Patch your Linux hosts and Ivanti Connect Secure appliances first. CISA lists the Linux kernel flaw CVE-2026-46300, which chains into PHP webshells and root commands, and two Ivanti flaws as exploited. Then plan your GitLab upgrade, because 19.5.3 distrusts compromised eMudhra CAs. Next.js ships a security release on 3 November. For a similar exploited-flaw drill, see our PHP2Shell patch plan.
Linux kernel and Ivanti head this week's exploited-flaw list
CISA's Known Exploited Vulnerabilities catalog has listed the Linux kernel flaw CVE-2026-46300 since 28 October. Chained with two other CVEs, it plants PHP webshells and runs commands as root. Check your distribution's security tracker for CVE-2026-46300 to see whether your kernels are affected and which update fixes it.
Ivanti Connect Secure CVE-2026-111357 has been listed since 30 October. It chains with two other Ivanti flaws, one of them an unauthenticated command execution bug. CISA flags both the kernel flaw and this one for forensic triage: check for prior compromise before you patch or rebuild.
Three more are listed. Adobe Commerce/Magento CVE-2026-48356 allows code execution through unrestricted upload. VMware ESX CVE-2026-41709 lets an admin act without logging. Cisco ASA/FTD CVE-2026-76418 lets a remote attacker reload the device.
CISA's remaining due dates are 10 November for Adobe, 11 November for ESX and 13 November for the Ivanti file upload flaw CVE-2026-118527. Exploitation is happening regardless of who you are.
Verdict: act now on the kernel, Ivanti, and Adobe or ESX if you run them. Plan for Cisco, since it's an outage, not code execution.
GitLab 19.5.3 distrusts the eMudhra intermediate CAs
GitLab's 19.5.3 patch release removes trust for eMudhra intermediate CA certificates whose private keys were compromised. Upgrading GitLab alone doesn't cover your pipelines. You also need GitLab Runner 19.5.1, and any CI job images that bundle their own ca-certificates package have to be rebuilt. The AI Gateway upgrades separately: 19.5.3, or the listed version for your line (18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3).
Single-node instances will have downtime while migrations run. Google Cloud's matching bulletin is in last week's roundup.
Verdict: plan for it this sprint if you self-host GitLab, and schedule the runner and image work with the upgrade.
GitHub Actions workflow lockfiles pin actions to exact commits
GitHub's 28 October changelog makes workflow lockfiles generally available on Free, Team, Enterprise Cloud and Enterprise Cloud with data residency. A .github/workflows/actions.lock file pins exact commits for actions referenced by tag or branch, and the gh actions-lock extension generates it. Adopt one workflow at a time. Dependabot regenerates entries, and admins can set a "Require lockfile" policy.
A lockfile helps protect against unexpected changes. It doesn't tell you whether the pinned commit is any good.
Verdict: plan for it. Pilot one workflow, then decide whether to require it.
Claude Opus 4.8 fast mode ends 30 November, plus a cost API
Anthropic's API release notes deprecate fast mode for claude-opus-4-8 and remove it on 30 November 2026. After that, requests with speed: "fast" to that model return an error, and to keep fast mode, Anthropic says to migrate to Claude Opus 5.5. Search your code for speed: "fast" now, because the failure will be a production error, not a warning.
The same notes list a Usage and Cost Analytics API in beta from 29 October, behind the analytics-usage-cost-2026-08-24 header. It serves /v1/organizations/analytics/usage and /cost for Console and Enterprise organizations, grouped by model, workspace, API key or user. Our view: if each team has its own workspace, grouping by workspace is enough for per-team chargeback.
Verdict: plan for it. Fix the fast-mode calls before the end of the month.
Next.js ships seven medium fixes on 3 November, and Vercel starts billing Data Cache
The Next.js blog says a scheduled security release lands Tuesday 3 November, fixing seven medium vulnerabilities. Book a slot on 3-4 November. Last time's context is in September's Next.js advisories.
Separately, Vercel's changelog says Data Cache becomes Runtime Cache, and reads and writes that were free are now billed, from $0.40 per million read units and $4.00 per million write units, varying by region. Hobby teams get 1 million reads and 200,000 writes free a month. Pro usage draws from the $20 infrastructure credit. Hobby teams migrate on 29 November, Pro teams get notified of their date, and teams created from 30 October get Runtime Cache by default. Existing Hobby and Pro teams can opt in early from CDN settings, at which point pricing applies.
Verdict: plan for it if you run Next.js on Vercel with fetch caching or unstable_cache. Ignore the billing change otherwise.
What this means for your patch calendar and platform bill
Give each item one owner, not a project. One person takes the kernel and Ivanti patches, and checks for prior compromise first because CISA marks both for forensic triage. One person owns GitLab, including Runner, rebuilt CI images and the AI Gateway. One books the Next.js upgrade for 3-4 November.
Then put two dates on the calendar with named owners: Vercel's Hobby migration on 29 November and the end of Opus 4.8 fast mode on 30 November. Our view: the cost dates are the ones that slip.
More weekly changes and what to do about them are in our platform and tech news hub.
FAQ
Does the CISA deadline apply to my company?
CISA sets these due dates in the catalog. The catalog tells organizations to use it as an input to their vulnerability management prioritization, and the flaws are exploited either way, so patch soon on your own schedule.
Does upgrading GitLab fix the eMudhra trust on my CI runners?
No. You also need GitLab Runner 19.5.1, and any CI job images that include their own ca-certificates package must be rebuilt.
What happens to Opus 4.8 fast mode requests after 30 November?
Requests to claude-opus-4-8 with speed: "fast" return an error. To keep fast mode, Anthropic says to migrate to Claude Opus 5.5.