{ "version": "https://jsonfeed.org/version/1.1", "title": "Oktsec Radar", "home_page_url": "https://www.oktsec.com/radar", "feed_url": "https://www.oktsec.com/radar/feed.json", "language": "en", "description": "Selected security incidents, evidence and actions.", "items": [ { "id": "https://www.oktsec.com/radar/litellm-1-107-0", "url": "https://www.oktsec.com/radar/litellm-1-107-0", "title": "LiteLLM 1.107.0: check where it ran", "content_text": "LiteLLM confirmed malicious PyPI and container artifacts. Removing the package does not revoke credentials it could access.\n\nIdentify affected executions, replace accessible credentials and rebuild from a clean environment.", "date_published": "2026-10-23T20:34:00Z", "date_modified": "2026-10-23T21:15:06Z", "tags": [ "supply_chain", "act_now" ] }, { "id": "https://www.oktsec.com/radar/brief/2026-10-23", "url": "https://www.oktsec.com/radar/brief/2026-10-23", "title": "The systems and credentials to check this week", "content_text": "Review exposed runtimes, the builds that ran and the credentials they could reach. This brief covers updates reviewed on October 22 and 23, including earlier disclosures that still require action.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:15:06Z", "tags": [ "brief" ] }, { "id": "https://www.oktsec.com/radar/carliy0s-latin-american-financial-sector", "url": "https://www.oktsec.com/radar/carliy0s-latin-american-financial-sector", "title": "CARLIY0S: targeting Latin American banks", "content_text": "Straiker reports AI supported attack operations targeting banks and payment providers in Latin America. Its reported target inventory is not a count of confirmed compromises.\n\nReview exposed services, privileged access and model provider credentials.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:08:44Z", "tags": [ "threat_activity", "monitor" ] }, { "id": "https://www.oktsec.com/radar/arista-velocloud-cve-2026-114625", "url": "https://www.oktsec.com/radar/arista-velocloud-cve-2026-114625", "title": "VeloCloud Orchestrator: active exploitation confirmed", "content_text": "Arista reports exploitation of an authenticated SQL injection flaw. Operators of affected on premises deployments need to apply the vendor fix.\n\nUpgrade affected VCO deployments and review privileged account activity.", "date_published": "2026-10-23T20:34:00Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "act_now", "CVE-2026-114625" ] }, { "id": "https://www.oktsec.com/radar/beyondtrust-bt26-05", "url": "https://www.oktsec.com/radar/beyondtrust-bt26-05", "title": "BeyondTrust Remote Support: exploited appliance flaw", "content_text": "BeyondTrust confirms targeted exploitation of Remote Support. Operators of their own appliances must verify that the BT26-05 patch was applied.\n\nVerify BT26-05 patch status and investigate unexpected appliance activity.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "act_now", "CVE-2026-102764" ] }, { "id": "https://www.oktsec.com/radar/cisco-expressway-cve-2026-76466", "url": "https://www.oktsec.com/radar/cisco-expressway-cve-2026-76466", "title": "Cisco Expressway: patch clustered deployments", "content_text": "Cisco fixed a root command execution flaw in clustered Expressway devices. The advisory reports no known malicious use.\n\nUpgrade affected clusters to X15.5.20 or a later fixed release.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "this_week", "CVE-2026-76466" ] }, { "id": "https://www.oktsec.com/radar/emudhra-chrome-root-removal", "url": "https://www.oktsec.com/radar/emudhra-chrome-root-removal", "title": "eMudhra: check certificate chains before October 27", "content_text": "Chrome plans to remove trust in emSign ECC Root CA - G3. Services using that root need a replacement certificate chain.\n\nReplace affected certificate chains before Chrome’s October 27 trust change.", "date_published": "2026-10-23T20:34:00Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "trust_pki", "act_now", "CVE-2026-91403" ] }, { "id": "https://www.oktsec.com/radar/gitlab-cve-2026-110264", "url": "https://www.oktsec.com/radar/gitlab-cve-2026-110264", "title": "GitLab issues an emergency code execution fix", "content_text": "A critical regular expression compiler flaw can allow unauthenticated code execution. GitLab recommends upgrading affected installations immediately.\n\nUpgrade GitLab to a fixed release and confirm the version serving traffic.", "date_published": "2026-10-23T20:34:00Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "this_week", "CVE-2026-110264" ] }, { "id": "https://www.oktsec.com/radar/netscaler-cve-2026-88771", "url": "https://www.oktsec.com/radar/netscaler-cve-2026-88771", "title": "NetScaler: exploited flaws need patching and investigation", "content_text": "Citrix confirms exploitation of two NetScaler flaws. Check appliance versions and preserve evidence of activity before the update.\n\nInstall the vendor fixes and investigate unexpected access or persistence.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "act_now", "CVE-2026-88771", "CVE-2026-88772" ] }, { "id": "https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497", "url": "https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497", "title": "Node2Shell: update runtimes that decode untrusted Brotli", "content_text": "A Node.js decoder flaw can allow code execution when an application decompresses attacker supplied Brotli data. Imperva demonstrated the impact in specific Linux arm64 configurations.\n\nUpdate the deployed Node.js runtime and identify paths that decode untrusted data.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "act_now", "CVE-2026-111497" ] }, { "id": "https://www.oktsec.com/radar/php2shell", "url": "https://www.oktsec.com/radar/php2shell", "title": "PHP2Shell: investigate from October 17", "content_text": "AWS observed exploitation attempts before disclosure. Patch exposed PHP servers and investigate the activity that preceded the update.\n\nPatch PHP, preserve logs and review server activity from at least October 17.", "date_published": "2026-10-23T20:34:00Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "vulnerability", "act_now", "CVE-2026-109618", "CVE-2026-109619", "CVE-2026-115560" ] }, { "id": "https://www.oktsec.com/radar/pingcap-october-2026-api-keys", "url": "https://www.oktsec.com/radar/pingcap-october-2026-api-keys", "title": "PingCAP: replace management API keys as a precaution", "content_text": "PingCAP confirms an internal systems incident and exported customer records. Its customer guidance calls for replacing active TiDB Cloud management keys.\n\nReplace active management keys and verify unexpected account requests.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "platform_breach", "act_now" ] }, { "id": "https://www.oktsec.com/radar/railway-october-2026-secrets", "url": "https://www.oktsec.com/radar/railway-october-2026-secrets", "title": "Railway: replace stored secrets after the platform incident", "content_text": "Railway’s preliminary report confirms that some encrypted environment variables were decrypted. It recommends replacing sensitive variables stored before October 21.\n\nReplace reachable secrets, revoke old access and review provider activity.", "date_published": "2026-10-23T21:03:38Z", "date_modified": "2026-10-23T21:03:38Z", "tags": [ "platform_breach", "act_now" ] } ] }