--- title: October 21, 2026: PHP, Node.js, GitLab, LiteLLM and a... description: A cluster of major security incidents hit on October 21, 2026, dubbed 'Black October.' PHP has two critical unauthenticated RCE bugs rated 9.2 with active... canonical: https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: October 21, 2026: PHP, Node.js, GitLab, LiteLLM and a long list of other security incidents | daily.dev og:description: A cluster of major security incidents hit on October 21, 2026, dubbed 'Black October.' PHP has two critical unauthenticated RCE bugs rated 9.2 with active... og:url: https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v og:image: https://api.daily.dev/og/posts/BOE6qm91v.png og:image:alt: October 21, 2026: PHP, Node.js, GitLab, LiteLLM and a long list of other security incidents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # October 21, 2026: PHP, Node.js, GitLab, LiteLLM and a long list of other security incidents **[Collections](https://daily.dev/sources/collections)** · 6 min read · 2 upvotes · 0 comments ## Summary A cluster of major security incidents hit on October 21, 2026, dubbed 'Black October.' PHP has two critical unauthenticated RCE bugs rated 9.2 with active exploit traffic, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. GitLab's CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE reportedly affecting versions back to 7.0, fixed in 19.5.1, 19.4.3 and 19.3.6. Node.js fixed a Brotli decoder RCE and TLS bypasses in 22.23.4, 24.22.1 and 26.12.1. LiteLLM 1.107.0 reportedly shipped credential-stealing malware via PyPI and Docker for about two hours, reportedly stealing cloud keys, SSH keys and browser passwords. Other items include Oracle's 1,295-patch CPU, a Next.js RCE fix, eMudhra's compromised CA keys, and breaches at Railway, ConnectWise and TiDB Cloud. ## Content October 21, 2026 was an ugly day for security. Critical bugs, supply-chain malware, a certificate authority failure and several cloud breaches all surfaced within hours of each other. Some people started calling it "Black October." @GergelyOrosz said he couldn't remember a single day with so many critical breaches and disclosures hitting so many sites, companies and users. He also pointed out that the two big AI labs, Anthropic especially, have been warning about this kind of thing since the Mythos announcement. ## The biggest one: PHP Two critical unauthenticated remote code execution bugs (PHP2Shell) hit PHP. Details became public before patches were ready. Cloudflare reported exploit traffic, and the NSA and FBI urged patching. Agencies in the US, Japan and Europe advised taking systems offline as a precaution. Government sites, a major European port's systems, parts of Wikipedia-related infrastructure, pixiv and the Internet Archive went down or into maintenance mode. One account put the attack attempts at millions within hours. Another said the first patch may be incomplete. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or your vendor's security backport. Internet-facing systems come first. ## Supply chain and developer tooling - **LiteLLM:** v1.107.0 shipped credential-stealing malware through PyPI and official Docker images, including mutable tags. It steals cloud keys, SSH keys, browser passwords and AI tokens, and it ran on install even if you never imported the library. It was live for roughly two hours. If you ran it, treat the environment as compromised: isolate it, rebuild clean, move to 1.106.2, and rotate every credential it could reach. A downgrade alone doesn't clean anything up. - **Rank Math PRO:** some copies of v3.0.123, distributed October 15-16, contained malware. Install v3.0.124 or restore from a clean backup, and rotate credentials. Updating or deactivating the plugin doesn't remove persistence. The free edition wasn't affected. - **Node.js:** security releases fix a Brotli RCE, TLS hostname-validation bypasses and other issues. