Security Checklist for November 2026: What to Patch and Hunt

Four actions matter most this month, in the order we would follow them. Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Rotate tokens if you ran LiteLLM 1.107.0 or the tampered Claude Code extension. Upgrade GitLab to the latest patch release for your line, because CISA lists its regex flaw as exploited. Patch the Linux kernel TCP flaw where your distribution has a fix (Debian does), and put a firewall stopgap in front of it where it has not.

Cyberpresso data: as of 4 November 2026, of the 108 news posts we published in October 2026, nine describe an attack that got in through a developer's computer (four: Binance's engineers, the Dubai Airports coding test, a planted AGENTS.md file, the Aoki infostealer), a code editor extension (two: GlassWorm's VS Code themes, the Claude Code copy on Cursor's marketplace) or a package or plugin release (three: LiteLLM on PyPI, the testmetest npm worm, Rank Math PRO). Those three entry points shape the list below, and each row links our post on that incident.

November 2026 checklist: action and check for each item (vendor pages read 4 November 2026)

Incident	Action	How to verify	Our coverage
PHP CVE-2026-109618 and CVE-2026-109619	Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or take your distribution's backport.	php -v, then the build each web server loads	PHP leak and early attacks
Linux kernel CVE-2026-98432 (IPv4 TCP)	Install the fixed kernel. Until your distribution ships it, apply Ubuntu's nftables rule.	Your distribution's tracker or status page; sudo nft -c -f /etc/cve-2026-98432.nft before applying	Linux TCP root exploit
GitLab CVE-2026-97229 (CISA KEV) and CVE-2026-110264	Upgrade self-managed GitLab to the latest patch release on your line. Installs with their own Ruby must upgrade Ruby too.	Your instance version against the version list on GitLab's latest patch release page	GitLab CVE-2026-97229
Cursor marketplace copy of Anthropic.claude-code 2.1.312 and 2.1.313	Remove the extension, delete the persistence, rotate what the host could reach.	Search authorized_keys for the svc-telemetry key	Backdoored extension on Cursor
LiteLLM 1.107.0 (PyPI and Docker tags)	Pin litellm==1.106.2, rebuild environments, rotate keys.	pip show litellm, then a file search for cook.pth and sitecustomize.py	LiteLLM poisoned release
Rank Math PRO 3.0.123	Install 3.0.124 from your Rank Math account. If 3.0.123 was activated, restore from a clean backup or clean the site first.	Plugin version on the Plugins screen; the rank-math-pro folder and three wp_options names	Rank Math PRO backdoor
Railway environment variable exposure (21 October)	Roll every environment variable and every private registry credential.	Service logs; CLI and CI credentials recreated	Railway breach and rotation
eMudhra intermediate CA keys and the emSign ECC Root CA - G3 removal	Replace certificates that chain to the removed root.	The issuer chain of each public site you run	eMudhra CA key and Chrome root
Binance incident (29 October): developer machines	Keep deploy tokens off laptops. Vet every coding test and "assignment" before running it.	An inventory of deploy and cloud tokens and the laptops that hold them	Binance and the engineer laptop

The sections keep the same order every month. Where a vendor gives a command, it is copied exactly.

Patch now

PHP: CVE-2026-109618 and CVE-2026-109619

PHP's security team fixed two critical flaws in the 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releases, per the PHP security archive. CVE-2026-109618 is an out-of-memory bug that can leave request data half built and then treat it as valid. CVE-2026-109619 lets stale request state carry over into a later request on the same worker. The project says either can allow unauthenticated remote code execution, and CISA added both to its Known Exploited Vulnerabilities catalog on 26 October 2026.

php.net says the risk is highest on Apache with mod_php, where a demonstrated exploit has an unauthenticated request trigger the attack before any application code runs. The affected list also names PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

php -v reports only the command-line build, and a web server can load a different one. Distributions got the patches in advance, so a fixed package may carry a different version number. Read the package changelog before you call a host clean. Our posts cover the leak before the patches and an AI-agent intrusion that reached a European government's MFA secrets.

