Two due dates were today

Two clocks ran out today. Neither is a Japanese member file.

CISA put GitLab Community and Enterprise CVE-2026-97229 on the exploited list on 29 October and set today as the federal due date. Integer overflow in how a CI configuration’s regular expression is checked. Unauthenticated. Code execution on the GitLab server. The directive also wants a look at whether the box was used before the patch, not only that the patch is on.

The other due date today is Cisco Secure Firewall ASA and FTD CVE-2026-76418: an unchecked return that can take the appliance down from the network, no login. A crash is not a theft of sessions. It is still a due date.

Ivanti Connect Secure has two new rows from Friday. CVE-2026-111357, missing authentication for a critical function, is due tomorrow and also wants the look-back. CVE-2026-118527, predictable identifiers, is due 13 November. CISA says they chain with an older Connect Secure row. That is a VPN sentence, not a member count.

What two due dates will be asked to cover

It will be briefed as every GitLab on earth already owned, and as every Cisco firewall emptied. One is a CI regex that needs a forensic pass. One is a crash. Ivanti is tomorrow. A still-green pipeline is evidence about today’s build. It is not a finding that the regex never ran.

If you run GitLab on the public internet, the patch and the look-back are the incident. If you run ASA or FTD, the crash is the incident. A “support” mail that already knows the CVE and asks for a config dump is not CISA.

Two due dates were today. The look-back is the part people skip.