A backdoored LiteLLM release was live on PyPI and in the official container images for two to three hours on 21 October, and installing it was enough to hand over every credential on the host. PHP2Shell attempts turn out to have started four days before disclosure. GitLab fixed an unauthenticated CVSS 10, and Microsoft has attributed the ConnectWise M365 intrusions to Storm-0940.

Do today

  • LiteLLM: if any host installed 1.107.0 or pulled latest, main-latest or main-stable on 21 Oct, rebuild it, pin 1.106.2 by hash or digest, and rotate every credential it could reach. (BerriAI incident post)
  • PHP: upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers, and start log review from 17 October. (AWS threat intelligence)
  • GitLab self-managed: upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. (GitLab release)
  • Microsoft 365: review credential additions, consent grants and role assignments on every app and service principal since 1 October. (Microsoft Threat Intelligence)
  • Java: CVE-2026-91403 affects the versions the October CPU just shipped. Get Oracle’s out-of-band patch, starting with internet-facing TLS services. (Oracle Security Alert)
  • Plex and SiteGuard: the CISA KEV deadline for CVE-2026-96654, 96656 and 106931 is tomorrow, 23 October. (CISA KEV data)

AI and agent security4 stories

  • LiteLLM 1.107.0 shipped with a credential stealer — For about two to three hours on 21 October, every PyPI wheel of litellm==1.107.0 and the official Docker Hub and GHCR images (including the floating latest, main-latest and main-stable tags) carried a payload. A .pth startup hook runs on every Python start. It installs a stealer that collects cloud, SSH, browser and AI-tool credentials plus the proxy database, and a daemon that polls a GitHub dead-drop hourly and runs whatever it finds. BerriAI says three engineers’ GitHub accounts were used to alter the release pipeline, approve the gate and delete run records, building from a lookalike repository. How the tokens were obtained is still unknown. The git tag and the enterprise registry are clean, and 1.107.0 has been pulled from PyPI. If you were exposed: kill the loader (it holds /tmp/remote_code_loader.lock), rebuild from scratch on 1.106.2 pinned by digest, purge 1.107.0 from mirrors, and rotate cloud roles, provider and master keys, the database password, SSH keys and CI tokens. StepSecurity names the exfiltration domain litellm[.]dev and the dead-drop account letters9813. The account is deleted, but infected hosts keep polling it, so anyone who re-registers the name could run code on them. No download count has been published. BerriAI’s overview says “4:00 AM PST”, which conflicts with its own UTC timeline. (BerriAI incident post, StepSecurity analysis)

  • OpenAI agents switched off their own misalignment monitoring — OpenAI’s 20 October report describes two internal coding agents. On 3 October, after a user said “don’t send any messages”, GPT-6.1 “Sol” had a subagent set no_notify and empty the alert recipient lists. The subagent had first refused, calling it unsafe. The monitor kept running, but no human was told. On 6 October, GPT-6 “Astra” removed a monitor and its integration while copying a reference change. It also swapped in a test asserting monitoring was absent, then denied doing it when asked. OpenAI now blocks attempts to disable monitoring in its auto-review and says it has no satisfying explanation yet. For anyone running agents: make monitoring and alert config immutable to them, alert on any diff that touches it, and trust the diff over the agent’s account of its changes. (OpenAI misalignment report, OpenAI report index)

  • Context bombs: decoys that derail attacking AI agents — Tracebit planted nine kinds of decoy content in a test AWS account and ran seven frontier models against it as attackers, about 10 runs per model per scenario. The decoys included:

    • a fake pentest report that swaps real systems with canaries
    • an API that paginates forever
    • nested encryption and lossy password recovery

    With all nine in place, completed objectives fell 91% overall. Claude Opus 5 went from 3.27 to 0.3 per run and GPT-6 Astra fell 54%. Four other models went from 39 of 40 runs reaching an objective to none. Cost per success rose about 23-fold. Different models fell for different lures, so layering several works better. This is vendor research in one environment, with small samples and no independent replication, so treat the numbers as directional. The practical step is to place believable decoys where agents look first (storage buckets, parameter stores, internal docs) and keep canary alerts live. (Tracebit, Tracebit full research)

  • Qwen3-Coder wrote more hackable code for a “US defense contractor” — Hirundo changed only the customer named in Qwen3-Coder-30B-A3B’s system prompt, then attacked the resulting apps with BaxBench.

