https://www.oktsec.com/radarSecurity incidents, affected systems and actions for your team.enFri, 23 Oct 2026 21:15:06 GMThttps://www.oktsec.com/radar/litellm-1-107-0https://www.oktsec.com/radar/litellm-1-107-0Fri, 23 Oct 2026 21:15:06 GMTLiteLLM confirmed malicious PyPI and container artifacts. Removing the package does not revoke credentials it could access.https://www.oktsec.com/radar/carliy0s-latin-american-financial-sectorhttps://www.oktsec.com/radar/carliy0s-latin-american-financial-sectorFri, 23 Oct 2026 21:08:44 GMTStraiker reports AI supported attack operations targeting banks and payment providers in Latin America. Its reported target inventory is not a count of confirmed compromises.https://www.oktsec.com/radar/arista-velocloud-cve-2026-114625https://www.oktsec.com/radar/arista-velocloud-cve-2026-114625Fri, 23 Oct 2026 21:03:38 GMTArista reports exploitation of an authenticated SQL injection flaw. Operators of affected on premises deployments need to apply the vendor fix.https://www.oktsec.com/radar/beyondtrust-bt26-05https://www.oktsec.com/radar/beyondtrust-bt26-05Fri, 23 Oct 2026 21:03:38 GMTBeyondTrust confirms targeted exploitation of Remote Support. Operators of their own appliances must verify that the BT26-05 patch was applied.https://www.oktsec.com/radar/cisco-expressway-cve-2026-76466https://www.oktsec.com/radar/cisco-expressway-cve-2026-76466Fri, 23 Oct 2026 21:03:38 GMTCisco fixed a root command execution flaw in clustered Expressway devices. The advisory reports no known malicious use.https://www.oktsec.com/radar/emudhra-chrome-root-removalhttps://www.oktsec.com/radar/emudhra-chrome-root-removalFri, 23 Oct 2026 21:03:38 GMTChrome plans to remove trust in emSign ECC Root CA - G3. Services using that root need a replacement certificate chain.https://www.oktsec.com/radar/gitlab-cve-2026-110264https://www.oktsec.com/radar/gitlab-cve-2026-110264Fri, 23 Oct 2026 21:03:38 GMTA critical regular expression compiler flaw can allow unauthenticated code execution. GitLab recommends upgrading affected installations immediately.https://www.oktsec.com/radar/netscaler-cve-2026-88771https://www.oktsec.com/radar/netscaler-cve-2026-88771Fri, 23 Oct 2026 21:03:38 GMTCitrix confirms exploitation of two NetScaler flaws. Check appliance versions and preserve evidence of activity before the update.https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497Fri, 23 Oct 2026 21:03:38 GMTA Node.js decoder flaw can allow code execution when an application decompresses attacker supplied Brotli data. Imperva demonstrated the impact in specific Linux arm64 configurations.https://www.oktsec.com/radar/php2shellhttps://www.oktsec.com/radar/php2shellFri, 23 Oct 2026 21:03:38 GMTAWS observed exploitation attempts before disclosure. Patch exposed PHP servers and investigate the activity that preceded the update.https://www.oktsec.com/radar/pingcap-october-2026-api-keyshttps://www.oktsec.com/radar/pingcap-october-2026-api-keysFri, 23 Oct 2026 21:03:38 GMTPingCAP confirms an internal systems incident and exported customer records. Its customer guidance calls for replacing active TiDB Cloud management keys.https://www.oktsec.com/radar/railway-october-2026-secretshttps://www.oktsec.com/radar/railway-october-2026-secretsFri, 23 Oct 2026 21:03:38 GMTRailway’s preliminary report confirms that some encrypted environment variables were decrypted. It recommends replacing sensitive variables stored before October 21.https://www.oktsec.com/radar/brief/2026-10-23https://www.oktsec.com/radar/brief/2026-10-23Fri, 23 Oct 2026 21:03:38 GMTReview exposed runtimes, the builds that ran and the credentials they could reach. This brief covers updates reviewed on October 22 and 23, including earlier disclosures that still require action.