Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

This week's patch list is long, but only a few items can't wait. If you run Delinea Secret Server on your own servers, upgrade it today: Delinea now says customers are seeing attacks on the FIDO2 sign-in flaw. After that, finish the PHP and Linux kernel work from earlier in the week, then book the rest into normal patch windows.

Most of this list can wait for your normal patch cycle. Two things can't. Delinea says attackers are using a flaw in self-hosted Secret Server that lets someone add their own security key to another person's account and log in as them. Secret Server holds admin passwords, so whoever gets in there can usually reach everything else.

The other urgent job started earlier in the week. The PHP flaws known as PHP2Shell went on CISA's exploited list, and two days later CISA added a Linux kernel bug it says can be chained with them to get root. If you patched PHP and stopped there, the server can still be taken over by someone who already got a foothold. Our PHP and Node.js post has the full story and the kernel detail.

Some of this week's items aren't security flaws at all, and they can still break things. Okta Access Gateway had a release that made healthy apps return errors. Snowflake's ODBC driver stopped checking, by default, whether certificates were revoked. InterSystems shipped a release because the two biggest browsers are about to remove a feature its message viewers depend on. Those are the ones that surprise people on a Monday morning.

Delinea Secret Server (self-hosted). Secret Server is a vault for privileged passwords. CVE-2026-19117 lets an outsider register their own FIDO2definitionSign-in with a security key or a phone instead of a typed code. In Secret Server, the bug let a stranger tie their own key to your account. security key against someone else's account and then sign in as that person, with no password and no login needed first. Delinea scores it 9.8, and its trust center now says customers have reported active exploitation of their on-prem servers. CISA hasn't listed it yet, so don't wait for that.

The fix to pick is 12.2.7 or later. Delinea also offered quick hotfixes for the FIDO2 bug alone (12.1.3, 12.0.23, 11.9.48, 11.8.2 and 11.7.62), but two or three other September flaws stay open on them, depending on the hotfix, including a SAML sign-in bypass. Only 12.2.7 and later close all four. If you go to 12.3, take 12.3.000002, because 12.3.000001 sent users who sign in with Windows authentication plus a second factor back to the login page. Delinea's cloud service isn't listed as affected.

After upgrading, check who has a FIDO2 key registered. An upgrade stops new rogue registrations, but it doesn't remove one an attacker already added. Reset two-factor for any account where you don't recognise the key, and look at what those accounts opened. See our Delinea page for how we run these upgrades.

Delinea Privilege Manager. A separate Delinea advisory published this week covers the Privilege Manager agent, the software that controls admin rights on Windows and Mac endpoints. CVE-2026-92744 can let a remote attacker run code as LocalSystem. Delinea's text calls it unauthenticated, but its own score assumes high privileges, so read it as serious rather than an emergency. Fixed in 13.0.2064 and 12.0.5804, for on-prem and cloud. No exploitation is reported.

Already covered in their own posts. These were critical enough to write up separately. Read the linked post if you run the product.

• PHP2Shell: if you patched PHP and stopped, go back and do the kernel. CISA lists kernel CVE-2026-46300 and says it can be chained with both PHP flaws to get root, and our PHP and Node.js post has the detail.
• Brotli CVE-2026-111497: lots of software bundles this compression library, from Node.js to firewalls, and CISA lists it as exploited. Our Brotli post shows where to look for copies.
• Oracle E-Business Suite: Canada's Cyber Centre says CVE-2026-101767 is being exploited. You don't need anything new from Oracle, just the October patch bundle actually applied.
• BeyondTrust Remote Support BT26-05: on CISA's list since mid-October. Patch, then check who got in. See the BeyondTrust post.
• IBM Verify Access: two flaws that run code without a login, fixed in 11.0.3.2 and 10.0.9.4. No exploitation reported. See the IBM Verify post.