If you cannot update now, php.net lists mitigations that reduce exposure but, in its words, do not make an installation safe. Set session.upload_progress.enabled=0 in php.ini, an FPM pool or the server configuration, not in ini_set() or a .user.ini file, then restart every worker. Set memory_limit=-1 in a way applications cannot override, and cap post_max_size. php.net also suggests a container or cgroup limit as the availability boundary, because an unlimited memory setting removes PHP's own cap. PHP 8.1 and older get no further updates from the project, which published source backports only for 7.4, 8.0 and 8.1.

Linux kernel: CVE-2026-98432

NVD published CVE-2026-98432 on 15 October 2026. It is a use-after-free in IPv4 TCP connection setup: a race in which one CPU processes a retransmitted SYN while a second CPU is still building the reply. The 9.8 on NVD's record is the kernel CNA's CVSS 3.1 score. Red Hat's CVE page also gives 9.8 and rates it Critical for Red Hat Enterprise Linux.

A fix has shipped for some distributions. The Debian security tracker lists bookworm-security at 6.1.190-1 and trixie-security at 6.12.115-2 as fixed. Ubuntu's status page, read on 4 November 2026, still lists 26.04 LTS, 24.04 LTS and 22.04 LTS as vulnerable with a fix in progress, and 20.04 LTS as vulnerable with no fix named. Ubuntu's own page calls its firewall rule a limit that "reduces the risk but does not fully prevent exploitation". Our news post on the bug covers how Debian and Ubuntu split on the fix.

Ubuntu's rule drops incoming IPv4 TCP packets that carry IP options. It breaks TCP connections that depend on IPv4 options, and containers with their own networking need it applied separately:

table inet cve_2026_98432 {
chain input {
type filter hook input priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
}

Create /etc/cve-2026-98432.nft with that content, check it with sudo nft -c -f /etc/cve-2026-98432.nft, then apply it with sudo nft -f /etc/cve-2026-98432.nft. Ubuntu's steps make the rule survive a reboot.

That rule sits on the input hook, which sees only packets addressed to the host itself. The nftables wiki says forwarded packets take the prerouting, forward and postrouting path instead, and Docker's docs say Docker turns on IP forwarding on Linux hosts, so traffic a host passes on to its containers never reaches that chain. The prerouting hook comes first on both paths, so on such a host the same match can go on a prerouting chain. This variant is ours, not Ubuntu's, so check it with sudo nft -c -f before applying it:

table inet cve_2026_98432_prerouting {
chain prerouting {
type filter hook prerouting priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
}

Some write-ups call disabling MPTCP the quick fix. The Go team's notice to oss-security calls disabling MPTCP per program "a fragile mitigation": one MPTCP listener left open keeps a system vulnerable, and the approach assumes every viable exploit depends on MPTCP. Its advice is a patched kernel. If you still want the system-wide switch, the kernel documentation describes net.mptcp.enabled (default 1) as the setting that controls whether MPTCP sockets can be created. Put the line net.mptcp.enabled = 0 in a file under /etc/sysctl.d/, the directory that sysctl.d(5) reads as *.conf files. Go 1.24 made MPTCP the default for listeners on Linux, per the Go 1.24 release notes.

GitLab: CVE-2026-97229 and CVE-2026-110264

GitLab's 19.4.2 patch release of 12 October 2026 fixed CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that an unauthenticated user can reach with a crafted pattern. GitLab scores it 10.0 under CVSS 3.1. CISA added it to the KEV catalog on 29 October 2026 with a due date of 1 November 2026, which has passed. Our news post on CVE-2026-97229 covers the exploitation and the Ruby angle.

The newer flaw is CVE-2026-110264, a second integer overflow in the same compiler with the same 10.0 score and no authentication needed. GitLab's 19.5.1 patch release, of 21 October 2026, fixes it and also backports the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9. Do not stop at the 97229 release.

Go to the latest patch release for your line. GitLab's 19.5.3 release page lists the current versions as 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14. Take the one that matches your minor version.

GitLab adds a warning for self-built installs. An install that brings its own Ruby, for example a source build or a custom container image, stays exposed after the GitLab upgrade alone: move that Ruby to 3.3.13, 3.4.12, 4.0.9 or newer as well, because the CVE-2026-110264 fix ships in Ruby rather than in GitLab's code. The Ruby project's advisory of 23 October 2026 lists the same releases. The bugs are reached only when an application compiles a pattern from a string an attacker controls.