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. - **Next.js / React:** the October 14 update fixes two critical RCEs. Upgrade to 15.5.28 or 16.4.1 or later, then rebuild and redeploy. - **GitLab:** CVE-2026-110264, CVSS 10.0, an unauthenticated RCE in self-managed servers reaching back to version 7.0 from 2014. Fixed in 19.5.1, 19.4.3 and 19.3.6, with backports for older branches. Check again even if you patched last week. - **OpenCode Console:** reportedly leaked users' API keys, affecting about 1.4% of users. ## Cloud platforms and breaches - **Railway:** possible unauthorized access to encrypted customer environment variables, with decrypted contents exposed for some. Everyone is being told to rotate API keys, database credentials and registry credentials. At the last update builds and deployments were paused, which meant customers couldn't ship replacement credentials. - **TiDB Cloud / PingCAP:** stolen service-account credentials were used to copy source code, customer-related records and encrypted API-key values. PingCAP says it found no evidence that stored customer database data was affected, and advises replacing management API keys. One account claims 10.6 TB was stolen, with about 50,000 records in Japan affected. - **ConnectWise Cloud Backup / SkyKick:** compromised application credentials gave access to customer Microsoft 365 tenants, and attackers created extra application secrets for persistence. Microsoft reportedly tied it to a China-aligned group using an AI tool against 2,250+ tenants. Keep affected connections disabled until the vendor gives reconnection instructions. - **State Bank of India:** confirmed that data on 3,897 customers leaked to the dark web. ## Trust infrastructure - **eMudhra:** private keys for eight intermediate CA certificates were compromised, and the keys were reportedly weak enough to crack in seconds. Security professionals described the cleanup as bigger than Heartbleed. Mozilla, Google, Apple and Microsoft are deploying distrust measures. Update browsers, operating systems and runtimes, and check custom trust stores, container images and server-side apps. - **GoDaddy:** revoked incorrectly issued SSL certificates after a certificate-profile bug. A replacement sitting in the dashboard does nothing until it's installed on the live server. ## Actively exploited products and big patch drops - **Plex:** active exploitation of the Plex2Shell chain, with cryptominers and proxy software deployed. Update to 1.43.3.10861 or later and inspect exposed hosts, since patching won't remove malware already there. - **BeyondTrust Remote Support:** CVE-2026-102764 went into CISA's KEV catalog on October 16. BeyondTrust links targeted attacks to a suspected China-nexus campaign, with exploitation going back to August. - **Ivanti Connect Secure:** CVE-2026-104935 was added to KEV on October 13 after confirmed exploitation as part of a chain for RCE, credential theft and data exfiltration. - **Siemens Software Center:** a DLL-sideloading flaw is being used in a ClickFix campaign. Update to 4.0.9.8. Siemens reports no sign its distribution channel was compromised. - **SiteGuard Server Edition:** CVE-2026-106931 is an exploited command injection that gives a low-privileged local user root or SYSTEM. Preserve diagnostics before updating, because the update can remove attack traces. - **Microsoft QUIC / .NET:** CVE-2026-105016, CVSS 9.8, unauthenticated RCE on affected Windows .NET deployments. Apply the .NET and MsQuic updates and redeploy self-contained apps. - **Cisco:** Expressway has a CVSS 9.8 root RCE in clustered deployments (update to X15.5.20, no workaround). Snort 3 and Secure Firewall have several critical fixes. Cisco reports no known exploitation for either. - **Oracle:** the October CPU has 1,295 patches, including CVE-2026-101809 in E-Business Suite Workflow (CVSS 10.0, no credentials needed). A separate alert covers CVE-2026-91403, a CVSS 9.1 JSSE issue in Java and GraalVM. - **Chrome 156:** 353 security fixes, six rated critical. Update and relaunch. ## AI on the attack side One report says a hacking group used AI agents to plan and run attacks on more than 400 Latin American banks with little human involvement. Combined with the Microsoft 365 campaign, it adds to the worry that attackers are now working at machine speed. ## The pattern Keys in repos. Keys in environment variables. Keys in packages. Keys generated by a broken script. None of this took a genius. ## What to do 1. Prioritize internet-facing systems and anything with confirmed exploitation. 2. Preserve evidence before patching. 