IT News Today: CISA Flags Flaws, Apple M6 (Oct 29, 2026)

Critical vulnerabilities top the list

The biggest IT story today is a wave of urgent patching orders from the US Cybersecurity and Infrastructure Security Agency (CISA). On October 27, CISA added CVE-2026-111497 — nicknamed "Node2Shell" — to its Known Exploited Vulnerabilities (KEV) catalog. The bug is an out-of-bounds write flaw in Google's Brotli compression library, affecting versions 1.0.3 through 1.2.0. Honeypot operators Previdian and ELLIO had already logged real-world exploitation attempts before CISA's listing. Federal agencies now have until November 10 to remediate, but any organization running affected Brotli versions should treat this as a priority since Brotli is widely embedded in web servers and browsers.

A day earlier, CISA also flagged two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both allowing unauthenticated remote code execution. Site operators are urged to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Given how much of the web still runs on PHP, this is a significant exposure for businesses and hosting providers alike.

GitLab's rough October continues

GitLab had to issue its second maximum-severity (CVSS 10.0) patch this month. On October 21, the company shipped an out-of-band fix for CVE-2026-110264, an integer overflow in its regex engine that affects every self-managed GitLab release dating back to 2014. This comes just ten days after a related CVSS-10.0 flaw, CVE-2026-97229, was patched in the same component. Teams running self-managed GitLab instances should check their patch status immediately — these are the kind of bugs attackers actively hunt for.

Apple's "Pro and Tell" event ships new M6 hardware

On a brighter note, Apple held its "Pro and Tell" event in Los Angeles on October 28, unveiling a new 14-inch MacBook Pro and an updated iMac, both powered by the new M6 chip. Apple claims the M6 MacBook Pro delivers up to 13 times faster LLM prompt processing compared to the original M1 model, along with 24-hour battery life and Wi-Fi 7 support. Preorders are open now, with shipping starting November 6. For developers and AI workloads on the Mac, the local inference speed boost is the headline upgrade.

Cloud infrastructure: new links, but also outages

AWS and Google Cloud jointly launched a new multicloud interconnect service, combining AWS Interconnect-multicloud with Google Cloud's Cross-Cloud Interconnect. The service lets businesses set up private, high-bandwidth links between the two clouds in minutes rather than weeks — Salesforce is named as an early adopter. This matters for enterprises running workloads split across providers, since it removes a major networking bottleneck.

Elsewhere, reliability had a rough few days. Cloudflare suffered a roughly 90-minute outage affecting Durable Objects in Eastern North America, with knock-on effects on D1, Queues and Workflows. Separately, AWS reported regional disruptions in Bahrain (me-south-1) and the UAE (me-central-1) around October 27–28, though the remaining 30 of its 32 regions, plus all 59 Azure regions, stayed operational throughout.

Why it matters

Today's roundup is a reminder that security patching cycles keep accelerating — three separate KEV-level bugs across compression libraries, PHP, and GitLab in a single week — while hardware and cloud providers push ahead with new capabilities despite occasional outages.