// day
Oct 21, 2026
4 new incidents, 7 with updates.
## started
- criticallivepatchedsince Oct 21, 2026
GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
› GitLab CE/EE (self-managed)
GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
CVE-2026-110264 - criticallivepatchedsince Oct 21, 2026
LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
› LiteLLM (PyPI + official Docker/GHCR images)
On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.
MAL-2026-2144 - highlivepatchedsince Oct 21, 2026
Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)
› Node.js
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
CVE-2026-111497CVE-2026-105482CVE-2026-105483CVE-2026-106069+6 more - highlivepartial fixsince Oct 21, 2026
Railway discloses unauthorized access to customer environment variables
› Railway (hosted platform)
On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.
## updated
- criticallivepartial fixsince Oct 17, 2026
ConnectWise Cloud Backup shut down after M365 app-identity hijack
› ConnectWise Cloud Backup / Microsoft 365 app identity
ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.
- criticallivepartial fixsince Oct 18, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
CVE-2026-111943CVE-2026-91403 - criticalliveunpatchedsince Feb 19, 2025
Fearless Wallet browser extension leaked private keys for ~20 months
› Fearless Wallet browser extension (Chrome; Firefox build delisted)
The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.
- mediumclosedpatchedclosed Oct 14, 2026
nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)
› nginx
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
CVE-2026-15176CVE-2026-93479CVE-2026-95101CVE-2026-97629+1 more - criticallivepartial fixsince Oct 17, 2026
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
CVE-2026-109618CVE-2026-109619 - highlivepartial fixsince Sep 9, 2026
PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken
› PingCAP TiDB Cloud (hosted database platform)
PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.
- criticallivepatchedsince Oct 16, 2026
Plex2Shell: chained Plex Media Server RCE exploited for miners
› Plex Media Server
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656
