CitrixVulnerability
NetScaler: exploited flaws need patching and investigation
Install the vendor fixes and investigate unexpected access or persistence.
No login requiredTeam briefing
The systems and credentials to check this week
Review exposed runtimes, the builds that ran and the credentials they could reach. This brief covers updates reviewed on October 22 and 23, including earlier disclosures that still require action.
Review windowOct 22, 2026 – Oct 23, 202612 incidents · 7 checks
Exposed infrastructure
4 incidentsBeyondTrustVulnerability
BeyondTrust Remote Support: exploited appliance flaw
Verify BT26-05 patch status and investigate unexpected appliance activity.
No login requiredAristaVulnerability
VeloCloud Orchestrator: active exploitation confirmed
Upgrade affected VCO deployments and review privileged account activity.
Account access requiredPHPVulnerability
PHP2Shell: investigate from October 17
Patch PHP, preserve logs and review server activity from at least October 17.
No login requiredEvidenceAttempts observedFurther action needed
Builds, runtimes and credentials
4 incidentsLiteLLMSupply chain
LiteLLM 1.107.0: check where it ran
Identify affected executions, replace accessible credentials and rebuild from a clean environment.
Affected package must executeEvidenceExploitation confirmedFurther action needed
RailwayPlatform incident
Railway: replace stored secrets after the platform incident
Replace reachable secrets, revoke old access and review provider activity.
Provider held credentialsEvidenceProvider confirmed incidentFurther action needed
Node.jsVulnerability
Node2Shell: update runtimes that decode untrusted Brotli
Update the deployed Node.js runtime and identify paths that decode untrusted data.
Application or configuration dependentEvidenceResearch exploit demonstratedFix available
PingCAPPlatform incident
PingCAP: replace management API keys as a precaution
Replace active management keys and verify unexpected account requests.
Provider held credentialsEvidenceProvider confirmed incidentFurther action needed
Patch planning and certificate deadlines
3 incidentsGitLabVulnerability
GitLab issues an emergency code execution fix
Upgrade GitLab to a fixed release and confirm the version serving traffic.
Application or configuration dependentEvidenceNo exploitation reportedFix available
CiscoVulnerability
Cisco Expressway: patch clustered deployments
Upgrade affected clusters to X15.5.20 or a later fixed release.
Application or configuration dependentEvidenceNo exploitation reportedFix available
eMudhra / GoogleCertificate trust
eMudhra: check certificate chains before October 27
Replace affected certificate chains before Chrome’s October 27 trust change.
Application or configuration dependent · Oct 27, 2026EvidenceTrust change announcedFurther action needed
Latin American financial services
1 incidentsLatin American financial servicesThreat activity
CARLIY0S: targeting Latin American banks
Review exposed services, privileged access and model provider credentials.
Not establishedEvidenceResearch report
What to check today
Oktsec can help establish which of these incidents affects your infrastructure and AI workflows. Scope, access and deliverables are agreed before testing.
Scope an assessment- 01Identify exposed edge appliances and preserve evidence before upgrades.
- 02Review PHP activity from at least October 17 and retain the separate upload progress mitigation where applicable.
- 03Find executed LiteLLM artifacts and reachable secrets. Replace affected Node.js runtimes.
- 04Complete Railway and PingCAP credential actions, including issuer revocation and downstream usage checks.
- 05Schedule GitLab and clustered Expressway fixes according to actual exposure.
- 06Replace affected TLS chains before October 27 and check Java’s separate trust update.
- 07Brief regional security teams on the CARLIY0S research without treating targets as confirmed victims.
Sources
Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.
- NetScaler security bulletin CTX697096Citrix · vendor · Checked Oct 23, 2026 UTC
- BT26-05 security advisoryBeyondTrust · vendor · Checked Oct 23, 2026 UTC
- ARMORY CASTLE investigation and responseBeyondTrust · vendor · Checked Oct 23, 2026 UTC
- Security Advisory 0199Arista · vendor · Checked Oct 23, 2026 UTC
- PHP critical security advisoryPHP · vendor · Checked Oct 23, 2026 UTC
- PHP2Shell observations in MadPotAWS · vendor · Checked Oct 23, 2026 UTC
- Session upload progress follow upPHP · vendor · Checked Oct 23, 2026 UTC
- October 21 supply chain incidentLiteLLM · vendor · Checked Oct 23, 2026 UTC
- Preliminary report: October security incidentRailway · vendor · Checked Oct 23, 2026 UTC
- October Node.js security releasesNode.js · vendor · Checked Oct 23, 2026 UTC
- Node2Shell research demonstrationImperva · research · Checked Oct 23, 2026 UTC
- October incident reportPingCAP · vendor · Checked Oct 23, 2026 UTC
- Customer actions and API key replacementPingCAP · vendor · Checked Oct 23, 2026 UTC
- GitLab critical patch releaseGitLab · vendor · Checked Oct 23, 2026 UTC
- Expressway remote code execution advisoryCisco · vendor · Checked Oct 23, 2026 UTC
- Chrome and Android response to compromised eMudhra intermediatesGoogle · vendor · Checked Oct 23, 2026 UTC
- Java security alert CVE-2026-91403Oracle · vendor · Checked Oct 23, 2026 UTC
- CARLIY0S investigationStraiker · research · Checked Oct 23, 2026 UTC
Radar email
Get incident alerts and briefings
Act now incidents and team briefings, with sources and recommended actions.
Checking availability…