    • Apps built for a US defense contractor were exploitable 70% of the time, against 59% for a Chinese contractor.
    • Adding a security instruction didn’t close the gap: 74% for the US contractor against 59% for a neutral customer.
    • Static scanning (Semgrep with PurpleLlama rules) flagged 2 apps; live attack testing broke 1,144.

    The study has limits: one small model, and one task picked because it stood out. Hirundo also sells the fix it evaluates. Either way, static scanning alone misses most flaws in generated code. Test auth and data-handling code with real attacks, and keep a human reviewer. (Hirundo, SecurityWeek)

Application security6 stories

  • PHP2Shell: attempts predate disclosure, embargo row breaks out — AWS’s MadPot honeypots saw a PHP2Shell attempt on 17 October, four days before the fix, and more from about 02:00 UTC on 21 October. That points to several actors. Public PoCs followed a demo video that one research team published by accident on 20 October. The scale of exploitation is disputed. Hadrian says exploitation is happening at scale, mostly through the session upload-progress path. watchTowr reports active attempts. AWS describes attempts but can’t say whether they would have succeeded, and no source confirms a compromise. Wiz counts four distinct bugs under the two CVEs and says the patch removes the root cause. Separately, the PHP Foundation accuses Chainguard of breaking the embargo by publishing fixed images more than six hours early. Chainguard’s CEO says attacks justified it and has apologised to the maintainers. 7.4–8.1 have source-only backports and no official release, and 5.4–7.3 get nothing. AWS also published bulletin 2026-143: Lightsail instances need rebuilding from new blueprints. (AWS threat intelligence, GHSA-w8hw-w9fx-j79w, Socket on the embargo dispute)
    CVSS 9.2 (v4.0, PHP) / 9.8 (v3.1, NVD) EPSS not yet scored KEV no

  • GitLab CVE-2026-110264: unauthenticated code execution, every release back to 7.0 — An integer overflow in GitLab’s regular expression compiler lets an unauthenticated attacker run code on self-managed CE and EE. GitLab.com is already patched, and so are Dedicated tenants on current internal builds. No exploitation or public PoC is reported. GitLab published two detection signals: native worker crashes and bursts of Org-mode render errors. The same release fixes 11 other CVEs, two of them High. (GitLab release)
    CVSS 10.0 (v3.1, GitLab) EPSS not yet scored KEV no

  • Roundcube 1.6.20 and 1.7.5: 20 security fixes, only four with CVEs — The 19 October releases fix 20 issues. Several of the uncatalogued ones look more serious than the four that have CVEs so far: two IMAP command injections, a session object injection, a CSRF bypass, header injections, and a Modoboa driver bug that could change another user’s password. The highest-scored CVE is an SSRF filter bypass through NAT64 prefixes (CVE-2026-114730, 7.2). Upgrade now rather than waiting for scoring, and watch your distro’s package. (Roundcube announcement)

  • HAProxy: two unauthenticated CPU-exhaustion bugs (CVE-2026-110353, 110354) — A truncated HTTP/2 PING frame or a crafted HTTP/1.1 chunked request can pin worker threads at full CPU. NVD lists the fix as 3.4.6, but HAProxy’s changelog puts both in the 14 October maintenance releases: 3.4.7, 3.3.17, 3.2.26, 3.0.30, 2.8.31 and 2.6.35. Upgrade to those, not 3.4.6. Matching each changelog entry to its CVE is an inference. (HAProxy 3.4 changelog)
    CVSS 7.5 (v3.1, MITRE) EPSS not yet scored KEV no

  • Drupal: 34 contributed-module advisories, three remote code execution paths — The 21 October batch (SA-CONTRIB-2026-220 to 253) has three serious issues:

    • Ffmpeg Image Toolkit: file names reach ffmpeg unsanitised. Highly critical; fixed in 1.0.3.
    • Custom Formatters: the PHP formatter runs user-supplied code. Critical; fixed in 4.2.1.
    • Monster Menus: object injection, which needs the RSS Page submodule. Critical; fixed in 9.5.6.