Rank Math PRO 3.0.123

Rank Math says the malicious build was a PRO 3.0.123 download made between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC. The clean build is 3.0.124, and the free plugin on WordPress.org is not affected. Our news post explains why updating the plugin does not remove the backdoor.

If 3.0.123 was installed but never activated, delete the affected files, install 3.0.124 from your account and run a security scan. If it was activated, Rank Math recommends restoring from a backup made before 20:02 UTC on 15 October, then changing every password and secret the site could reach. Deactivating the plugin is not enough: Rank Math says the malware can rebuild its hidden backdoor on any visit to the site. Delete the rank-math-pro folder, delete the wp_options entries named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c, and block outgoing connections to rank1cdn.com.

Rank Math's second step is a search for leftovers; the main checks are below, and its advisory has the full list, including a fake core file, .htaccess and cron entries, PHP files in uploads/ and the server's own SSH keys and crontabs. Check wp-content/mu-plugins/, the folders of other plugins, the inc/, includes/ and lib/ folders of non-default themes, and the Rank Math includes/ folder for suspicious PHP files. Look for base64_decode combined with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code. Then review WordPress users for unfamiliar administrator accounts.

Hunt

The Cursor marketplace copy of Claude Code

Cursor says versions 2.1.312 and 2.1.313 of Anthropic.claude-code, published in its VS Code extension marketplace, were malicious. They were available on Windows and macOS between about 2:27am and 1:35pm PT on 29 October 2026. The extension tried to add an attacker-held SSH key labelled svc-telemetry, open a reverse SSH tunnel, and persist through a LaunchAgent on macOS or a scheduled task on Windows. Our news post has the timeline; GlassWorm's VS Code themes, covered on 6 October, were another malicious editor add-on.

Cursor says to follow its remediation whatever the check shows, because the payload drops standalone persistence scripts. On macOS its own check, run as the affected user, is:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, search the user and administrators' authorized_keys files for svc-telemetry in PowerShell. Also look for the LaunchAgent com.apple.sysmond, the scheduled task SysMon, and a tunnel to 134[.]209[.]82[.]225 on TCP port 22, defanged as Cursor gives it. A host with the key needs the key, the persistence and the tunnel removed, and its reachable credentials rotated from a trusted machine.

For secret scanning across repositories, compare the Toolradar listings for GitGuardian and TruffleHog. For endpoint hunting across many laptops, read our CrowdStrike review and SentinelOne review.

LiteLLM poisoned release

LiteLLM says its release pipeline was compromised on 21 October 2026 and that the bad release went to PyPI and Docker with malware that steals credentials. The PyPI wheels were live from 11:39 to 13:23 UTC. The Docker Hub tags v1.107.0, latest, main-latest and main-stable pointed to the bad image from 11:46 to 14:20 UTC. The GHCR copies were unavailable by 13:51 UTC. The official source tag does not contain the malicious files. Our news post covers how the attackers got the GitHub tokens they used.

LiteLLM says to pin 1.106.2 or any version published before the bad release. Do not start with pip install in an affected environment, because any Python start reruns cook.pth and sitecustomize.py, pip included. Delete those files and their compiled copies from each affected site-packages folder, kill the detached Python daemon holding /tmp/remote_code_loader.lock, then reinstall the pin.

Search for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py. Finding one confirms exposure. Finding none does not prove a host is clean, because containers and temporary folders get cleaned up. If the bad release ever ran on a host with outbound internet access, LiteLLM says to assume the data left.

Rotate

Railway said on 21 October 2026 that an unauthorised party may have decrypted some customer environment variables. Railway's first read is that only some users may be affected, yet it recommends rolling every environment variable, including API keys, and every private registry credential. Its 23 October update adds three chores, because commits pushed during the pause were not deployed: deploy the newest commit again, reconnect the GitHub integration, and issue fresh CLI and CI credentials. Our news post has more on the breach.

For the wider picture of leaked credentials, see our GitHub live credentials post. LiteLLM's list is longer: the instance or task IAM role, every provider key in the proxy database, the master and virtual keys, the DATABASE_URL password, and any secret in the environment of a process on an affected host. On AWS, check CloudTrail for GetCallerIdentity calls from that role around the install time.

