Security incidents
Find affected products. Check the evidence. Track your next steps.
Incident desk
| Incident | Priority | Evidence / response | Updated | Actions |
|---|---|---|---|---|
| VeloCloud Orchestrator: active exploitation confirmed Upgrade affected VCO deployments and review privileged account activity. | Act now | Exploitation confirmedFix availableCISA KEV | ||
| BeyondTrust Remote Support: exploited appliance flaw Verify BT26-05 patch status and investigate unexpected appliance activity. | Act now | Exploitation confirmedFix availableCISA KEV | ||
| NetScaler: exploited flaws need patching and investigation Install the vendor fixes and investigate unexpected access or persistence. | Act now | Exploitation confirmedFix availableCISA KEV · 2 | ||
| LiteLLM 1.107.0: check where it ran Identify affected executions, replace accessible credentials and rebuild from a clean environment. | Act now | Exploitation confirmedFurther action needed | ||
| Railway: replace stored secrets after the platform incident Replace reachable secrets, revoke old access and review provider activity. | Act now | Provider confirmed incidentFurther action needed | ||
| PHP2Shell: investigate from October 17 Patch PHP, preserve logs and review server activity from at least October 17. | Act now | Attempts observedFurther action needed | ||
| eMudhra: check certificate chains before October 27 Replace affected certificate chains before Chrome’s October 27 trust change. | Act now | Trust change announcedFurther action needed | ||
| Node2Shell: update runtimes that decode untrusted Brotli Update the deployed Node.js runtime and identify paths that decode untrusted data. | Act now | Research exploit demonstratedFix available | ||
| PingCAP: replace management API keys as a precaution Replace active management keys and verify unexpected account requests. | Act now | Provider confirmed incidentFurther action needed | ||
| Cisco Expressway: patch clustered deployments Upgrade affected clusters to X15.5.20 or a later fixed release. | This week | No exploitation reportedFix available | ||
| GitLab issues an emergency code execution fix Upgrade GitLab to a fixed release and confirm the version serving traffic. | This week | No exploitation reportedFix available | ||
| CARLIY0S: targeting Latin American banks Review exposed services, privileged access and model provider credentials. | Monitor | Research report |
Latest changes
- LiteLLM 1.107.0: check where it ran
Clarified the vendor warning against running Python or pip in an affected environment, and included this incident in AI and cloud credential coverage.
- CARLIY0S: targeting Latin American banks
Shortened the title and clarified the campaign scope for the incident workspace.
- LiteLLM 1.107.0: check where it ran
Added the response priority rationale and original disclosure date.
Get incident alerts and briefings
Act now incidents and team briefings, with sources and recommended actions.
Checking availability…