Hello everyone：

Forward the National Institute of Cyber Security and TWCERT/CC vulnerability warning announcement. Please confirm and update or patch as soon as possible to reduce related information security risks.

1.Critical Vulnerabilities Discovered in PHP; "ARTEX" AI-Powered Penetration Testing Tool Exploited on a Large Scale
   ■Two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been identified in the PHP web development language. With a severity score of 9.8, these high-risk vulnerabilities are already being actively exploited, as Proof-of-Concept (PoC) exploit code has been publicly released. Given that many websites and content management systems (such as WordPress, Drupal, Joomla, and Magento) rely on PHP as their underlying architecture, this issue has drawn significant international attention. Organizations and enterprises are urged to immediately assess their exposure and implement patches or strengthen protective measures.
   ■Recommended action: Apply patches as provided by the official PHP website.
      ▲https://www.php.net/downloads.php

2.High-risk security vulnerability in GitLab AI Gateway (CVE-2026-90970) – please verify and take action immediately.
   ■Researchers have identified a sandbox escape vulnerability (CVE-2026-90970) in the GitLab AI Gateway. An authenticated remote attacker with permissions to configure Duo Agent Platform workflows and templates could submit a specially crafted prompt template to bypass sandbox restrictions, thereby executing arbitrary commands on the AI Gateway. Please verify and take action immediately.
   ■Recommended action: Apply the patches provided on the official website.
      ▲https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/

3.Four High-Risk Security Vulnerabilities in Node.js (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, and CVE-2026-111497)
   ■Researchers have identified four high-risk security vulnerabilities in Node.js (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, and CVE-2026-111497). These include issues such as insufficient validation of null-byte inputs, bypass of TLS certificate hostname checks, and out-of-bounds write vulnerabilities. Please assess your environment and take appropriate action immediately.
   ■Recommended Action: Apply patches as provided by the official website.
      ▲https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

4.High-Risk Security Vulnerability in Microsoft Office SharePoint (CVE-2026-65660)
   ■Microsoft Office SharePoint contains a code injection vulnerability (CVE-2026-65660). An authenticated remote attacker can exploit this by sending a specially crafted request to inject and subsequently execute arbitrary code. This vulnerability is already being exploited in the wild; please verify your systems and take appropriate action immediately.
   ■Recommended Action: Apply the patches provided by the vendor via their official website.
      ▲https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 

5.Cisco SEG contains a high-risk security vulnerability (CVE-2026-76519)
   ■A relative path traversal vulnerability (CVE-2026-76519) exists within the Advanced Malware Protection (AMP) feature of the Cisco Secure Email Gateway (SEG). When the File Reputation service is enabled, an unauthenticated remote attacker can exploit this vulnerability by sending an email containing a specially crafted attachment to an affected device. This allows the attacker to write arbitrary files to the underlying operating system and execute commands with root privileges. This vulnerability is already being exploited in the wild; please verify your systems and take immediate action.
   ■Recommended Action: Apply the patches or fixes provided by the vendor via their official website.
      ▲https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp 

6.Related Articles:
   ▲https://www.nics.nat.gov.tw/latest_news/announcements/News/a3964373-0bf8-4abb-a77a-ca879f0e5d54/
   ▲https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/5c4e9af1-4275-44ef-a277-c692786b5a2c/
   ▲https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/a6d6fab1-7afc-479e-9d9a-a5dc286bae08/
   ▲https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/29471f0f-84a1-45bd-bfee-e93fba8cfe4b/
   ▲https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/32ec5d76-d5ce-43e8-be5c-bd3a9ba09aa9/
   ▲https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/e8796bcb-11c6-4eef-ae83-0d99c3c7cb82/

For more question about information security, please directly consult with Computer Center, at rogeryu@mail.ntust.edu.tw or applechang@mail.ntust.edu.tw