October 2026 Security Checklist: What to Do This Week

The October 2026 incidents ask for different things depending on what you run. Website owners need one answer from their host about PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Teams running servers need patches for GitLab, Node.js and Plex, and fresh secrets for Railway, Zeabur, TiDB Cloud and LiteLLM. Pick your role below, tick the items, and keep the evidence.

If you own a website or store

Your job this week is one question to your host, plus a few checks. Details are in the full PHP2Shell explainer and in the 10-minute response guide.

• PHP2Shell: send your host the question below and keep the reply. PHP runs WordPress, WooCommerce, Magento and most other PHP stores, and the flaw sits in PHP, not in your plugins. Source: php.net notice.
• Not sure who patches? Settle it in writing. See how to pin down who owns patching.
• Shared hosting: use the provider question guide and do not treat a silent status page as "patched".
• Admin accounts: look for administrator users and scheduled tasks you did not create. The CISA advisory on SafePay lists compromised accounts among its initial access routes (AA26-293A).
• Browsers and devices: keep them updated. Mozilla blocked eight eMudhra intermediate certificates after weak keys were found (Mozilla).

The question for your host:

For [your domain], is the PHP runtime that serves web requests patched for CVE-2026-109618 and CVE-2026-109619? Please give the fixed package, build or backport identifier, confirm that all PHP-FPM, CGI or Apache workers serving it have been restarted or replaced, and say whether I need to redeploy or change a setting.

If you run an agency or manage client sites

Your risk is the list you cannot see. Build it before you patch anything.

• Inventory: for every client, record domain, host, whether it serves PHP, and who patches it.
• PHP2Shell, per site: send the host question above for each client domain. Record the answer as detected, unknown or confirmed by owner evidence (see the self-test below). Source: php.net.
• Hosts that publish nothing: record "unknown" and ask. Do not mark a client as patched because a panel shows "8.3". The guide to patching the PHP runtime explains why.
• Your own tooling: if you host GitLab for client code, check it against the fixed versions in the server section. GitLab lists detection rules for self-managed instances and does not say that successful exploitation is confirmed (GitLab).
• Client deploy platforms: if any client keeps secrets on Railway, Zeabur or TiDB Cloud, start the rotation steps in the next two sections.
• Tell clients what you know: send the dated state per site, not "all patched".

If you run your own servers or a startup stack

Work in this order. Each line names the incident it comes from.

• PHP2Shell: install the vendor's patched PHP package, restart PHP-FPM or Apache, and rebuild container images that bundle PHP. Check the web runtime, not php -v. Source: php.net, which also posted a follow-up informational notice on 23 October about session upload progress.
• GitLab, CVE-2026-110264 (CVSS 10.0): self-managed CE and EE are affected from 7.0 up to the fixed releases 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. GitLab.com is already patched. Follow GitLab's upgrade path rather than jumping versions; how to check your GitLab version and upgrade walks through it. Source: GitLab.
• Node.js, 21 October releases: upgrade to 22.23.4, 24.22.1 or 26.12.1, then rebuild images and CI runners. The release includes a Brotli remote code execution fix (CVE-2026-111497), TLS hostname fixes, and an updated certificate bundle for the eMudhra weak-key incident. Source: Node.js.
• Plex: update to 1.43.3.10861 or newer. Plex reports active, widespread attacks and CISA added the four CVEs to its KEV catalog on 20 October. Disable Remote Access if you do not need it; closing a self-hosted Plex server covers the rest. Source: Plex.
• Railway: Railway says an unauthorized party may have accessed encrypted environment variables and decrypted some. Roll every variable stored there and your registry credentials, following the Railway rotation steps. Source: Railway.
• Zeabur: replace every credential in your Zeabur environment variables, revoking each at its provider first, then redeploy. Shared-cluster users also change passwords inside their databases; the Zeabur customer guide has the order. Source: Zeabur preliminary report.
• TiDB Cloud: PingCAP recommends replacing TiDB Cloud management API keys as a precaution; see what to rotate for TiDB Cloud. Source: PingCAP.
• Trust stores: update OS, runtime and container trust bundles for the eMudhra intermediates. Source: Mozilla.
• Edge devices and backups: the SafePay advisory asks you to patch internet-facing VPNs and firewalls, prioritise KEV entries, require MFA, and keep offline, immutable, tested backups. Source: CISA AA26-293A.

If you run AI or LLM tooling

• LiteLLM 1.107.0 only: the maintainer says malicious PyPI and container artifacts were live on 21 October (PyPI 11:39 to 13:23 UTC, Docker Hub 11:46 to 14:20 UTC). Run pip show litellm and compare the image digest in the report. Earlier versions and the official source tag are not affected, per the maintainer. Source: LiteLLM.
• If it ran: do not start Python or pip in that environment first. Rebuild from scratch (the LiteLLM compromise write-up has the detail), pin litellm==1.106.2 or an earlier release, and rotate the instance role, every provider key in the proxy database, master and virtual keys, the database password and any secret the host could read. Absence of the listed files does not prove a clean host.
• Provider keys on Railway or Zeabur: Railway says it asked inference providers to revoke keys proactively. Revoke at the provider and issue new ones.
• Inventory your AI credentials: list every model key, where it is stored, and who can read it. This is the work you need to do in the first hour of the next incident.
• Pin and verify: pin exact versions and image digests, and stop pulling latest into production.

What not to do

• Do not restore a backup and stop. A restore does not close the hole or change a single key.
• Do not trust a version string. Backports keep the old number, php -v reports the command-line PHP, and a panel selector shows a branch.
• Do not mark a site patched because the host is silent, or because a scan showed nothing.
• Do not rotate every password in sight. Rotate what the vendor named, then what the affected host could read.
• Do not repeat viral numbers. Use the vendor's page and its date.

Am I affected? A three-state self-test

The live status of every incident above is in the running tracker of October incidents. Dates and versions in this checklist were checked against the linked vendor pages on 23 October 2026. These pages move, so open the link before you act on a row.