{"generatedAt":"2026-10-22T08:41:58.324Z","reviewedAt":"2026-10-22T05:05:00Z","source":"curated","windowStart":"2026-10-20T20:41:58.324Z","windowHours":36,"advisories":[{"id":"php","product":"PHP","title":"PHP2Shell: unauthenticated remote code execution","severity":"critical","kind":"Vulnerability","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Two PHP core flaws affect installations serving web requests. Apache mod_php has the highest reported risk; PHP-FPM and other web SAPIs also need attention.","applies":"PHP web workloads, including containers and bundled runtimes. A missing CLI binary does not rule out a running web service.","action":"Use your vendor’s patched package or a fixed upstream branch. Confirm backports before comparing versions. Restart affected workers with approval and verify the running service.","versions":"8.5.12 · 8.4.27 · 8.3.36 · 8.2.35","source":"https://www.php.net/archive/2026.php#2026-10-21-1","sourceLabel":"PHP security team","cves":["CVE-2026-109618","CVE-2026-109619"],"curated":true},{"id":"gitlab","product":"GitLab","title":"Critical RCE in self-managed GitLab","severity":"critical","kind":"Vulnerability","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"An integer overflow in regular-expression compilation can allow unauthenticated code execution. Earlier October patches are insufficient for this issue.","applies":"Self-managed GitLab CE/EE servers. Installing Git or using a GitLab remote does not mean this computer hosts GitLab.","action":"Follow the supported upgrade path for the installed branch, with backups and migration planning. Obtain approval for downtime and verify the server after upgrading. GitLab-managed infrastructure is patched per the vendor.","versions":"19.5.1 · 19.4.3 · 19.3.6 · 19.2.9 · 19.1.9 · 19.0.10 · 18.11.13","source":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","sourceLabel":"GitLab patch advisory","cves":["CVE-2026-110264"],"curated":true},{"id":"litellm","product":"LiteLLM","title":"Compromised package and container release","severity":"incident","kind":"Supply chain","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Published 1.107.0 wheels and affected container tags carried credential theft and remote-code tooling. The official source tag did not contain the malicious files.","applies":"Environments that installed 1.107.0, or ran affected images. Check historical exposure, lockfiles and image digests, not just the version present now.","action":"Inspect files before starting Python or pip. On suspected exposure, stop and preserve evidence; propose containment and rebuilding from trusted artifacts. Rotate reachable credentials from a clean device after approval.","versions":"Vendor recommends pinning 1.106.2; recheck before installing","source":"https://docs.litellm.ai/blog/security-incident-oct-21-2026","sourceLabel":"LiteLLM incident report","cves":[],"curated":true},{"id":"node","product":"Node.js","title":"Brotli, TLS and DNS security fixes","severity":"high","kind":"Security release","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Security releases address a Brotli out-of-bounds write, TLS hostname checks and other issues. The releases also update eMudhra certificate protections.","applies":"Node runtimes in shells, version managers, services, CI and containers. Updating the default shell version does not replace other running copies.","action":"Upgrade within a supported release line through its existing manager, or verify the distribution’s backport. Rebuild affected images and restart processes with approval; verify their loaded runtime.","versions":"22.23.4 · 24.22.1 · 26.12.1","source":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","sourceLabel":"Node.js security release","cves":["CVE-2026-111497"],"curated":true},{"id":"railway","product":"Railway","title":"Potential exposure of stored secrets","severity":"incident","kind":"Platform incident","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Railway reported possible access to encrypted environment variables and some decrypted values. Its precautionary advice applies to all customers while the investigation continues.","applies":"This version shows the Railway advisory to the agent only when the Railway CLI is detected. The incident concerns secrets stored in Railway.","action":"If the Railway CLI is detected, present this advisory and confirm relevant account usage without retrieving secret values. Plan rotation of stored keys and credentials at their issuers, update dependent services, and review access logs. Check current provider status before rollout.","versions":"Credential rotation and log review; no local version fix","source":"https://blog.railway.com/p/security-disclosure-wednesday-october-21st","sourceLabel":"Railway disclosure","cves":[],"curated":true},{"id":"emudhra","product":"eMudhra","title":"Compromised certificate authority keys","severity":"incident","kind":"Trust stores","published":"2026-10-20","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Mozilla reports eight compromised intermediate certificate keys and has distributed browser protections. Applications using separate certificate stores need their own assessment.","applies":"TLS clients, browsers, operating systems, language runtimes and containers—even if you have never bought an eMudhra certificate.","action":"Check each vendor’s current trust-store guidance. Browser protection does not prove CLI or container protection. Use approved certificate tests with a valid control; DNS errors and timeouts are inconclusive.","versions":"Vendor-specific trust updates; do not disable TLS checks","source":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","sourceLabel":"Mozilla