics such as vulnerability disclosure and remediation, observations of exploitation, and reports of personal information leaks, indicating the importance of ongoing security measures and verification of incident response capabilities. It is recommended to apply updates starting with those of highest urgency based on vendor advisories and public agency warnings.