The threat map.
October 2026.
Beyond the headlines. A clear look at vulnerabilities, breaches and outages: who is affected and what deserves your attention first.
From signal to action.
Open an event for its scope, remediation and original technical disclosures.
01RailwayIncidentsEnvironment secrets at risk
Railway is investigating unauthorized access to environment-variable storage. Some encrypted values may have been decrypted.
Environment variables / credential exposure
Environment secrets at risk
Railway is investigating unauthorized access to environment-variable storage. Some encrypted values may have been decrypted.
Environment variables / credential exposurePotential exposure includes API keys, database passwords and private-registry credentials; the customer scope remains under investigation.
Rotate secrets stored in Railway at their providers, update configuration and inspect usage logs.
The provider recommends rotation for all users as a precaution. Exposure is not confirmed for every customer.
02PHPPatchesTwo critical PHP2Shell flaws
Memory corruption during out-of-memory handling and stale global state can allow unauthenticated code execution.
CVE-2026-109618 · CVE-2026-109619
Two critical PHP2Shell flaws
Memory corruption during out-of-memory handling and stale global state can allow unauthenticated code execution.
CVE-2026-109618 · CVE-2026-109619PHP serving web requests: FPM, mod_php, CGI, FrankenPHP and LiteSpeed. The team identifies mod_php as the highest risk.
Update the relevant branch, restart every PHP worker and verify the running service version.
8.5.12 / 8.4.27 / 8.3.36 / 8.2.35There is no complete workaround. Older branches need confirmed vendor backports or migration to a supported release.
03Node.jsPatchesBrotli decoder RCE
An out-of-bounds write in the Brotli decoder can permit remote code execution.
CVE-2026-111497 · High
Brotli decoder RCE
An out-of-bounds write in the Brotli decoder can permit remote code execution.
CVE-2026-111497 · HighRelease lines 22.x, 24.x and 26.x before the listed fixes, including runtimes embedded in containers or other products.
Update every Node.js installation in use. Check the executable that actually runs the application.
22.23.4 / 24.22.1 / 26.12.1The official severity is High. The release also fixes other issues and refreshes CAs following the eMudhra incident.
04LiteLLMIncidentsMalicious packages and containers
The compromised 1.107.0 release stole credentials and loaded code-execution tools.
Supply chain · 1.107.0
Malicious packages and containers
The compromised 1.107.0 release stole credentials and loaded code-execution tools.
Supply chain · 1.107.0PyPI: 11:39–13:23 UTC. Container v1.107.0 and moving tags latest, main-latest and main-stable were also affected.
Rebuild affected environments from clean sources, rotate reachable secrets and pin a clean version.
1.106.2Do not start with pip inside a compromised environment: starting Python may reactivate malware. The private enterprise registry was unaffected.
05GitLabPatchesUnauthenticated code execution
An integer overflow while compiling a crafted regular expression can lead to remote code execution.
CVE-2026-110264 · CVSS 3.1 10.0
Unauthenticated code execution
An integer overflow while compiling a crafted regular expression can lead to remote code execution.
CVE-2026-110264 · CVSS 3.1 10.0Self-managed GitLab CE/EE from 7.0; the advisory lists precise affected ranges for each branch.
Install the branch-specific fix using GitLab upgrade procedures and review the published exploitation detections.
18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1GitLab.com is already patched. Plan migrations and possible downtime; a vulnerable server is not necessarily compromised.
06State Bank of IndiaIncidentsSuspected data exposure under investigation
Kotak Neo, citing an SBI disclosure, reports 3,897 records containing customer personal information.
Suspected customer-data exposure
Suspected data exposure under investigation
Kotak Neo, citing an SBI disclosure, reports 3,897 records containing customer personal information.
Suspected customer-data exposureThe preliminary review covered about 375,000 records; authenticity, origin and completeness remain under investigation.
Follow official bank notices and verify suspicious approaches through established contact channels.
The original exchange filing was unavailable for this review. 375,000 is the dataset size, not a confirmed victim count.
07eMudhra / emSignIncidentsCertificate-authority keys compromised
Eight intermediate CA keys could enable fraudulent certificates. Mozilla received the report on 17 October.
8 intermediate CA keys
Certificate-authority keys compromised
Eight intermediate CA keys could enable fraudulent certificates. Mozilla received the report on 17 October.
8 intermediate CA keysTLS clients still trusting affected chains, including older Python CA bundles.
Update OS, runtime and container trust stores. In Python, update certifi, pip and uv.
certifi 2026.10.19 / pip 26.2.2 / uv 0.13.4Firefox and Chrome blocked affected CAs on 17 October; server clients need separate checks. MITM requires control of the network path.
08Plex Media ServerPatchesPlex2Shell: a chain to code execution
Four vulnerabilities combine into an unauthenticated remote-code-execution chain.
CVE-2026-96652 / 96654 / 96655 / 96656
Plex2Shell: a chain to code execution
Four vulnerabilities combine into an unauthenticated remote-code-execution chain.