Trust stores

eMudhra and the Chrome root

Google's Chrome team said on 20 October 2026 that eight eMudhra intermediate certificate authority keys were compromised after being generated with weak randomness. That would let anyone forge HTTPS certificates against clients that had not removed trust. Chrome blocked the affected intermediates on 17 October, and no certificate chaining to the six TLS intermediates reached Certificate Transparency logs before the block. Our news post covers the key failure behind the removal.

Chrome also removed emSign ECC Root CA - G3, the root that signed the bad intermediates, from its root store, with the removal expected on Tuesday 27 October 2026, Pacific time. Some legitimate certificates chaining to it will stop working in Chrome, so Google tells site operators to get a certificate from another hierarchy in the Chrome Root Store. GitLab's 19.5.3 release also removes trust for those eight intermediates from the certificate stores it ships.

The action now is an inventory. Find each public site whose certificate chains to emSign ECC Root CA - G3, and replace it.

Harden developer machines

Binance and the engineer laptop

Binance's initial report on X, posted on 3 November 2026, covers its 29 October incident. It describes a campaign that started on engineers' computers and reached an internal wallet signing service. One engineer downloaded a tampered Homebrew installation after finding the tool through a search engine. Another ran an "assignment" from a fake recruitment process on a work computer. A container deployment token kept on the first engineer's computer was then used to deploy a container during the attack. Binance says the latest FBI information points to North Korea. Our news post of 31 October predates this report, and our September post covers fake Mac installers from the Contagious Interview campaign.

Binance's account points to three controls. Keep deploy and cloud tokens off laptops, or give them short lifetimes. Install developer tools from their official source, not the first search result. Treat a coding test or "assignment" from an unknown recruiter as phishing until a known contact confirms it. Our AI coding agent infostealer post covers the same laptop risk.

What comes next month

PHP will publish a full advisory for CVE-2026-115560 with its next release. GitLab publishes each fixed issue's details 90 days after its patch release, and Google will share updates on eMudhra's remaining roots in public forums.

The monthly format follows a practical security guide from Cognition's blog: A Practical Guide to Security in November 2026.

FAQ

What should a security team patch first in November 2026?

Patch PHP to the fixed releases, and upgrade self-managed GitLab to the latest patch release on your line. PHP's two CVEs can allow unauthenticated remote code execution, and CISA lists the GitLab flaw as exploited. Apply Ubuntu's nftables rule to the kernel flaw until your distribution ships the fix.

Does php -v prove that PHP is patched?

No. It reports only the command-line build, while php.net lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as affected, and distributions backport fixes under their own version numbers.

Does disabling MPTCP fix CVE-2026-98432?

Not on its own. The Go team calls disabling MPTCP per program a fragile mitigation and says the fix is a patched kernel. The vendor description covers plain IPv4 TCP, and Ubuntu's mitigation is an nftables rule, not an MPTCP switch.

How do I know if the Cursor Claude Code extension hit my machine?

Look for the svc-telemetry key in your authorized_keys file. On macOS, Cursor's one-line check does this. The affected versions were 2.1.312 and 2.1.313, live on 29 October 2026. A host with the key needs the persistence removed and its reachable credentials rotated.

Will the Chrome removal of an eMudhra root break my site?

It can. Google says some legitimate certificates chaining to emSign ECC Root CA - G3 will stop working in Chrome, and the removal was expected on 27 October 2026. Get a certificate from another hierarchy in the Chrome Root Store, and check each public site's chain before the next renewal.

How we checked this page

Every version, setting, IOC, date and score was read on 4 November 2026 on the first-party page linked where it appears: vendor advisories and docs, NVD, the distribution trackers, CISA's catalog and Google's Chrome blog. Binance's post on X of 3 November 2026 is the source for its incident. Nothing here was run in a lab.

The Cyberpresso count rule: every post in our news format (no guide or comparison type) dated October 2026, 108 in all, classified by title and text on 4 November 2026. The nine are a judgment call. We left out borderline cases where the way in was a vendor's update server, a hosted web script or fake apps on GitHub, such as AOMEI, Polymarket's DebugBear script and the fake GPT-6 apps.

Louis Corneloup, founder of Toolradar and Dupple, is the author. How products are described is on how we rate, and corrections sit in the editorial policy.

Cite this: Cyberpresso, "Security Checklist for November 2026: What to Patch and Hunt", November 2026.

Cyberpresso's daily brief covers the exploits and patches behind each line here: subscribe at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.