If you run one of these, start with its own post: PHP and Node.js, Brotli, Oracle October patches, BeyondTrust Remote Support and IBM Verify Access. They have the patch order and what to check once you're done.

CISA added four more flaws this week in products outside the platforms we cover: GitLab, Cisco's ASA and Firepower firewall software, VMware ESX and Adobe Commerce. The GitLab and Cisco ones carry a federal due date of November 1, which tells you how seriously CISA rates them. If you run any of those, go to the vendor's advisory today.

Okta Access Gateway. Access Gateway is the box Okta customers put in front of older web apps that can't do modern single sign-on. Okta put out three advisories for it at once. CVE-2026-115547 (9.1) lets someone who is already an Access Gateway admin run system commands, and CVE-2026-115546 (8.1) lets a signed-in user tamper with a sign-in setting and possibly get into the admin console. Both are fixed in 2026.10.2.

The third covers the PHP2Shell flaws in the PHP that ships inside the appliance. Okta says the default configuration blocks the known way of exploiting them, and the fix is in 2026.44.0, which carries PHP 8.3.36. Then a catch: 2026.9.2 through 2026.44.0 could make apps return HTTP 503 with ACTIVE_DNS_FAILURE even when DNS was fine. Okta fixed that in 2026.44.1, which has the same security fixes. If you're still on an older build, go straight to 2026.44.1. If you're on 2026.44.0 and seeing those 503s, 2026.44.1 is your fix.

Okta RADIUS Agent and Credential Provider for Windows. The RADIUS Agent lets VPNs and network gear send logins to Okta for MFA. Versions 2.17.5 to 2.27.0 can be knocked over by a malformed packet from the same network segment (6.5), and the Windows installer left file permissions loose enough for a local service to read the agent's key and its Okta API token (5.3). Take 2.28.0. The Credential Provider, which adds Okta MFA to Windows and RDP logins, can leak bits of process memory into local logs; take 1.4.6.0. These advisories are from mid-October, so check them off if you already have.

Auth0 SDKs. Four Auth0 libraries that developers build into apps got fixes in mid-October, all medium severity. auth0.js 9.12.0 to 10.2.1 didn't enforce maxAge, so a stale sign-in could pass; take 10.3.0. auth0-lock could put Active Directory login form data in the URL; take 13.2.1 or 15.0.2. java-jwt 4.0.0 to 4.6.1 can lose a thread to a token with an out-of-range timestamp; take 4.6.2. nextjs-auth0 before 4.32.0 has an open redirect after login; take 4.32.0. Your scanners will flag these in dependency files, so ask the app teams to bump them in their next release.

SailPoint IdentityIQ. This is a catch-up item. CVE-2026-12342 is a 9.6 flaw that lets an unauthenticated user run code on IdentityIQ, but only from an adjacent network, and it was published in late September. CVE-2026-12341 (8.8, July) lets an attacker reach protected APIs by getting past bearer-token checks. SailPoint ships the fixes as IIQSR-983 and IIQSR-982 for each supported version, and every version up to 8.5p2 is affected (8.5p1 for CVE-2026-12341). If they aren't in your last change record, they belong in this month's window. More on our SailPoint page.

On the Identity Security Cloud side, SailPoint's Virtual Appliance 2026.10.29 (version 2.38, CCG 1332) carries no security fixes. It brings ServiceNow Service Catalog connector 5.4, which moves approval sync from polling to event triggers. SailPoint also posted notices saying it doesn't believe its products are hit by PHP2Shell, and that the eMudhradefinitionA certificate authority whose intermediate certificates had weak keys. Java, Go and browsers are removing trust in them. issue isn't a critical risk to it.

PingFederate. Ping's October maintenance releases, 13.1.4, 13.0.6 and 12.3.9, include two security items without CVEs. One restricts which JDBC drivers and connection URL types the Admin API will accept for datastores, and the other updates the Bouncy Castle FIPS libraries. Ping describes the first as defence in depth. Normal maintenance window.

