Two runtimes, one twelve-year-old bug, and a lot of leaked secrets
If you run anything on the web, this was not a week to ignore security advisories. Two runtimes that power most of the web shipped emergency fixes on the same day, GitLab patched a maximum-severity bug that goes back twelve years, and a chain of incidents hit AI and cloud platforms that hold developers' secrets. Here is what happened and what to do about it.
On October 20, details of two critical vulnerabilities in PHP, CVE-2026-109618 and
CVE-2026-109619, leaked online before their coordinated disclosure and before patches were
out. The fixes landed on October 21 at 14:00 UTC in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35,
and both bugs can allow unauthenticated remote code execution. One is memory corruption during out-of-memory
handling; the other is request state that survives after its memory has been freed. The upload-progress
handler can also hand freed worker memory back to the client inside a PHPSESSID cookie, and that
memory can hold passwords, session tokens, API keys or TLS private keys from other requests.
The bug is in the interpreter, not in any one app, so updating WordPress, Drupal or Laravel does not fix it. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all in scope, including PHP bundled in control panels like cPanel and Plesk. The risk is highest for mod_php, where a single unauthenticated request can trigger the attack before any application code runs. According to Wiz, which shares credit for the discovery with Calif and OpenAI, versions from PHP 5.4 through PHP 8 are affected.
Attackers didn't wait. Cloudflare, which had WAF rules in place hours before disclosure, reported early attacks and payloads being mutated to get around its rules, and watchTowr and Patchstack saw exploitation attempts around the time the patches landed. At the time of writing the bugs are not yet in CISA's KEV catalog.
A few practical notes:
php -v.One detail worth thinking about: Wiz said the flaws had been present for decades, but proving they were exploitable took a chain of steps at the edge of what human researchers could manage, and frontier AI models lowered that barrier substantially.
Also on October 21, the Node.js project fixed 10 vulnerabilities across the 26.x, 24.x and 22.x lines: four high, three medium and three low. The patched versions are 26.12.1, 24.22.1 and 22.23.4. The worst, CVE-2026-111497, is an out-of-bounds write in Node's Brotli decoder: a process that decodes attacker-supplied Brotli data can be made to leak memory or run arbitrary code.
You're exposed if your code, or a library you use, decompresses Brotli data an attacker controls, whether in
a request body or in a fetched response, and only the runtime patch covers fetched responses. Two more of
the high-rated flaws, CVE-2026-105483 (26.x and 24.x only) and
CVE-2026-106069, let a TLS certificate hostname check be bypassed, and the fourth,
CVE-2026-105482, makes dns.resolve truncate names containing a NUL character. The same release
also pulls the compromised eMudhra intermediate CAs out of Node's bundled trust store (more on that below).
As always, end-of-life Node versions are affected too and get no fix. Don't forget Electron apps and anything else that bundles its own Node.
GitLab released fixes on October 21 for CVE-2026-110264, a flaw that lets an attacker run code on a self-managed server without logging in. It affects every version back to 7.0, released in 2014. The reason it reaches so far back: the bug is an integer overflow in the regex handling built on Ruby's Onigmo engine, which GitLab ships in its own builds, so the weakness is present in every release since 7.0.
If you patched for the October 12 CVSS 10 bug (CVE-2026-97229), you're not done. That update covered only 19.2 to 19.4, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for anything from 7.0 through 18.11. The same release fixes 11 other CVEs, including high-severity ones.
GitLab hasn't said what preconditions an attacker needs, so admins can't rule themselves out by configuration, and there's no interim workaround. No exploitation has been reported so far. GitLab.com and GitLab Dedicated are already patched. Plan for downtime on single-node installs, since 19.4.3 and 19.3.6 include database migrations that run during the upgrade.
LiteLLM 1.107.0 was published with malware on October 21: all seven wheel files on PyPI carried a credential stealer and a remote code loader, and the malicious release also reached the official Docker images. BerriAI, the company behind LiteLLM, said the release came through three engineers' GitHub accounts, apparently via stolen GitHub CLI OAuth tokens, with one account triggering the release run and another approving it. How the attacker got those tokens in the first place is still unknown.
The nasty part is how it runs. Socket reported that the payload uses Python startup hooks, so it can activate even if an application never imports LiteLLM, exposing cloud credentials, developer secrets and AI authentication files. On LiteLLM Proxy installs it also queried the database table where the proxy stores upstream provider keys and pulled up to 500 of them.
The PyPI window was installs between roughly 11:39 and 13:23 UTC on October 21, and one report has the Docker tags live until about 14:20 UTC. The most recent safe version is 1.106.2. If you pulled 1.107.0 anywhere, treat that machine or CI runner as compromised and rotate every secret it could see.
OpenCode disclosed a breach of a legacy system it was decommissioning, tied to what it calls a large-scale distillation attack. It affected 1.4% of OpenCode Console users, specifically those with external AI provider keys saved in their workspaces. The exposed keys could be for Anthropic, OpenAI and Google models, and some users reported unauthorized charges overnight. If you got the email, revoke and reissue those keys at the provider.
Separately, Pillar Security warned that older OpenCode versions remain exposed to a critical RCE because the fix shipped as a refactor without a CVE or public advisory, so scanners may not flag it. Versions 1.0.137 through 1.18.32 are affected and 1.18.33 fixes it. Exploitation needs a malicious or compromised remote MCP server, and only Windows (including WSL) is hit: during OAuth, the server supplies an endpoint that OpenCode uses to launch a browser, and on Windows that address went into PowerShell without proper escaping. The vendor considers malicious MCP servers outside its threat model, which is one more reason to treat every MCP server you connect as untrusted.
Railway detected anomalous activity in the systems that store customer environment variables. It says an unauthorized third party accessed encrypted variables and, for a subset, obtained the decrypted contents. Its initial analysis suggests only some users are affected, but it paused all deployments and recommends that all users rotate environment variables, API keys, database credentials and private registry credentials stored on the platform. Remember that most apps read environment variables at startup, so a rotated secret may only take effect after a redeploy.
Railway believes this is part of a broader campaign against platform companies aimed at compromising AI inference providers. That fits the pattern: earlier this month Fireworks also disclosed that an unauthorized party used internal credentials to access environment variables in evaluation jobs in a limited number of customer accounts.
The list keeps going:
litellm==1.107.0.The common thread this week is secrets. Code bugs get patched; leaked API keys and tokens keep working until someone rotates them. Short-lived credentials, scoped tokens and a tested rotation process are worth more than ever.
Sources: Wiz – PHP2Shell, CERT-EU – Critical Vulnerabilities in PHP, Help Net Security – PHP2Shell patched, Sansec – PHP2Shell, Huntress – PHP2Shell, Patchstack – PHP critical RCE, Cloudflare – php2shell protections, Node.js – October 21, 2026 security releases, Vercel – Node.js Brotli RCE, GitLab – Critical Patch Release 19.5.1, The Hacker News – GitLab CVSS 10.0 across 12 years, LiteLLM incident report, Socket – LiteLLM compromise, StepSecurity – LiteLLM 1.107.0, BleepingComputer – OpenCode breach, Pillar Security – OpenCode MCP OAuth RCE, Railway security disclosure, Fireworks security bulletin, Cisco – Expressway advisory, Oracle – October 2026 CPU, Cloudflare – eMudhra certificate compromise, The Stack – OVHcloud CLI compromised