Patch reference
| Severity | What | Fix |
|---|---|---|
| High | Symfony, 21 advisories, 4 Nov | symfony/* 8.1.11 7.4.23 6.4.50 5.4.56 |
| High | Next.js, 7 advisories, 3 Nov | next 16.4.5 15.5.29 |
| High | WordPress upgrade-window RCE, KEV 3 Nov carried over | WordPress 7.1.4, backports to 4.7.39 |
| Not rated | Apple CVE-2024-27834, KEV 4 Nov | Fixed May 2024: Safari 17.5, macOS 14.5, iOS 17.5 16.7.8 |
| Not rated | SonicWall CVE-2026-19868, KEV 6 Nov | Follow SonicWall's SNWLID-2026-0014 |
| Medium | nginx, 5 advisories, 14 Oct | nginx 1.30.6 1.31.7 or later |
| Critical | GitLab CI regex RCE, KEV 29 Oct carried over | GitLab 19.5.3 19.4.5 19.3.7 19.2.1019.1.10 19.0.11 18.11.14Runner 19.5.3 19.4.4 19.3.6 |
| High | Linux kernel CVE-2026-46300, KEV 28 Oct carried over | Your distribution's kernel |
What happened this week
Symfony fixes 21 issues in one batch
Symfony published 21 advisories with 5.4.56, 6.4.50, 7.4.23 and 8.1.11. The high ones: the YAML parser can spend seconds on a 93-byte document (CVSS v4 8.7), the X509 authenticator can read the wrong user from a client certificate (CVE-2026-118513, CVSS v4 7.7), two Serializer bugs let a request read server files (CVE-2026-118515 and a DATA: scheme bug), and Filesystem\Path lets crafted paths escape their base directory.
Two weaken access rules. Since 6.4.29, /index.phpadmin is routed as /admin, so an nginx or CDN rule on /admin can be bypassed; Symfony's own access_control is not affected by this one. And HEAD requests skip access_control rules limited to GET (CVE-2026-118514).
Do thisrun composer update "symfony/*" and confirm the versions above. 6.4.49 and 7.4.22 from W44 are not enough. Two components have no fix on older lines because they do not exist there: HtmlSanitizer starts at 6.1 and JsonPath at 7.3, so on 5.4 neither applies, and their fixes start at 6.4.50 and 7.4.23.
Sources Symfony advisories · Symfony 8.1.11 · GHSA-hwfg-qwvh-2wfx · GHSA-3h27-hjv7-fqjx · Packagist
Next.js 16.4.5 and 15.5.29 fix seven issues
The release announced last week fixes cache bugs in Cache Components and use cache that can serve one tenant's or user's data to another, a response-framing bug in self-hosted apps that return a fetched Response unchanged, a cookie leak through an internal header on Edge routes, and an SVG check bypass in image optimisation. Next.js rates the unstable_cache and use cache mix-up high; GitHub's database lists it as medium.
Do thisupdate to next@16.4.5 or next@15.5.29.
Sources Next.js · GitHub advisories · npm
Carried over: WordPress upgrade-window RCE now exploited
CISA added CVE-2026-119977 to its exploited list on 3 Nov and marked it for forensic triage, not just patching. The fix is unchanged: 7.1.4, with backports from 7.0.8 down to 4.7.39, all from 28 Oct.
Do thisconfirm wp core version. If a site was still on 7.1.3 or older, check it for files you did not deploy.
Sources CISA KEV · WordPress · Release archive · Wordfence
A 2024 Apple WebKit bug is now on KEV
Not rated · KEV 4 Nov · CVE-2024-27834
CISA listed a WebKit bug that lets an attacker who can already read and write memory bypass Pointer Authentication. Apple fixed it in May 2024 in Safari 17.5, macOS Sonoma 14.5, iOS and iPadOS 17.5 and 16.7.8, and the matching tvOS and watchOS releases.
Do thisnothing if your Apple devices take updates. Check any Mac or iPhone that has been pinned to an older release.
Sources CISA KEV · Apple, Safari 17.5 · Apple, macOS 14.5 · Apple, iOS 17.5
SonicWall SSLVPN SAML bypass on KEV
Not rated · KEV 6 Nov · CVE-2026-19868
CISA added a SonicOS SSLVPN bug on 6 Nov that lets a user with valid credentials for another sign-in method bypass SAML, including SAML-enforced MFA; follow SonicWall's SNWLID-2026-0014 for affected versions and what to do.