3. Patch and redeploy, then verify the fix is actually live. 4. Rebuild compromised environments rather than cleaning them. 5. Revoke and rotate exposed secrets, and pin dependency versions. ## Markets noticed The fallout reached markets the next morning. US futures were lower, tech was under pressure, and SK Hynix fell about 5.5% and Samsung 4% in Korea. A market commentator, @RektMkts, attributed much of the nervousness to the cyber scare, though not the whole sell-off. Bitcoin fell roughly 1.9% over 24 hours. Separately, PulseChain's community noted its base chain wasn't affected, since validators run Go-based blockchain clients rather than PHP, Node.js or GitLab. They did concede that front-end sites and third-party tools built on top could use vulnerable components. My read: the sheer length of the list is the story. Several of these will touch most teams, so check your own exposure today. ## Questions this post answers ### What PHP versions fix the PHP2Shell remote code execution vulnerability? Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install your vendor's security backport. The flaw involves two critical unauthenticated remote code execution bugs rated 9.2, with Cloudflare already observing exploit traffic in the wild. The NSA and FBI urged immediate patching, and internet-facing systems should be prioritized. _Teams tracking critical PHP CVEs and patch timelines follow release coverage like this on daily.dev._ ### What happened with the LiteLLM 1.107.0 supply chain attack? LiteLLM version 1.107.0 shipped credential-stealing malware through PyPI and official Docker images, including commonly used mutable tags, for about two hours before removal. It stole cloud keys (AWS, Azure, Google Cloud), SSH keys, browser passwords and AI tokens, and executed on install even without being imported. Anyone who ran it should isolate, rebuild clean on 1.106.2, and rotate all reachable credentials. _Developers vetting dependencies after supply chain scares like this keep watch via daily.dev._ ### What is the GitLab CVE-2026-110264 vulnerability and which versions fix it? CVE-2026-110264 is an unauthenticated remote code execution flaw in GitLab rated CVSS 10.0, reportedly affecting versions going back to 7.0 from 2014. Fixed releases include 19.5.1, 19.4.3 and 19.3.6, with backports for older branches. Self-managed operators must apply the update themselves, and re-checking is advised even after a recent patch. _Self-managed GitLab operators tracking critical patches like this rely on daily.dev to stay current._ ## Community take How the wider developer community reacted, aggregated from 5 discussions and 74 comments across x (as of 2026-10-22). **TL;DR:** The reaction is mostly alarm at the sheer density of incidents hitting in a single day, with pointed criticism of the PHP Foundation's slow patch timeline and broad anxiety that AI-accelerated vulnerability discovery is outpacing defenders' ability to patch. **Sentiment:** 5% positive · 30% mixed · 65% skeptical **The case for** - A few see a silver lining that the shock could force better security hygiene and faster patching culture going forward. - AI tools are seen by some as making patching and triage easier once a problem is identified. **The pushback** - The PHP vulnerability was reportedly known for months yet took far too long to fix, seen as bad PR for the PHP Foundation. - Attackers are perceived to now operate at 'agent speed' while patch pipelines still move through slow human review and release processes. - Concern that disclosure norms (like 90-day windows) and patch coordination are outdated given how fast exploits can now be found and chained. - Worry that small teams and legacy web businesses are unprepared for rapid rotation/remediation work this scale of incident demands. - A state-linked group reportedly used an AI pentest framework against many organizations via already-authorized app access, raising broader fear. **By community** - x (skeptical): Replies express alarm and frustration at the volume and speed of incidents, with direct criticism of slow PHP patching and fear that AI is tilting the balance toward attackers. **Hottest debate:** Whether this wave of incidents reflects AI making vulnerability discovery (and exploitation) faster, or is simply overdue old bugs surfacing at once, with no consensus on which factor dominates. **Open questions** - Who, if anyone, should coordinate disclosure timing so multiple critical patches don't land simultaneously? - Can patch pipelines and review processes realistically be sped up to match attacker tooling speed? - Is the apparent spike in breaches due to more vulnerabilities being created, or more being found by AI-assisted scanning? **Highlights** > @GergelyOrosz The PHP security issues was known since mid summer, apparently. Only tool them