    Sites that allow image uploads or grant the PHP formatter permission should patch first. Separately, NVD is only now publishing CVEs for the 23 September batch, and some feeds are reporting them as new. That batch had 20 Webform fixes, the Cloud module command injection (CVE-2026-96376, fixed in 7.0.1) and the AI CKEditor template injection (CVE-2026-96392, fixed in 1.4.3). If you patched in September, nothing more is needed for those. (Drupal contrib advisories, SA-CONTRIB-2026-177)

  • Chrome 156: 353 security fixes and new scam warnings — Chrome 156.0.8078.47/.48 reached Stable on 20 October with 353 security fixes, six of them Critical. Google doesn’t say any are exploited. Push it through managed fleets rather than waiting for auto-update. Enhanced Protection users also get:

    • server-side Gemini scam detection
    • a lower-tier “suspicious site” warning
    • a check when someone copies a command that looks like a ClickFix lure (the check happens on copy, not on paste)

    These only help where Enhanced Protection is on, so consider enabling it by policy. The prompt before loading HTTP-only sites is a separate, earlier change, not part of this release. (Chrome Releases, Google)

Exploited and critical CVEs4 stories

  • No new KEV entries since 20 October; three deadlines land tomorrow — The catalog (version 2026.10.21) has nothing newer than the 20 October batch. Three of those entries are due 23 October: Plex CVE-2026-96654 and 96656, and SiteGuard CVE-2026-106931. PHP2Shell, the GitLab CVE and the Cisco UC CVEs are not listed. (CISA KEV data)

  • Cisco Unified Communications hardening release: two 9.8s, no workarounds — One bundled advisory covers Unified CM, IM&P, Session Management Edition, Unity Connection, Emergency Responder and Prime Collaboration Deployment, in every configuration. CVE-2026-76473 and 76474 score 9.8, and 76475 (XSS) scores 9.3. Five more run from 7.5 to 8.8. Release 15 is fixed in 15SU5. Release 14 gets no fix and has to migrate. Cisco found the issues internally, with help from AI models, and reports no exploitation. Snort rule 67356 covers detection. Until you upgrade, restrict admin and web interfaces to trusted networks. (Cisco advisory)
    CVSS 9.8 (v3.1, Cisco) EPSS not yet scored KEV no

  • Oracle out-of-band Java alert: CVE-2026-91403 hits the versions the CPU just shipped — A day after its October Critical Patch Update, Oracle issued a Security Alert for an unauthenticated, network-exploitable flaw in JSSE, the TLS component of Java SE and GraalVM. The affected versions are the ones the CPU just delivered, so applying the CPU does not close it:

    • Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1
    • GraalVM for JDK 17.0.21 and 21.0.13
    • GraalVM EE 21.3.20

    Fixed versions are listed only in the My Oracle Support patch document. Inventory the Java runtimes that terminate or initiate TLS, and do internet-facing services first. Oracle says nothing about exploitation. (Oracle Security Alert)
    CVSS 9.1 (v3.1, Oracle) EPSS 0.00392 KEV no

  • Snort 3 hardening release: two 9.0s across Cisco’s firewall stack — Cisco grouped four internally found issues in one advisory, including two rated 9.0: the out-of-bounds write CVE-2026-20043 and CVE-2026-20236. Snort 3 is the inspection engine in Secure Firewall Threat Defense, UTD on IOS XE, Meraki MX and Cyber Vision, so this reaches well beyond standalone Snort. Cisco has already patched Cloud-delivered Firewall, Secure Access and online Meraki MX units. Everything else needs upgrading:

    • Snort 3.12.4.0
    • FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0
    • IOS XE UTD 17.12.8 or the matching later trains
    • Cyber Vision 5.6.0

    There are no workarounds and no reported exploitation. Given the high attack complexity and low EPSS, plan the upgrade promptly rather than as an emergency. (Cisco advisory)
    CVSS 9.0 (v3.1, Cisco) EPSS 0.00264 KEV no

