Magento CVE-2026-48356 Now Exploited: Apply July Patch

Two of this week’s warnings are about patches that already exist. A flaw in the Magento shop software that Adobe fixed in July is now being used in attacks, and the two PHP flaws we led on last week have moved from “patch now” to “being exploited”. There is also a new Cisco firewall VPN bug that was attacked before it was disclosed, and the data protection regulator reprimanded a police force over a single line in a document.

Magento shops that skipped the July update are exposed

On 27 October CISA, the US cyber agency, added CVE-2026-48356 in Adobe Commerce and Magento Open Source to its catalogue of flaws it knows are being exploited. It is an unrestricted file upload bug: an attacker can upload a file the shop should have refused, which can lead to code running on the server. Adobe rated it critical, with a score of 9.6 out of 10, and fixed it in security bulletin APSB26-73 on 14 July 2026. When the bulletin came out, Adobe said it was not aware of any attacks. That has now changed.

Affected versions include Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, and 2.4.6-p15 and earlier, with matching Adobe Commerce and B2B releases; the fix is the July 2026 security release for each line. If your online shop runs on Magento and an agency looks after it, ask which version it is on and whether the July release went in. A shop that has not been updated since the spring should be checked for signs of tampering, not just patched, because card skimming code is a common reason attackers go after online shops. Our guide to cyber insurance for retailers covers what a policy expects of an online shop, and our patch deadline calculator works out the Cyber Essentials 14-day date. Sources: Adobe’s bulletin APSB26-73, the CISA catalogue and Meetanshi’s summary, which lists the affected and fixed releases.

PHP’s two critical flaws are now being exploited

Last week PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker with no login run code on a web server, and the NCSC told UK organisations to act straight away. On 26 October CISA added both to its exploited list and gave US federal agencies until 29 October to deal with them. CISA also flagged both for forensic triage, which means it wants agencies to look for signs of a break-in as well as patch.

The fixed versions have not changed: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you asked your web host or agency last week and have not had an answer, chase it now. PHP runs almost every WordPress site, and the NCSC’s advice is that any version of PHP may be affected, so an old site is not safe because it is old. Details and the questions to ask are in last week’s news and the NCSC alert; the listing is in the CISA catalogue.

Cisco firewall VPN bug was attacked before the fix

On 28 October Cisco published an advisory for CVE-2026-76418 in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, scored 8.6 out of 10. An attacker with no login can send a crafted request to the remote access SSL VPN and make the firewall restart, which cuts off everyone connected through it. Only firewalls with the SSL VPN switched on and secondary authentication set up on a tunnel group are affected. Cisco says it became aware of active exploitation in October 2026, and CISA added the flaw to its exploited list on 29 October.

There is no workaround, though Cisco describes a mitigation that turns off secondary authentication, at some cost to security. The fixed releases include ASA 9.18.4.96, 9.20.4.50, 9.22.3.200 and 9.24.1.27, and FTD 7.4.9, 7.6.7 and 10.1.1; the advisory lists the rest. A restart sounds minor, but repeated restarts mean staff cannot reach the network, and a firewall that is being knocked over deserves a closer look. If an IT provider manages your Cisco firewall, ask whether it is on a fixed release. Our guide to network security for small businesses covers the basics. Read Cisco’s advisory.

The ICO reprimands Staffordshire Police over an address in a template

On 28 October the ICO said it had reprimanded Staffordshire Police after the force included a domestic abuse victim’s current address in a Domestic Violence Protection Notice served on the alleged abuser in March 2024. The abuser did not know the address before, and the victim had moved home several times to get away. The ICO also found poor completion rates for mandatory data protection training.

There is no hacking here, and that is the point for a small firm. Many of the breaches the ICO deals with are a document, an email or a template that contains more personal data than it needs to. Its advice is to review default templates so details such as addresses appear only where they must, check contact details are current, and double check before anything is sent. A breach like this still has to be assessed and, if it is serious, reported within 72 hours; our pages on types of data breach and GDPR breach examples explain how. Read the ICO announcement.

Also this week

CISA added two more flaws in self-hosted software to its exploited list. On 29 October it listed CVE-2026-97229 in GitLab, which lets an attacker with no login run code on a GitLab server through a crafted regular expression in a CI/CD configuration; GitLab fixed it on 12 October in versions 19.4.2, 19.3.5 and 19.2.8, and GitLab.com was already patched. On 23 October it listed CVE-2026-110447, a command injection flaw in Collabora Online’s built-in CODE server when used inside Nextcloud, which some small firms run as their own file-sharing service. Sources: GitLab’s release notes, Nextcloud’s notice and the CISA catalogue.