months to fix it and it wasn't until the last 2 days that exploits became public. Awful PR for the PHP Foundation. > — [Cwaabuki on x · 5 points, 1 comments](https://x.com/Cwaabuki/status/2113191979861299286) > @GergelyOrosz Apparently, many of the controversial things Dario takes are aging well. What's next? open weight models turning out to be dangerous > — [thanveersiddiq on x · 1 points](https://x.com/thanveersiddiq/status/2113213636474982440) > @GergelyOrosz the scary part isn't any single breach, it's that finding bugs got cheap way faster than fixing them did. attackers are on agent time now, defenders still ship patches through human review and release trains. patch pipelines need agents too, not just more advisories. > — [ElioJackee on x](https://x.com/ElioJackee/status/2113213430475981042) > @GergelyOrosz Quick triage for today's pile: pip show litellm | grep Version, and if you ever had 1.107.0 rotate every cloud and SSH key from a clean machine, uninstalling isn't enough. Then node -v on every box, anything 20.x is EOL and won't get the Brotli fix. > — [tuffbrownboy on x](https://x.com/tuffbrownboy/status/2113199453075321095) > @GergelyOrosz Seems to me the disclosure process needs improving, I know these things can’t wait but timing things so multiple go out together wasn’t optimal. Who would coordinate it though? > — [daviddlow on x](https://x.com/daviddlow/status/2113192086430199918) **Source threads** - [x](https://x.com/Ashutosh_Sidh/status/2113033638589952261) · 4 points · 4 comments - [x](https://x.com/GergelyOrosz/status/2113174434622366205) · 0 points · 64 comments - [x](https://x.com/GergelyOrosz/status/2113174292435489092) · 0 points · 0 comments - [x](https://x.com/Thom_Wolf/status/2113189482329743475) · 0 points · 0 comments - [x](https://x.com/HexJamHex/status/2113147239195611344) · 16 points · 6 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"October 21, 2026: PHP, Node.js, GitLab, LiteLLM and a long list of other security incidents","url":"https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v"},"datePublished":"2026-10-22T06:28:48.862Z","dateModified":"2026-10-22T12:55:14.439Z","description":"A cluster of major security incidents hit on October 21, 2026, dubbed 'Black October.' PHP has two critical unauthenticated RCE bugs rated 9.2 with active...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,nodejs,php","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"October 21, 2026: PHP, Node.js, GitLab, LiteLLM and a long list of other security incidents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/october-21-2026-php-node-js-gitlab-litellm-and-a-long-list-of-other-security-incidents-boe6qm91v#faq","mainEntity":[{"@type":"Question","name":"What PHP versions fix the PHP2Shell remote code execution vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install your vendor's security backport. The flaw involves two critical unauthenticated remote code execution bugs rated 9.2, with Cloudflare already observing exploit traffic in the wild. The NSA and FBI urged immediate patching, and internet-facing systems should be prioritized. Teams tracking critical PHP CVEs and patch timelines follow release coverage like this on daily.dev."}},{"@type":"Question","name":"What happened with the LiteLLM 1.107.0 supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"LiteLLM version 1.107.0 shipped credential-stealing malware through PyPI and official Docker images, including commonly used mutable tags, for about two hours before removal. It stole cloud keys (AWS, Azure, Google Cloud), SSH keys, browser passwords and AI tokens, and executed on install even without being imported. Anyone who ran it should isolate, rebuild clean on 1.106.2, and rotate all reachable credentials. Developers vetting dependencies after supply chain scares like this keep watch via daily.dev."}},{"@type":"Question","name":"What is the GitLab CVE-2026-110264 vulnerability and which versions fix it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-110264 is an unauthenticated remote code execution flaw in GitLab rated CVSS 10.0, reportedly affecting versions going back to 7.0 from 2014. Fixed releases include 19.5.1, 19.4.3 and 19.3.6, with backports for older branches. Self-managed operators must apply the update themselves, and re-checking is advised even after a recent patch. Self-managed GitLab operators tracking critical patches like this rely on daily.dev to stay current."}}]} ```