Security recap, October 22–23: critical patches, exposed secrets and AI attacks

PHP2Shell attempts were visible before public disclosure. Arista confirmed active exploitation of VeloCloud Orchestrator. GitLab released an emergency fix for unauthenticated code execution. Meanwhile, LiteLLM, Railway and PingCAP asked customers to take action on credentials.

This October 22–23 security recap covers critical updates, supply chain incidents, data disclosures and research on attackers using AI. The practical priorities are to check exposed services, contain affected environments and replace credentials that could still give an attacker access after a patch.

Reviewed October 23, 2026 · Includes October 21 disclosures and subsequent updates. Incident scope and vendor guidance may change. Recommendations and diagrams are Oktsec’s analysis.

Start with your exposure

Three response tracks to run in parallel

Assign an owner to each applicable track. A completed patch does not close a credential incident.

01

Exposed softwarePatch and investigate

PHP · VeloCloud · GitLab · Node.js · Expressway · NetScaler

Confirm the running version ↗ 02

Credentials and buildsContain and replace access

LiteLLM · Railway · TiDB Cloud

Verify old keys are revoked ↗ 03

Certificate trustUpdate clients and certificate chains

eMudhra · Chrome Root Store · Java

Test the deployed client ↗

Critical updates and exploitation evidence

Use the fixed release for your supported branch, or a vendor package with a documented backport. Record the build actually serving traffic. A patched image in a registry does not update existing containers.

Swipe or scroll horizontally to compare all columns.

PHP2Shell: include the days before disclosure

AWS traced an exploitation attempt to October 17 in its MadPot honeypots, four days before the October 21 disclosure. Its analysis of the early activity was still ongoing. An observed attempt is not proof that a particular customer server was compromised.

Patch the interpreter using the PHP advisory, restart the relevant workers and investigate exposed systems from at least October 17. Preserve available request, process and authentication logs. Review unexpected child processes, changed application files and use of credentials accessible to the PHP worker.

Our PHP2Shell, Node.js and eMudhra analysis covers runtime checks, temporary mitigations and AWS WAF inspection limits. Edge filtering can reduce exposure while you patch. It does not establish that the origin is clean.

VeloCloud: a low-privilege login can reach operator authority

Arista’s October 22 advisory confirms active exploitation of CVE-2026-114625. This SQL injection issue can let an authenticated tenant user impersonate a superuser operator. Hosted and Dedicated VCO services have been patched. On-premises operators must check their own release.

Arista recommends blocking 74.82.197.86 and 38.54.50.151 and searching logs for those addresses. Also investigate unusual encoded paths, internal-service references, request bursts, unexpected outbound activity and administrative changes. Preserve evidence where feasible before patching or removing attacker access. An absent IP match does not rule out exploitation.

GitLab: verify the new fix, even after a recent upgrade

GitLab’s critical release addresses an integer overflow during regular-expression compilation that can permit unauthenticated code execution. Affected branches extend back to version 7.0. The release includes backports beyond GitLab’s usual patch window.

Match your installation against the release table above rather than assuming an earlier October update covers this CVE. GitLab also published detections for Onigmo native worker crashes and bursts of Org mode rendering errors. These support investigation of self-managed instances. GitLab says its managed infrastructure is patched. The advisory’s severity rating alone does not demonstrate exploitation of your instance.

Node.js and NetScaler: different kinds of evidence

The Node.js October 21 release fixes the Brotli decoder vulnerability and other runtime issues. Imperva’s Node2Shell research reports code execution using crafted Brotli data in applications running an official Node.js 24.22.0 Linux arm64 image. Treat this as a demonstrated exploit path. It does not mean every Node.js endpoint exposes a decoder to unauthenticated requests, or establish attacks in the wild.

For NetScaler, Zscaler reports observed exploitation of CVE-2026-88771, including log poisoning, web-shell attempts and delivery of a Rust-based FreeBSD implant. Check the current vendor bulletin for your appliance and investigate persistence as well as patch status. Infrastructure overlap with another campaign is an investigative lead, not sufficient attribution.

Cisco Expressway: check the cluster configuration

Cisco’s advisory describes unauthenticated command execution as root through the database service. It applies to vulnerable Expressway-C and Expressway-E devices, both virtual and appliance versions, when configured in a cluster. Cisco lists X15.5.20 as the first fixed release and provides no workaround. Include collaboration infrastructure in the patch inventory, even when a separate team operates it.

Linux KSMBD: track vendor fixes separately from development patches

ZDI lists ZDI-CAN-33774 and ZDI-CAN-33549 as pending Linux reports rated CVSS 9.0. The reported issues concern the kernel SMB server and its SMB Direct path. Do not treat a patch in a development tree as evidence that your distribution or storage appliance has shipped it.

