# IT Daily Roundup: October 22, 2026 > Oct 22, 2026 · #security #gitlab #wordpress #php #supply-chain GitLab patches a CVSS 10 unauthenticated RCE flaw, attackers planted backdoors on WordPress sites after breaching TeamUpdraft.com, and the PHP2Shell patch is out with active exploitation attempts starting. ## 1. GitLab patches a CVSS 10 flaw that lets attackers run code without logging in GitLab released a fix for CVE-2026-110264 on October 21. The severity is CVSS 10.0. The bug sits in Onigmo, the regex engine GitLab bundles in its own packages. A crafted regular expression triggers an integer overflow and lets an unauthenticated attacker execute code on the server. Every self-managed instance back to version 7.0 (2014) is affected. GitLab.com and Dedicated tenants already on 19.3.5-internal0 or 19.4.2-internal0 and later received the fix automatically. Fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. If you updated on October 12, you may still be vulnerable: that release only covered 19.2 and above. There is no configuration workaround. Versions 19.4.3 and 19.3.6 include database migrations, so single-node deployments should expect brief downtime. > **Why it matters:** Many companies run GitLab either self-hosted or through their IT provider. A CVSS 10 unauthenticated flaw is not something to put off until the next maintenance window. Check your version and compare it against the fixed releases. GitLab also published two Sigma rules for detecting exploitation attempts: "Onigmo native worker crash" and "Org mode render error burst." ## 2. Attackers planted backdoors on WordPress sites through a breached TeamUpdraft website TeamUpdraft.com was accessed without authorization on October 17-18. The attackers likely obtained customer connection keys for UpdraftCentral and used them to send commands to linked WordPress sites and install backdoors. Patchstack documented an 18-hour campaign. UpdraftPlus has over four million active installations, and every copy ships with the UpdraftCentral client component. The fix is UpdraftPlus 1.26.12 or 2.26.12 (or newer). This version disconnects all UpdraftCentral connections made before 10 p.m. BST on October 18. After updating, review the WordPress Users list for unfamiliar accounts and check Plugins, including the Must-Use Plugins tab. Backups stored in your own storage and self-hosted UpdraftCentral are not affected. > **Why it matters:** If your company's WordPress sites use UpdraftPlus and had an active UpdraftCentral connection before October 18, treat this as a priority. Look for accounts named system_team850, web.tech988, or cmseditor170, and plugins with names like "Site Health Cache," "Content Helper," or "Speed Kit." Patchstack published a list of 99 backdoor plugin names in total. ## 3. Update: PHP2Shell patch is out, and exploitation attempts have started We covered CVE-2026-109618 and CVE-2026-109619 on October 21. The patch shipped on schedule at 14:00 UTC in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 7.4, 8.0, and 8.1 will not receive official fixed releases; the PHP project published source backports for those branches only. At 14:19 UTC, watchTowr confirmed active exploitation attempts against both flaws. Cloudflare is tracking attack traffic and reported that attackers are changing their payloads to bypass firewall rules. No confirmed successful breach has been reported yet. > **Why it matters:** On PHP 8.2 through 8.5, updating the package is straightforward. For older versions, the fix depends on your distribution. Ask your server admin which PHP version you are running. On the command line, `php -v` gives you the answer; on shared hosting, look in the PHP settings section or use phpinfo(). Do not wait. --- © 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-22-it-daily-roundup.html