Sources CISA KEV · SonicWall SNWLID-2026-0014
nginx: no new fix this week, check for October's
nginx has released nothing for security since 14 Oct, when 1.30.6 and 1.31.7 fixed five medium bugs, among them buffer overflows with alias plus rewrite and in string expressions, and HTTP/3 request body injection. 1.31.8 on 21 Oct carries no security fixes. The official nginx:alpine image is on 1.31.8 and stable-alpine on 1.30.6.
Do thisrun nginx -v. Anything older than 1.30.6 or 1.31.7 needs an update; rebuild images that use a floating tag so they pick it up. If nginx guards a PHP app's /admin, also apply the Symfony fix above.
Sources nginx advisories · nginx news · nginx CHANGES · Docker Hub
GitLab: no new patch since 29 Oct
GitLab's patch release feed has nothing after 29 Oct as of 8 Nov, so 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14 are still the versions to be on. The exploited CI regex RCE, CVE-2026-97229, makes them urgent. GitLab Runner 19.5.3, 19.4.4 and 19.3.6 followed this week, with base images rebuilt to fix Brotli, xz-libs and docker-machine CVEs.
Do thisbesides GitLab itself, update self-hosted GitLab Runner to 19.5.3, or 19.4.4 or 19.3.6 on the 19.4 and 19.3 lines, and self-hosted AI Gateway to the 29 Oct version for your line (19.5.3 down to 18.11.8). Upgrading GitLab updates neither.
Sources GitLab 19.5.3 · GitLab patch feed · CISA KEV · Runner 19.5.3 changelog
Other carried-over items
- Linux CVE-2026-46300 (KEV 28 Oct) is fixed in your distribution's kernel; Amazon Linux 2023 fixed it on 15 May in ALAS2023-2026-1710. Reboot after updating.
- GitHub's advisory for the Symfony Mime fix, CVE-2026-45070, still lists the May versions. Go by Symfony's post from W44.
- GitHub's advisory for Laravel's TokenGuard bypass, CVE-2026-114509, still lists only 12.68.0 and 13.29.0.
- php.net has posted no new security release this week; W43's versions stand.
Sources Amazon Linux · GHSA-vqc8-7275-q272 · GHSA-f9x3-7vq9-cph6 · php.net
Next week: Node.js on 11 Nov
Node.js will release 26.x, 24.x and 22.x on or shortly after Wednesday 11 Nov; the most severe issue is rated high. Details arrive with the release.
Sources Node.js
Supply chain advice for CLI agent users
- Give a database MCP server a read-only account; its own read-only switch is a SQL parser, and parsers miss things.
- Update the MCP reference servers you run; git, fetch and filesystem all had fixes in late October.
- Rebuild images after a base update; a floating tag does not change a running container.
Agent tooling to check (4)
| When | Item | Check |
|---|---|---|
| 2 Nov | DBHub read-only bypass on MySQL and MariaDB | 0.22.6 or later |
| 28 Oct | mcp-server-git repository confinement |
2026.10.28 or later |
| 25 Oct | mcp-server-fetch private-address guard |
2026.10.24 or later |
| 25 Oct | server-filesystem symlink and TOCTOU fixes |
2.0.1 or later |
The DBHub fix shipped in June; the advisory only appeared on 2 Nov. GitHub also published 361 malware advisories from 2 to 8 Nov: 325 npm, 31 PyPI and 5 RubyGems. Browse them.
One-minute self-check
# Compare each version with the patch table above
$ composer show "symfony/*"
$ npm ls next
$ wp core version
$ nginx -v
$ sudo gitlab-rake gitlab:env:info
$ uname -r
Additions to W44
- GitLab AI Gateway: W44 named only Runner, but GitLab's 29 Oct release also requires self-hosted AI Gateway to move to 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3 or 19.5.3. GitLab 19.5.3
- MCP reference servers: W44's agent table missed six advisories from 25 to 28 Oct. Three are in this week's table; the others are a
mcp-server-fetchNAT64 guard gap (fixed in 2026.10.24), aserver-filesystemTOCTOU and an environment variable leak inserver-everything(both fixed in 2.0.1). MCP servers advisories - WordPress backports: W44 listed six, but every branch from 7.0 down to 4.7 got one on 28 Oct, 24 in all. Release archive
- Next.js severity: W44 quoted the preview's "seven medium"; the release rates one of them high and six medium. Next.js