Firewall Down, CI/CD Cracked: The Two Vulnerabilities UK Small Businesses Need to Patch Right Now
Two vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalogue on the 29th of October 2026. One can crash your firewall and kill your VPN. The other can hand an unauthenticated attacker full code execution on your software development server. Neither requires a password to trigger.
This is the threat intelligence picture as of today, the 30th of October 2026. Let’s go through what the data actually shows.
The Two Stories That Matter This Week
The CISA KEV catalogue is not a vendor advisory. It is not a researcher’s blog post. It is a list of vulnerabilities with confirmed active exploitation in the wild, maintained by the US Cybersecurity and Infrastructure Security Agency. When something lands on that list, attackers are already using it. The debate about whether to patch is over.
Yesterday, two entries were added.
CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure Firewall FTD Software. The vulnerability is an unchecked return value leading to a null pointer dereference. In plain terms: an unauthenticated, remote attacker can send crafted traffic to the device and cause it to reload unexpectedly, producing a denial-of-service condition. Your firewall goes down. Your VPN terminates. Whatever network perimeter you had built around your business ceases to function until the device recovers or is manually restarted.
For a small business running Cisco ASA as its primary network edge, this is not a theoretical inconvenience. It is a window of exposure. And if the attacker’s goal is not just disruption but access, that window is exactly what they need.
CVE-2026-97229 affects GitLab Community Edition and Enterprise Edition. This one is worse in a different way. It is an integer overflow vulnerability in GitLab’s regular expression handling within CI/CD pipeline configurations. An unauthenticated attacker can craft a malicious regular expression in a CI/CD configuration and use it to execute arbitrary code on the GitLab server itself.
CI/CD stands for Continuous Integration and Continuous Deployment. It is the automated pipeline that takes code from developers, tests it, and deploys it to live systems. If an attacker owns your GitLab server, they are positioned inside your software supply chain. They can modify code before it ships. They can access credentials stored in pipeline variables. They can pivot to any system the pipeline touches.
For small businesses that self-host GitLab, or whose managed service provider does so on their behalf, this is a direct, confirmed, active threat.
What “Actively Exploited” Actually Means
The phrase gets used loosely in vendor marketing. CISA’s use of it is precise.
For a vulnerability to appear on the KEV catalogue, CISA requires evidence that exploitation has occurred in real-world attacks against real organisations. It is not enough for a proof-of-concept exploit to exist. It is not enough for a researcher to demonstrate the technique in a lab. Someone, somewhere, has already used these vulnerabilities against a target.
Both CVE-2026-76418 and CVE-2026-97229 met that bar as of the 29th of October 2026.
The required action for both is the same: apply vendor mitigations in accordance with vendor instructions, following CISA’s BOD 26-04 guidance. If mitigations are unavailable, the guidance is explicit: discontinue use of the product.
That last clause is worth reading twice. CISA is saying that if you cannot patch, you should stop running the software. For a firewall, that means your network architecture needs to be reconsidered. For a GitLab instance, that means your development pipeline needs an alternative until the patch is applied.
Why UK Small Businesses Should Care About a US Advisory
A reasonable question. CISA is a US government agency. BOD 26-04 is binding only on US federal agencies. So why does this matter to a 15-person accountancy firm in Leeds or a 30-person manufacturer in the West Midlands?
Because the vulnerabilities are not geographically bounded. The attackers exploiting CVE-2026-76418 and CVE-2026-97229 are not restricting themselves to US targets. Cisco ASA appliances and self-hosted GitLab instances exist in UK small and medium businesses, in UK managed service providers, and in UK cloud environments. The KEV catalogue is the most reliable, publicly available signal that exploitation is occurring. It should inform patch prioritisation regardless of where you are.
Your MSP almost certainly uses US-sourced threat intelligence. If they are not already prioritising these two, ask them why.
The Wider Noise This Week
Beyond the two KEV entries, this week produced a significant volume of critical-severity vulnerability disclosures. Several are worth registering even if they do not affect most small businesses directly.
Four critical vulnerabilities were published against IBM Langflow OSS between the 1.0.0 and 1.12.x release lines on the 29th of October 2026. Three of them received CVSS scores of 9.8 or 9.9. The vulnerabilities allow remote code execution, in some cases by authenticated users and in others by unauthenticated attackers, due to missing authorisation controls and improper handling of code generation. Langflow is an open-source AI workflow builder. If you are running AI automation tooling in your business, particularly self-hosted instances, the version numbers matter.
A flaw in the Linux kernel’s TCP handling, tracked as CVE-2026-98432, received a 9.8 CVSS score and affects Ubuntu and Red Hat Enterprise Linux distributions, among others. The flaw involves a use-after-free condition in the MPTCP implementation. Researchers reported it could be exploited to run commands as root on affected servers. Ubuntu and RHEL had not yet shipped fixes as of reporting. If you run Linux servers, this needs to be on your patch watch list.
Mozilla Firefox 159, published on the 27th of October 2026, fixed 167 security vulnerabilities across the browser, including 108 rated High severity. Firefox updates automatically by default, but if you have disabled automatic updates, or if your staff are running Firefox on unmanaged devices, the version number to check for is 159 or later.
A flaw in Telegram for Android, CVE-2026-111105, allowed an attacker to execute code on a victim’s device simply by placing a voice call through the application once the victim answered. The attacker needed only an ordinary Telegram account. The flaw was fixed in Telegram version 12.10.4. If your staff use Telegram for business communication on Android devices, confirm the app is up to date.