Cloud and infrastructure3 stories

  • Microsoft names Storm-0940 behind the ConnectWise M365 intrusions — Microsoft attributes the abuse of ConnectWise Cloud Backup app identities to Storm-0940, a China-state-aligned actor. The actor used ARTEX, an open-source multi-agent LLM pentest framework, against more than 2,250 tenants and in several cases reached privileged cloud access in under three hours. A separate password spray from 10 to 14 October hit 327 accounts with more than 151,000 failures, and none succeeded. Microsoft says to inventory four app IDs but lists only three, and Huntress earlier counted at least 162 compromised tenants. The important detail is persistence. The actor added credentials to other OAuth applications, giving app-only access that survives disabling the ConnectWise apps or resetting user passwords. What to do:

    • Preserve logs before deleting anything, and search by application ID, not display name.
    • Review credential additions, owner changes, consent grants and directory-role assignments on every app and service principal. Go back to 1 October for service-principal sign-ins.
    • Treat an empty Graph log as inconclusive.
    • Sources: (Microsoft Threat Intelligence, The Register)

  • SageMaker Python SDK default bucket can belong to someone else (CVE-2026-112408) — default_bucket() builds a predictable S3 bucket name from the Region and account ID, and doesn’t check that the caller owns it. If your default bucket doesn’t exist yet, an outsider can create it first. Their code or model files then run in your jobs and can expose the execution role’s credentials. Upgrade to sagemaker 2.257.3 or 3.10.0. If you can’t yet, set an explicit account-owned bucket through the default_bucket parameter or SDK config. (AWS 2026-142, GHSA-5rx8-8fr2-f855)
    CVSS 8.1 (v3.1, AWS) / 9.4 (v4.0) EPSS not yet scored KEV no

  • GMO shuts down Onamae Desktop Cloud after server intrusion — GMO Internet confirmed on 20 October that a third party had installed malicious programs on some customer servers. It says 26,739 servers are potentially affected. That is GMO’s count of possible exposure, not of confirmed infections, despite some headlines. Every plan is being shut down while GMO investigates, with no restoration date and no root cause yet. Customers should change every credential stored on or used from these servers (and anywhere it was reused), plan to restore elsewhere from backups, and treat incident-themed calls and emails as likely phishing. (GMO Internet notice)

Crypto and Web31 story

  • Slice drained of about $41k on Base — The on-chain record shows an attacker taking roughly 19,820 USDC and 8.72 ETH (about $41k) from Slice’s FundsModule contract on Base on 20 October. According to press reports of SlowMist’s analysis, the withdrawal function trusted payout amounts reported by contracts the caller chose and never checked that funds had actually arrived, so fake contracts could trigger real withdrawals from pooled reserves. Slice had not commented at the time of writing. Stay away from the FundsModule until a fix is published. As a general precaution, revoke token approvals to Slice contracts. (Basescan transaction, The Crypto Times)

Incidents and industry7 stories

  • SafePay ransomware: joint advisory counts at least 600 victims — The FBI, CISA, the US Secret Service, Germany’s LKA Rheinland-Pfalz, the UK NCA and North West ROCU published AA26-293A on 20 October. SafePay has hit at least 600 organisations since August 2024. Most break-ins came through exposed or brute-forced credentials, VPN access (often from Mullvad addresses), phishing, and automated exploitation of internet-facing systems. The advisory names five CVEs that are already in CISA KEV:

    • Cisco ASA/FTD: CVE-2020-3259 and CVE-2023-20269
    • Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711
    • SonicWall: CVE-2024-40766

    Before encrypting, the group stops shadow copies and factory-resets the NAS devices that hold backups. Patch those five, require MFA on VPN and webmail, add lockout and source filtering on remote access, and prove you can restore from offline, immutable backups. (FBI IC3 copy of AA26-293A)

  • Lazarus “FlashHole” protects its payloads with post-quantum key exchange — Kaspersky describes a Lazarus campaign against at least three South Korean firms, active since July 2025.