Oracle Java SE and GraalVM: the eMudhra certificates. When a Java app connects to a site over HTTPS, it checks the site's certificate against a list of authorities it trusts, and eMudhra is on that list. Eight of eMudhra's intermediate certificates had weak private keys, so someone could forge a certificate that Java would accept. Oracle put out two emergency alerts, both scored 9.1. The first stops trusting the bad intermediates, and the second removes the related eMudhra root certificates.

The builds to install are 8u511-b33, 11.0.33.0.3, 17.0.21.0.3, 21.0.13.0.3, 25.0.5.0.3 and 27.0.1.0.3, plus the matching GraalVM updates. Neither alert reports exploitation. The work is in finding every Java runtime: application servers, EBS and PeopleSoft middle tiers, Oracle identity products, and vendor tools that ship their own JRE. PTC, for one, says it doesn't ship Java but some of its products depend on it, and its cloud customers are getting emergency maintenance. The first alert is also covered in our October Oracle post.

Oracle also put PHP2Shell fixes into its own products in a separate alert, now on revision 2. It covers Oracle Secure Backup 19.1, Solaris 11 and several Communications products such as Diameter Signaling Router and EAGLE. Fixed builds sit in My Oracle Support, so your Oracle DBA or Solaris team has to pull them from there.

SAP. SAP's October patch day had four critical notes: a 10.0 in SAP Cloud SDK for Python (fixed in 0.45.2), a 9.9 in NetWeaver Visual Composer, a 9.9 code injection in S/4HANA's Manage Substitution/Validation Rules app, and a 9.1 missing authorization check in Manufacturing Integration and Intelligence. SAP doesn't report any of them exploited. The next patch day is Tuesday, November 10. If the October notes aren't in yet, apply them together with November's so your Basis team only tests once. More on our S/4HANA page.

MuleSoft. Mule runtime 4.13.1 fixes regressions that 4.13.0 introduced, including deployment failures with placeholder error types, JMS logging without an XA transaction manager, and Object Store v2 watermark partitions. No security content. The thing to plan for is CloudHub 2.0. MuleSoft says the November cycle is self-upgrade only: automated patching in sandbox and production is paused, and you have to upgrade your apps by hand to get the patches. Automatic updates come back in December.

IBM Sterling. Two catch-up items for the file transfer estate. Connect:Direct for UNIX has a flaw in the old apnotify utility (CVE-2026-93888, 7.8) that a logged-in local user can abuse; IBM says the utility may be found on some installs upgraded in place since 2017 or earlier. Fixed in 6.4.0.6.iFix025 and 6.3.0.7.iFix033. B2B Integrator and File Gateway were writing credentials to logs (CVE-2026-81209 at 4.9 and CVE-2026-12737 at 4.4), fixed in 6.2.1.3 and 6.2.2.2. Patch, then clean or restrict the old logs, because the credentials are still sitting in them.

InterSystems IRIS and Health Connect. This one isn't a security fix, but it has a hard date. InterSystems says Chrome and Edge are expected to drop built-in XSLT, and the Management Portal's Message Viewer and Visual Trace rely on it to show messages. The new maintenance releases fix that, and they're in the table below. Older lines such as Caché and Ensemble only get their fix days before the browser change, which leaves those teams almost no time to test. See our InterSystems page.

HashiCorp Vault 2.2.1. Vault stores secrets and hands them out by policy. 2.2.1 fixes a cache-key collision that could make a policy-name alias resolve to the root policy, the one that can do anything. HashiCorp lists it as a security patch but hasn't published a CVE or a bulletin, and doesn't say which versions are affected. Treat it as a this-month upgrade, sooner if teams create their own policy names. More on our Vault page.

