Tuesday's lead is the kind of miss that could happen to any team: a project patched its GitLab and still got hit, because the upgrade stopped one release short of the fix. Here is the longer version of today's five, with the version numbers, KB numbers and links that do not fit in three minutes.
GitLab: being used in attacks, and over a thousand servers still open
CVE-2026-97229 is scored a maximum 10.0: a crafted regular expression in CI/CD configuration lets an unauthenticated attacker run code on a self-managed GitLab Community or Enterprise Edition server, and the underlying bug sits in the Ruby runtime GitLab bundles. GitLab fixed it on October 12 in 19.2.8, 19.3.5 and 19.4.2. The Alpine Linux project says its own GitLab server was attacked on October 21: Alpine had upgraded on October 13, but to 19.3.4, one release short of the fix, and the attacker came back on October 25 and 26 after the real patch was in and was blocked. On October 29 CISA added the flaw to its Known Exploited Vulnerabilities catalog with a federal due date of November 1, which has now passed. BleepingComputer reports that Shadowserver still counts over 1,000 vulnerable GitLab instances on the internet, and notes one more trap: installations built with a separate Ruby runtime need the Ruby fix too, not only the GitLab upgrade. The check that matters is the exact version string, 19.2.8, 19.3.5, 19.4.2 or later.
The fix watch: quiet, one recap
Microsoft has posted no new fixes since the October 27 updates. Those carry both recent repairs: KB5127936 resolves the Smart App Control switch that sat grayed out on Windows 11 versions 25H2 and 26H2, and KB5127653 and KB5127936 resolve the Remote Desktop sign-in failure with error 0xC000000D for non-admin users.
Exchange: Outlook on the web sign-in, day twenty-one
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". Windows release health still lists it as Mitigated, a workaround but no fix, across Windows Server 2016, 2019, 2022 and 2025, and the entry has not been updated since October 16. If you run your own Exchange server, read it before this week's patch window; the affected updates include KB5126646, KB5126655 and KB5126651.
The install watch: still quiet
Microsoft has posted no new "this update fails to install" issues; the most recent known-issue changes remain the two fix entries above, from October 28. A quiet week means a failed install on your machine is more likely local than a known problem. If one fails, note the error code before calling IT.
Brotli: one week to the federal deadline
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, the compression library bundled into Node.js, Microsoft's .NET and a long tail of software that copies the decoder into its own code. CISA added it to the exploited list on October 27 with a federal due date of November 10, next Tuesday. The fixes are out: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20, 23 and 25 get no fix), Microsoft's out-of-band .NET updates 8.0.33, 9.0.22 and 10.0.14, and upstream Brotli 1.0.10, 1.1.1 and 1.2.1. Two notes from Microsoft's advisory coverage, reported by BleepingComputer: .NET does not switch Brotli decompression on by default, and a self-contained app bundles its own runtime, so it needs a rebuild and redeploy, not just a patched host. The flaw was reported by OpenAI's Codex Security researchers.
While you patch, one number from Redmond: Microsoft Security Research published a data-driven analysis of exploited vulnerabilities yesterday. Of roughly 383,000 tracked CVEs, 2,056 have been used in real attacks, fewer than 1 in 200, but this year the median time from a CVE going public to landing on CISA's exploited list is three days. Their words: "Patching remains essential, but it is not the only defensive action available." Prioritize the takeover flaws, which is exactly what today's two CVEs are.
If you do three things this week
- If you run a self-managed GitLab, read the exact version string today: 19.2.8, 19.3.5, 19.4.2 or later, and remember Alpine missed by one.
- Get the Brotli fixes into Node.js and .NET apps before next Tuesday's deadline, and rebuild self-contained apps rather than only patching the host.
- If you run Exchange, read Microsoft's OWA release health entry before you patch this week.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.