Identify systems actually running KSMBD, confirm whether SMB Direct is enabled and check the product vendor’s status. Disable an unused service. Where it is needed, restrict SMB and relevant RDMA access to trusted clients. TCP port 445 filtering alone does not describe every SMB Direct deployment. Samba’s userspace server is a separate implementation.

Supply chain and cloud incidents: replace the access

A dependency update can remove malicious code while leaving stolen credentials usable. For these incidents, the closure check includes both the workload and the services its keys can reach.

LiteLLM 1.107.0

LiteLLM confirms compromised PyPI wheels from 11:39 to 13:23 UTC on October 21. Affected container tags included v1.107.0, latest, main-latest and main-stable, with registry-specific exposure windows in its report. Private enterprise releases were not affected.

The vendor says three engineers’ GitHub accounts were used, apparently through stolen CLI OAuth tokens. The official source tag was clean, while published artifacts contained malware. Checking the source alone would have missed the delivered payload.

Python startup files can execute the payload without importing LiteLLM. The vendor warns against starting the response with pip inside the affected environment. Isolate it, preserve evidence and rebuild from a trusted environment with a verified pinned release. LiteLLM recommends 1.106.2 or an earlier explicit version. Rotate credentials the affected host could access and review their use at the issuing services.

Railway

Railway’s October 21 notice says encrypted environment variables may have been accessed and some contents decrypted. Although the confirmed scope was still being established, it asked all customers to rotate stored secrets and private-registry credentials and review connected-service logs.

The initial deployment pause has since been eased in stages. Railway’s status updates report builds restored for Enterprise, Pro and Hobby workspaces on October 22, and invalidation of existing API tokens. Check the current status before redeployment. If an exposed key is being abused, revoke it at its provider rather than leaving it active while waiting for an application deployment.

PingCAP and TiDB Cloud

PingCAP’s incident report confirms access to internal resources using stolen service-account credentials between September 9 and October 7. Exported information included account and business details, SQL editor text and errors, and encrypted API-key values. It reports no evidence that data stored in TiDB was affected. Claims that the exported API keys were all plaintext are not established by this report.

Its customer guidance recommends replacing active TiDB Cloud management API keys as a precaution. Without suspected misuse, create replacements, migrate and test integrations, then promptly revoke the old keys. If misuse is suspected, revoke immediately. Review any credentials that appeared in SQL editor text or support exchanges against your exposure records.

Credential response · Oktsec guidance

A new key is only half of a rotation

Contain the source of exposure before placing replacement credentials in it.

Establish scopeWhich workload and which credentials?

Record the artifact or platform, exposure window, reachable secrets and their owners. Preserve evidence.

↓

Is a credential suspected of being misused?

Yes · contain immediately

Revoke and isolate

Disable the affected access at its issuer. Stop compromised workloads and follow the incident response plan, including sessions and derived credentials.

No · precautionary replacement

Replace, migrate, then revoke

Use a trusted environment. Move dependent services to new credentials, verify operation and promptly disable the old access.

↓

Both pathsVerify at the service that accepts the credential

Confirm revoked keys and applicable sessions no longer work. Check activity, permissions and spend. Record any access that remains unresolved.

eMudhra: the certificate replacement deadline matters

On October 22, eMudhra announced its withdrawal from global SSL/TLS certificate services. The company says it will arrange free replacements through partners and maintain certificate-status and revocation services until issued certificates expire or are replaced. Its other signing and enterprise services continue.

Google’s notice distinguishes blocking the compromised intermediate keys from removing their parent root. Chrome had already distributed protections against the compromised keys. Removal of emSign ECC Root CA - G3 from the Chrome Root Store is expected to reach all relying devices on the morning of October 27, Pacific time. Some legitimate certificate chains will stop working. Google instructs affected operators to obtain a certificate under another trusted hierarchy immediately.

Two sides of TLS

Check what you serve and what you trust

Website or API operator

Replace an affected chain

Inventory public endpoints, load balancers and renewal jobs. Install the new chain and test from supported clients.

Evidence: the endpoint serves the replacement.

Application or agent operator

Update the client’s trust

Check OS bundles, containers, language runtimes and embedded stores. Rebuild and redeploy where required.

Evidence: the deployed client rejects revoked trust.

Oracle separately issued Security Alert CVE-2026-91403 on October 21 for Java SE and GraalVM, rated CVSS 9.1. Review its affected-version matrix and patch instructions even if you installed the October 20 Critical Patch Update. For other runtimes, our existing trust-store guidance links the relevant maintainer updates. Do not disable TLS verification to work around a rejected chain.

Data disclosures: records, people and unresolved scope

These disclosures have different levels of certainty. Counts of log entries, accounts and affected people are not interchangeable. Accurate customer details can also make a fraudulent message convincing without exposing a password.