Terraform. Terraform 1.17.1 came out this week with bug fixes only. If terraform fmt hits a write error, it now leaves the original file alone instead of a damaged one. If you're on 1.16, take 1.16.7. It's built with a Go release that stops accepting the compromised eMudhra intermediates, and 1.16.6 before it fixed an HTTP/2 exhaustion bug that needs a compromised registry to exploit. HashiCorp's go-getter library also had a path traversal bug in S3 and GCS directory downloads, fixed in 1.8.10 and 2.2.5. HashiCorp's bulletin mentions only the library, so check any Go tools of your own that import it.

dbt Core. 1.12.6 and 1.11.16 make sure a package downloaded as a tarball can't write outside dbt's downloads folder. There's no CVE, but it's the kind of fix you want in CI, where dbt deps pulls code from the internet on every build.

Snowflake drivers. Snowflake updated its drivers to stop trusting compromised intermediate certificates: ODBC 4.2.0 and the Python connector 5.1.0. ODBC 3.22.0 does the same for the 3.x line, and it also turns OCSPdefinitionA way for software to ask a certificate authority whether a certificate has been revoked. Some Snowflake drivers now skip this check by default. revocation checking off by default. If your security team relies on DisableOCSPCheck=false to keep it on, that setting no longer does it. The Python connector 4.8.0 made the same OCSP change in September, so this is a direction across Snowflake's drivers. Ask your security team whether that's acceptable, and look at the CRL setting if it isn't.

Two traps sit in the Python connector. 4.8.1, a patch release from this week, drops Python 3.10, so a pipeline pinned to 3.10 will fail to install it. And 5.0.0 is a rewrite with a long list of removed options, so moving from 4.x to 5.x is a project, not a version bump. Snowpipe Streaming SDK 1.9.1 fixes Google Cloud Storage uploads that could be silently truncated, which is worth taking just for that. More on our Snowflake page.

CISA published five industrial advisories this week. Only one includes a flaw on its exploited list, an old WebP bug inside the ICONICS products, and most need network access to the control network. Plant teams should still put them in the next outage plan, because plant systems often wait for a planned outage to be patched.

Mitsubishi won't fix MC Works64, GENESIS32 or BizViz, so if you run them, plan the replacement and lock them down in the meantime. Mitsubishi's advice is to let only administrators log in to those PCs and block remote logins from untrusted networks. More on our OT security page.

AVEVA. AVEVA says someone got unauthorized access to its corporate SharePoint, its internal document store. It says its software and production environments are separate and not affected, and it isn't recommending any action yet. If you've shared network diagrams, credentials or support files with AVEVA, list what you sent, and rotate anything that still works.

The BeyondTrust change deserves a line in your change calendar. Starting with 26.3.1, Remote Support and Privileged Remote Access deployments that have automatic updates turned on will move to new versions in their maintenance window, not just get patches. If you need to control when your jump hosts change version, untick the automatic install option on the appliance's Updates page before January. Critical patches still install as soon as they're ready either way.

# example output, with made-up hosts and versions. Run each on the systems you own.
$ java -version 2>&1 | head -1
java version "21.0.13" 2026-10-21 LTS
# 21.0.13 alone doesn't tell you the build. Check the full build string or the update date in your package tool.
$ uname -r && php -v | head -1
6.8.0-88-generic
PHP 8.3.36 (cli)
$ python3 -V
Python 3.10.14
$ pip show snowflake-connector-python
Version: 4.8.0
# This host is still on Python 3.10, so 4.8.1 won't install here. Move Python to 3.11 first, or hold at 4.8.0 for now.

These three are made up, and none is a real incident or a Cohash client. The versions and behaviours in them come from the vendor advisories and release notes behind this roundup.

We patch and upgrade most of the platforms on this list. In a week like this we'd begin by checking what you really run, because an urgent list is only as good as the inventory behind it. If someone already got in, we stay for the clean-up. If you want a second pair of eyes on Secret Server or your Okta estate, see our Delinea team and our Okta team. If you're not sure what's exposed, start with an assessment.