CVE-2026-96652 / 96654 / 96655 / 96656According to the researcher, Plex Media Server through 1.43.3.10828 is affected.
Update to 1.43.3.10861 or later and review available logs and indicators of intrusion.
1.43.3.10861Technical version boundaries come from the researcher. The public-analysis date differs from later reports of exploitation.
09SiteGuard Server EditionPatchesCommand injection as root or SYSTEM
The statistics feature allows OS command execution with elevated privileges. JVN confirms exploitation in the wild.
CVE-2026-106931 · CVSS 4.0 8.5
Command injection as root or SYSTEM
The statistics feature allows OS command execution with elevated privileges. JVN confirms exploitation in the wild.
CVE-2026-106931 · CVSS 4.0 8.5Versions from 2.20 with statistics enabled. IIS 3.10–4.00 Update 4 are excluded; statistics is enabled by default.
Upgrade or apply the vendor’s standalone patch, also available for EOL versions.
8.00 Update 5 / FreeBSD 7.00 Update 6The CVSS vector requires local access with low privileges. Direct-support customers were notified on 29 September.
10Siemens Software CenterPatchesA signed program loads attacker DLLs
Attackers distributed a genuine Software Center executable alongside malicious DLLs that it loaded at startup.
CVE-2026-110936
A signed program loads attacker DLLs
Attackers distributed a genuine Software Center executable alongside malicious DLLs that it loaded at startup.
CVE-2026-110936Vulnerable Software Center releases; Siemens describes version 3.5.8.7 being used in attacks.
Install 4.0.9.8 or later; investigate unusual execution paths and ProductCERT indicators.
4.0.9.8The original advisory was published on 15 October. Siemens reports no known breach of its systems or official update channel.
11OVHcloud CLIIncidentsRelease binaries replaced
A compromised GitHub account was used to replace binaries in five releases with credential-stealing malware.
GHSA-862f-55f5-vmvw
Release binaries replaced
A compromised GitHub account was used to replace binaries in five releases with credential-stealing malware.
GHSA-862f-55f5-vmvwBinaries 0.11.0–0.15.0 downloaded during the stated window. Earlier downloads of those versions were unaffected.
Check hashes without executing the file. If a malicious copy ran, rotate reachable secrets and install a clean release.
0.16.0OVHcloud says source and build infrastructure were unaffected. Around 250 downloads do not establish 250 victims.
12OpenCode ConsoleIncidentsStored API keys potentially exposed
BleepingComputer reports that OpenCode notified some Console users of possible exposure of external AI-provider keys.
Stored third-party provider keys
Stored API keys potentially exposed
BleepingComputer reports that OpenCode notified some Console users of possible exposure of external AI-provider keys.
Stored third-party provider keysThe company reported 1.4% of Console users with linked external providers were affected and notified by email.
Check notifications, revoke affected keys at their providers and review spending and request logs.
The original post was unavailable for direct verification; details are attributed to media reporting. This does not establish compromise of every local CLI.
13Windows ShellPatchesShell security-feature bypass
Command injection allows a Windows Shell security feature to be bypassed. The October update addresses the vulnerability.
CVE-2026-96951 · CVSS 3.1 8.8
Shell security-feature bypass
Command injection allows a Windows Shell security feature to be bypassed. The October update addresses the vulnerability.
CVE-2026-96951 · CVSS 3.1 8.8Windows products and versions listed by Microsoft. Exploitation requires user interaction.
Install applicable October updates and verify installation completion and required restarts.
Advisories report exploitation. Patch status and prior compromise are separate questions; the applicable KB depends on the OS version.
14Google CloudOutagesRegional outage after power failure
A preliminary report links the outage to power loss in europe-west2-b and failed automatic backup-generator startup.
europe-west2 · London
Regional outage after power failure
A preliminary report links the outage to power loss in europe-west2-b and failed automatic backup-generator startup.
europe-west2 · LondonCompute, databases and other London-region services. The main impact window lasted 6 hours 10 minutes.
Review regional dependencies, backup restoration and system behavior when an availability zone is unavailable.
This is an availability incident, not a confirmed breach. Dates use the report’s timezone; a final RCA remains pending.
15Oracle E-Business SuitePatchesA broad ERP security update
The October CPU includes 194 new E-Business Suite security patches. Thirty-one vulnerabilities may be remotely exploited without authentication.
October 2026 Critical Patch Update
A broad ERP security update
The October CPU includes 194 new E-Business Suite security patches. Thirty-one vulnerabilities may be remotely exploited without authentication.
October 2026 Critical Patch UpdateVersions and components listed in Oracle’s matrix, including relevant Oracle Database and Fusion Middleware dependencies.
Match the installed components against the matrix and apply the corresponding patches using Oracle documentation.
There is no single fixed version for the whole package. Patch counts are not counts of Critical CVEs or confirmed attacks.
Try a service name or CVE identifier.
Your next
steps.
Start with the components you actually use. Your progress is saved in this browser.
This checklist helps organise work; it does not certify a system as secure.