Executive assessment
Today's brief leads with Multiple vulnerabilities in Perl DBI module. All 4 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 02 leads today because it is critical, CVSS 10.0, unauthenticated RCE, and the only finding with exploitation confirmed in the wild. Patch order: Finding 02 (Critical CVSS 10.0 unauthenticated RCE is being exploited in the wild; Bricksforge 3.1.8.10 or newer is fixed, with Patchstack RapidMitigate listed if patching is delayed); Finding 01 (Critical Perl DBI vulnerabilities have proof-of-concept exploitation noted; no fixed version is listed, so the provided DBI input restrictions are the immediate control); Finding 03 (Critical GitLab CE and EE vulnerability, but exploitation status, fixed version and controls are not provided in the listing).
Finding 01 — Multiple vulnerabilities in Perl DBI module
What changed: Harsh Raj Singhania discovered that the Perl DBI module did not correctly validate certain attributes. An attacker could possibly use this issue to execute arbitrary code.
Technical evidence: CVE-2026-78030; CVSS v3.1 9.8; weakness CWE-470; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patched, prevent less-trusted inputs from controlling DBI DSN fragments or the dbm_type and dbm_mldbm attributes. Reject non-string FetchHashKeyName values before running hashref-fetching methods. ([github.com](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7), [github.com](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-f4qx-mr9m-q2hq), [ubuntu.com](https://ubuntu.com/security/notices/USN-8912-1.json))
Affected: Upstream DBI versions through 1.652 are affected by CVE-2026-78030; versions through 1.653 are affected by CVE-2026-88816. ([github.com](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7), [github.com](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-f4qx-mr9m-q2hq))
Fix: Patched versions 1.653; Patched versions 1.654; "resolute":[{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"; "noble":[{"name":"libdbi-perl","version":"1.643-4ubuntu0.4". ([github.com](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7), [github.com](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-f4qx-mr9m-q2hq), [ubuntu.com](https://ubuntu.com/security/notices/USN-8912-1.json))
Panel assessment: Patch now wherever Perl DBI is present, prioritising internet-facing services, job runners, and shared application platforms, because the critical issue can become code execution when lower-trust input reaches DBI attributes and the companion flaw has a reliable crash path. (priority: patch now)
Action: Map CVE-2026-78030 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8912-1)
Finding 02 — Bricksforge: Unrestricted Upload of File with Dangerous Type
What changed: Patchstack reports active exploitation of CVE-2026-85097, a maximum-severity Bricksforge plugin flaw that allows unauthenticated attackers to upload and execute arbitrary PHP on vulnerable WordPress sites. This remains a single-source developing item pending authoritative corroboration.
Technical evidence: CVE-2026-85097; CVSS v3.1 9.8; weakness CWE-434; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching is delayed, deploy Patchstack’s RapidMitigate rule for CVE-2026-85097 to block exploitation attempts at the traffic layer. Monitor requests to /wp-json/bricksforge/v1/form_submit containing temporaryFileUploads and inspect upload directories for unexpected PHP files. Patchstack reports active exploitation attempts targeting Bricksforge installations, first observed on 7 October 2026 at 21:47 UTC. ([patchstack.com](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/), [wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bricksforge/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter))
Affected: Bricksforge versions up to and including 3.1.8.9. ([wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bricksforge/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter))
Fix: Bricksforge 3.1.8.10 or a newer patched version. ([wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bricksforge/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter))
Action: Map CVE-2026-85097 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html)
Finding 03 — 2026-016: Critical Vulnerability in GitLab CE and EE
What changed: CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances. CVE coverage: CVE-2026-97229, CVE-2026-92883, CVE-2026-16301.
Technical evidence: CVE-2026-97229; CVSS v3.1 10; weakness CWE-190; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Affected: Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. ([docs.gitlab.com](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/))
Fix: On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE); These versions contain important bug and security fixes ([docs.gitlab.com](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/))
Action: Map CVE-2026-97229 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cert.europa.eu](https://cert.europa.eu/publications/security-advisories/2026-016/)
Finding 04 — Multiple vulnerabilities in libx11
What changed: Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard map replies. If a user were tricked into connecting to a malicious X server, a remote attacker could possibly use this issue to cause libx11 to crash, resulting in a denial of service, or possibly execute arbitrary code.
Technical evidence: CVE-2026-88806; CVSS v3.1 7.5; weakness CWE-122; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-88806 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8913-1)