None of these made the KEV list as of this writing. They are flagged here as context. The two KEV entries remain the immediate priority.
How This Becomes a Supply Chain Problem
Small businesses frequently sit in supply chains that connect to larger organisations. Your customer contracts may include security expectations. Your MSP’s security posture affects your own exposure. Your software development pipeline, if you have one, may produce code that runs in a client’s environment.
The GitLab vulnerability illustrates why supply chain hygiene matters. If an attacker compromises a GitLab instance used to build software that ships to clients, the attacker has a potential route into every one of those client environments. The initial target may be a ten-person development shop. The downstream impact may reach considerably further.
For businesses that do not write software themselves, the question is still relevant. Ask your software vendors and your MSP whether they use GitLab for their own development and operations. Ask what version they are running. If they cannot answer that question promptly, that is information worth having.
Why This Is an Edge Case Worth Watching on AI Security
The Langflow CVEs deserve a brief aside because they represent a category that will become more common. Langflow is a tool for building AI-powered workflows, the kind of automation that connects language models to business processes. As small businesses adopt AI tooling, they will increasingly run components that they do not fully understand, including self-hosted AI infrastructure with its own vulnerability surface.
Four critical-severity CVEs published in a single day against a single AI workflow tool is not a catastrophic aberration. It is a preview of a pattern. The attack surface of AI tooling is not yet well understood by most small business owners, and the patch hygiene around it is likely to lag behind traditional software. The CVSS scores here, 9.8 and 9.9, are not vendor inflation. They reflect the actual impact of remote code execution on a business-critical system.
If you are deploying AI tooling in your business, the same patch discipline applies as to any other software. Someone needs to own the update process, and it needs to happen on a defined schedule.
How to Use This as a Differentiator
There is a straightforward competitive angle here for any business that handles client data or operates within a supply chain.
Being able to demonstrate that you monitor CISA’s Known Exploited Vulnerabilities catalogue, that you have a defined patch response process, and that you apply critical patches within a documented timeframe is a verifiable security posture. It is not compliance theatre. It is evidence that your security programme responds to real-world threat signals rather than annual checkbox exercises.
In procurement conversations, particularly with public sector clients or larger organisations that carry out supplier due diligence, this kind of specificity is increasingly expected. The businesses that can say “we track KEV entries and our SLA for applying critical patches is 48 hours” are differentiating themselves from those that say “we take security seriously.”
Making the Business Case
Three points that will land with a board or a budget holder:
First: unpatched firewalls are an insurance liability. Cyber insurance policies increasingly include patch management clauses. An actively exploited vulnerability with a public advisory, CISA listing, and vendor-issued patch, left unmitigated, is exactly the kind of fact that will appear in a claims investigation. If you are running Cisco ASA or FTD and you are not patched before an incident, your insurer will ask when you became aware of CVE-2026-76418. The answer “the 29th of October 2026” is available to them.
Second: the cost of a patching programme is calculable. The cost of a breach is not. An MSP applying critical patches within 48 hours costs a defined monthly fee. A ransomware incident originating from an unpatched GitLab server costs an undefined multiple of that, plus ICO notification obligations, plus client notification, plus reputational impact. One of these numbers is on your invoice. The other is not predictable.
Third: supply chain security is now a client expectation, not a differentiator. Clients, particularly those in regulated sectors, are increasingly asking about their suppliers’ security posture. Being unable to answer basic questions about patch management and vulnerability response is a commercial risk, not just a security one.
What to Do Before the End of the Week
One: establish whether CVE-2026-76418 affects you. If you run Cisco Secure Firewall ASA or FTD software, directly or through a managed service, contact your provider today and ask what version is running and whether the patch has been applied. Get the answer in writing. If the patch has not been applied, ask for a timeline. If the timeline is more than 48 hours, ask what compensating controls are in place in the interim.
Two: establish whether CVE-2026-97229 affects you. If you self-host GitLab, or if your MSP does on your behalf, check the version number against Cisco’s and GitLab’s published advisories and apply the patch. If you use GitLab’s cloud-hosted service rather than a self-hosted instance, check GitLab’s status page for confirmation that the hosted service has been patched.
Three: update Firefox on all managed devices. Confirm that Firefox 159 or later is running on any device where Firefox is in use. If automatic updates are enabled and the device has been online since the 27th of October 2026, this should already be the case. Verify rather than assume.
Four: check Telegram on staff Android devices. If Telegram is used for business communication, confirm that version 12.10.4 or later is installed. This takes two minutes per device.
Five: add CISA’s KEV catalogue to your threat monitoring. The catalogue is publicly available at no cost. Either bookmark it yourself, or ask your MSP to confirm that they are monitoring it and how quickly they act on new entries relevant to your environment. The answer to that question is a reasonable proxy for your MSP’s overall patch discipline.
The data is clear. Two vulnerabilities with confirmed active exploitation. Both unauthenticated. Both with vendor patches available. The question is not whether to act. The question is how quickly.
Before you go: follow the show wherever you listen, and if you found this useful, leave a rating or a review. It takes 30 seconds and it helps other small business owners find the content. Drop a comment with your questions or your own experience of managing patches in a small business, and share the episode with someone who runs a business and has not yet thought seriously about their firewall version number.