security response","cves":[],"curated":true}],"recent":[{"id":"php","product":"PHP","title":"PHP2Shell: unauthenticated remote code execution","severity":"critical","kind":"Vulnerability","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Two PHP core flaws affect installations serving web requests. Apache mod_php has the highest reported risk; PHP-FPM and other web SAPIs also need attention.","applies":"PHP web workloads, including containers and bundled runtimes. A missing CLI binary does not rule out a running web service.","action":"Use your vendor’s patched package or a fixed upstream branch. Confirm backports before comparing versions. Restart affected workers with approval and verify the running service.","versions":"8.5.12 · 8.4.27 · 8.3.36 · 8.2.35","source":"https://www.php.net/archive/2026.php#2026-10-21-1","sourceLabel":"PHP security team","cves":["CVE-2026-109618","CVE-2026-109619"],"curated":true},{"id":"gitlab","product":"GitLab","title":"Critical RCE in self-managed GitLab","severity":"critical","kind":"Vulnerability","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"An integer overflow in regular-expression compilation can allow unauthenticated code execution. Earlier October patches are insufficient for this issue.","applies":"Self-managed GitLab CE/EE servers. Installing Git or using a GitLab remote does not mean this computer hosts GitLab.","action":"Follow the supported upgrade path for the installed branch, with backups and migration planning. Obtain approval for downtime and verify the server after upgrading. GitLab-managed infrastructure is patched per the vendor.","versions":"19.5.1 · 19.4.3 · 19.3.6 · 19.2.9 · 19.1.9 · 19.0.10 · 18.11.13","source":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","sourceLabel":"GitLab patch advisory","cves":["CVE-2026-110264"],"curated":true},{"id":"litellm","product":"LiteLLM","title":"Compromised package and container release","severity":"incident","kind":"Supply chain","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Published 1.107.0 wheels and affected container tags carried credential theft and remote-code tooling. The official source tag did not contain the malicious files.","applies":"Environments that installed 1.107.0, or ran affected images. Check historical exposure, lockfiles and image digests, not just the version present now.","action":"Inspect files before starting Python or pip. On suspected exposure, stop and preserve evidence; propose containment and rebuilding from trusted artifacts. Rotate reachable credentials from a clean device after approval.","versions":"Vendor recommends pinning 1.106.2; recheck before installing","source":"https://docs.litellm.ai/blog/security-incident-oct-21-2026","sourceLabel":"LiteLLM incident report","cves":[],"curated":true},{"id":"node","product":"Node.js","title":"Brotli, TLS and DNS security fixes","severity":"high","kind":"Security release","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Security releases address a Brotli out-of-bounds write, TLS hostname checks and other issues. The releases also update eMudhra certificate protections.","applies":"Node runtimes in shells, version managers, services, CI and containers. Updating the default shell version does not replace other running copies.","action":"Upgrade within a supported release line through its existing manager, or verify the distribution’s backport. Rebuild affected images and restart processes with approval; verify their loaded runtime.","versions":"22.23.4 · 24.22.1 · 26.12.1","source":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","sourceLabel":"Node.js security release","cves":["CVE-2026-111497"],"curated":true},{"id":"railway","product":"Railway","title":"Potential exposure of stored secrets","severity":"incident","kind":"Platform incident","published":"2026-10-21","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Railway reported possible access to encrypted environment variables and some decrypted values. Its precautionary advice applies to all customers while the investigation continues.","applies":"This version shows the Railway advisory to the agent only when the Railway CLI is detected. The incident concerns secrets stored in Railway.","action":"If the Railway CLI is detected, present this advisory and confirm relevant account usage without retrieving secret values. Plan rotation of stored keys and credentials at their issuers, update dependent services, and review access logs. Check current provider status before rollout.","versions":"Credential rotation and log review; no local version fix","source":"https://blog.railway.com/p/security-disclosure-wednesday-october-21st","sourceLabel":"Railway disclosure","cves":[],"curated":true}],"watchlist":[],"boundary":[{"id":"emudhra","product":"eMudhra","title":"Compromised certificate authority keys","severity":"incident","kind":"Trust stores","published":"2026-10-20","precision":"day","verified":"2026-10-22T05:05:00Z","summary":"Mozilla reports eight compromised intermediate certificate keys and has distributed browser protections. Applications using separate certificate stores need their own assessment.","applies":"TLS clients, browsers, operating systems, language runtimes and containers—even if you have never bought an eMudhra certificate.","action":"Check each vendor’s current trust-store guidance. Browser protection does not prove CLI or container protection. Use approved certificate tests with a valid control; DNS errors and timeouts are inconclusive.","versions":"Vendor-specific trust updates; do not disable TLS checks","source":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","sourceLabel":"Mozilla security response","cves":[],"curated":true}]}