Separately, Papyless’s October 21 Renta! notice describes a service suspension after possible unauthorized access detected on October 18. Its scope was still under investigation. A precautionary shutdown alone does not establish data theft.

AI in attacker workflows, including Latin America

CyberCartel and CARLIY0S

Straiker’s October 21 research describes CyberCartel using CARLIY0S to coordinate activity against more than 400 financial targets in Latin America. It reports different commercial models assigned to analysis, attack development and credential-related tasks, alongside an agent framework.

The figure describes targets, not 400 verified breaches. The report is one research team’s view into an operator’s environment. It supports a concrete concern for banks and payment providers: established intrusion steps can be coordinated through reusable agent workflows.

For teams in Latin America

Review your financial-services exposure.

Banks and payment providers in Latin America can review this exposure with us in Spanish or Portuguese.

Financial services →Contact Oktsec →

BUGSTER and Indian universities

Unit 42 describes BUGSTER using Hermes Agent with DeepSeek V4 and Cursor, with safety controls disabled. Its report separates a brute-force campaign against one university from a confirmed intrusion into a second, where more than 5,200 records were exfiltrated. Those are distinct activities, not one proven chain.

For defenders, include model-provider accounts in credential investigations. Review unexpected usage, billing spikes and calls from unfamiliar identities or locations. Keep application, cloud and model access scoped separately so that a stolen integration key does not also become an administrative credential. An AI-related campaign does not remove the need to investigate the underlying service and account failures.

Also on the radar

BlackX bootkit. Kaspersky reports a bootkit campaign against diplomatic organizations in Central Asia and attributes it to APT41 with moderate confidence. Its analysis concerns startup defenses and security-update gaps. Treat the attribution as Kaspersky’s assessment. Device reviews should include firmware and boot-policy maintenance, not only the Windows patch level.

Operation Serengeti III. INTERPOL announced 1,462 arrests, disruption of 10,909 malicious networks and recovery of more than USD 105 million across 21 countries. The announcement was on October 22. The operation itself ran from June 29 to August 31, rather than during this recap’s two-day window.

What to check today

For each applicable item, record an owner, affected assets, the action taken and evidence of completion. A small team can keep this in an incident ticket. Larger organizations should reconcile it across infrastructure, development, identity and vendor-management teams.

Need help working through this list?

Oktsec can scope an assessment of your internet-facing services, build pipelines and the credentials your applications and agents can reach.

Scope an assessment →Talk to our team →

1. Verify exposed runtimes and appliances. Match deployed PHP, VCO, GitLab, Node.js and clustered Expressway versions against the relevant advisories. Verify NetScaler patches and check for attacker persistence. Review KSMBD service exposure and vendor patch status.
2. Preserve and review the relevant history. Start the PHP2Shell review at least on October 17. Include host activity and credential use. Record telemetry gaps rather than interpreting missing logs as a clean result.
3. Find affected builds. Search deployment inventories, image digests, lockfiles and CI caches for LiteLLM 1.107.0. Determine where it executed. Use a clean environment for investigation and rebuilding.
4. Complete credential replacement. Follow Railway and PingCAP guidance. For an affected host, identify every credential it could reach. Confirm revocation at the issuer, including relevant sessions or derived access.
5. Check certificate chains and client trust. Prioritize the Chrome root-removal deadline. Review Java’s separate security alert and the trust stores packaged with applications, containers and agent tools.
6. Review model-provider access. Investigate keys linked to affected systems, unfamiliar usage and unexpected spend. Replace exposed keys and remove permissions the integration does not need.
7. Prepare for targeted impersonation. Use affected vendors’ official notices to brief support and security teams. Verify unexpected account, payment and credential requests through an established channel.

For startups, the most useful starting point is a list of internet-facing services and the credentials each one can read. For enterprises, include appliances and SaaS integrations outside the central application inventory. A team cannot verify a fix or revoke access it does not know exists.

Work with Oktsec

Review the exposure in your running systems.

Scope an assessment of exposed services, runtime dependencies and the credentials your applications and agent tools can reach. For a first look at one AI workflow, start with the free workflow check.

Scope an assessment →Free workflow check →

Sources and editorial scope

This review links primary advisories, company notices, regulatory filings and original research alongside the relevant claims. It is a review of public reporting, not an Oktsec incident investigation. Vendor observations are attributed, and the figures are not combined into a total of affected organizations or people.

Uncorroborated extortion claims and alleged loss totals are excluded from the confirmed-incident summary. We also avoid inferring a shared attacker from incidents occurring in the same week. Consult the linked notices for updates after October 23.

Related reading: PHP2Shell, Node.js and eMudhra: fixes and deployment checks · Preparing for a disruptive cyber attack · AI-assisted attacks against Linux infrastructure.