Emergency patches race to fix critical flaws in PHP, GitLab, Oracle, Splunk

A three-month wave of emergency patches

The patch wave reached PHP on October 21. The PHP security team scheduled an emergency release for 14:00 UTC that day to fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The advance warning came after details of the embargoed flaws leaked online on October 20, according to SOC Prime and Clarín.

GitLab started the sequence on August 17 with a critical patch outside its normal twice-monthly schedule. The company fixed CVE-2026-19478, a CVSS 9.4 GraphQL flaw that under certain conditions allowed an unauthenticated attacker to change or remove public projects and user data. GitLab said GitLab.com and GitLab Dedicated were already running the patched version; only self-managed installations needed to upgrade to versions 19.2.4, 19.1.6, 19.0.8, or 18.11.11. The advisory disclosed no exploitation.

Oracle followed on August 18 with 943 patches across its portfolio. The most urgent fixes covered WebLogic Server core flaws CVE-2026-60696, CVE-2026-60672, and CVE-2026-60698, each scored 9.8 and exploitable over IIOP or T3 without authentication. Another flaw, CVE-2026-60702, rated 9.9, required a low-privileged authenticated user. Oracle urged customers to install the patches promptly and noted that attackers have taken advantage of unpatched known vulnerabilities in the past.

On Thursday, September 10, GitLab returned with another maximum severity issue. CVE-2026-85706, a path traversal flaw in the repository commits API, could let unauthenticated attackers read arbitrary data such as credentials and secrets. The company urged immediate upgrades to 19.3.2, 19.2.6, or 19.1. BleepingComputer reported that the next day watchTowr said its intelligence group had begun seeing in-the-wild probes for the path traversal bug. watchTowr advised defenders to look for POST requests to the project commits API where file.path appears in the parameters. GitLab also patched CVE-2026-87719, an insecure deserialization flaw in GraphQL subscription serializer affecting GitLab EE.

Splunk's turn came on October 13. Belgium's Centre for Cybersecurity Belgium warned about CVE-2026-76268, a critical authentication bypass in Splunk Enterprise search head clusters. The flaw scored 9.8 and could let unauthenticated remote attackers run arbitrary commands through the Patroni API for the PostgreSQL sidecar. A separate high-severity privilege escalation, CVE-2026-76266, affected native Linux packaging. Splunk fixed the issues in versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and CCB recommended patching with the highest priority after thorough testing.

How teams set priorities

The PHP emergency highlights how defenders sort the wave. The PHP security team had initially planned a Thursday release but moved it forward after the leak. SOC Prime reported that watchTowr confirmed the flaws were real and believed it had reproduced one, but no public exploit code or active exploitation was observed as of October 21. The vulnerabilities were not in CISA's Known Exploited Vulnerabilities catalog at that time. Clarín reported that Cloudflare deployed full transaction detection WAF rules after threat actors began scanning, and the FBI's Cyber Division issued an advisory. PHP's official patches covered supported branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team said only updating fully addresses the flaws; no workaround is complete.

For teams deciding what to patch first, the vendors and researchers point to the same priorities: internet-facing software with unauthenticated remote code execution, evidence of active scanning, and legacy deployments that will not receive vendor fixes. Oracle warned that unpatched known vulnerabilities have been exploited before. watchTowr's advice for the GitLab flaw was to hunt logs for exploitation attempts. Belgium's CCB told organizations to upgrade vulnerable Splunk devices with the highest priority after testing and to increase monitoring. SOC Prime recommended behavior-based monitoring for PHP, such as PHP or web-server processes spawning shells or download tools, while patch signatures remained unavailable.

The PHP leak claimed versions back to PHP 5 were affected, but PHP had not confirmed that range as of October 21, SOC Prime reported. If true, legacy deployments would be a major problem because PHP only supports 8.2 through 8.5 for security fixes; older releases are end of life. Clarín reported that Shodan telemetry showed nearly 60% of internet-facing servers reporting PHP banners run unsupported legacy builds. The PHP security team did release minimal source backports for those legacy branches, but organizations on older branches would still need to migrate or isolate.