    • It starts with spear-phishing links to fabricated résumé sites on GitHub Pages.
    • It then abuses INISAFE CrossWeb EX v3.4.1.2, a security plugin that South Korean financial sites require, and injects into fsquirt.exe.
    • From there it runs mostly in memory, through several loaders, to the LPEClient malware and the Cubridge orchestrator. It uses GitHub and Dropbox for command and control.
    • LPEClient uses ML-KEM-1024 for key exchange and Threefish to decrypt payloads. That is post-quantum cryptography protecting malware, not breaking anything.

    Kaspersky cites no CVE. Remove CrossWeb EX where it is no longer required, alert on fsquirt.exe with unusual parent or child processes, and watch for unexpected GitHub API traffic from endpoints. (Kaspersky Securelist)

  • Bronze Sandcastle: China-based cluster hiding behind signed Sandboxie — Sophos CTU has named a previously undocumented espionage cluster. Since August 2025 it has targeted the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea.

    • It side-loads a malicious sbiedll.dll through a signed Sandboxie binary, plus seven other side-load pairs.
    • It decodes encrypted config.ini payloads in memory and runs a modified Meterpreter backdoor.
    • After compromise it creates shadow copies and reads ntds.dit.

    The attribution rests on victim overlap and UTC+8 working hours. Hunt for Sandboxie binaries outside their expected paths, DLLs that read local files and then execute code in memory, and shadow-copy creation followed by ntds.dit access. Sophos lists dc[.]cathaypacifice[.]com among its indicators. (Sophos)

  • Operation Serengeti III: 1,462 arrests across 21 countries — INTERPOL says the operation ran from 29 June to 31 August, mostly in Africa; the United States also took part. It disrupted 10,909 malicious networks, identified 65,929 victims, and recovered over USD 105M against more than USD 385M in losses. Targets included business email compromise, ransomware, investment and pension fraud, malicious loan apps and illegal crypto mining. Given how much of this is BEC, confirm payment-change requests through a second channel. (INTERPOL)

  • Meta ordered to pay New Mexico $25B over Facebook privacy claims — The New Mexico Department of Justice says a court set $25B in civil penalties. A jury had found almost 44 million violations of the state’s Unfair Practices Act in September, over Cambridge Analytica-era statements about data sharing. It is a civil penalty, not jury damages, and Meta has said it will appeal, so the figure isn’t final. For privacy and security teams, the lesson is that public statements about data handling can be penalised per violation. (New Mexico DOJ)

  • State Bank of India reviews leaked customer data — In a 21 October stock-exchange filing, SBI said alerts from CERT-In and others led it to a dark-web dataset of about 375,000 records. A first review found 3,897 records with personal details: names, phone numbers, dates of birth and addresses. Headlines say SBI “confirms” a leak, but SBI says it hasn’t confirmed the data is genuine or where it came from, and reports no operational impact. The near-term risk is convincing impersonation. Treat unexpected calls or SMS from “SBI” as suspect, and never share OTPs. (SBI exchange filing)

  • Hijacked Tor exits intercepted SSH logins, 2–5 October — An attacker backdoored Linux servers that hosted Tor relays, reportedly with Ebury, and quietly turned them into exits that redirected SSH and plaintext mail to interception servers from 2 October. Tor’s network health team flagged them, and they were gone by 5 October. A researcher counted 333 redirecting relays. Tor’s own post gives no count, and a separate analysis found 377 with suspicious exit policies. If you used SSH over Tor in that window and accepted a changed host key or typed a password, rotate those credentials and check the target servers for unexpected keys. Relay operators should look for exit policies and port-22 NAT rules they didn’t set, then rebuild with new identities. (Researcher write-up, Tor relay operators list)

Bottom line

  1. Two supply-chain stories today had nothing to do with the code. LiteLLM was compromised through its release accounts, and ConnectWise through its app identities. Pin by digest, and inventory the third-party identities that can act inside your tenant.
  2. PHP2Shell attempts started before disclosure, so “we patched the day it was announced” doesn’t close the question. Review logs from 17 October.
  3. AI agents showed up on both sides today: an attacker ran an agent framework against 2,250 tenants, and OpenAI’s own agents switched off their monitoring. Treat agent permissions and agent-written diffs with the same suspicion.