October 2026 Security Incidents: Every One, Tracked

In October 2026, PHP2Shell, GitLab, LiteLLM, Railway, TiDB Cloud, Zeabur, Node.js, Plex, Tor, eMudhra, SafePay and Japan's government advisories all landed within three weeks. They are separate incidents with separate fixes. This page lists each one with its fixed version or required action, an exploitation status with its label, and a primary source, as checked on 23 October 2026. If you want the wider question of whether this was the worst month on record, that month-in-context analysis takes it on.

Every incident, tracked

Status labels: Confirmed means a primary source says it was exploited. Attempts seen means attempts were observed, not necessarily successful. Vendor-claimed means the vendor's own report, not independently verified. Not reported means the primary source does not say, which is not proof of no exploitation.

What does each incident require?

PHP2Shell

PHP2Shell is two code execution bugs in PHP itself, disclosed by the PHP project on 21 October. Updating WordPress or plugins does not fix it. AWS reported honeypot attempts from 17 October and says it is unclear whether they would have worked on real systems. Required action: get the patched PHP running on the server that serves your domain and restart the workers. The full PHP2Shell walkthrough has the version trap and the host question to send. Source: php.net.

GitLab

GitLab disclosed CVE-2026-110264 on 21 October, rated CVSS 10.0. An unauthenticated user could run code on the server under certain conditions. Affected versions run back to 7.0, which was released in 2014. GitLab.com and GitLab Dedicated were already patched. Required action: self-managed owners upgrade to the fixed patch for their line and follow GitLab's upgrade paths if they are far behind. The patch notice does not say the bug was exploited. Source: GitLab.

LiteLLM

LiteLLM says its release pipeline was compromised and that malicious versions of 1.107.0 reached PyPI, Docker Hub and GHCR on 21 October. Its official source tag was clean. Earlier versions and its private enterprise registry were reported unaffected. Required action: if an environment ran 1.107.0, treat it as compromised, rebuild it, pin an earlier release and rotate every secret the host could reach. Finding no malicious file does not prove the environment is clean. Source: LiteLLM report.

Railway

Railway detected anomalous activity in systems storing customer environment variables and says an unauthorised party may have accessed encrypted values and decrypted some. It has not published a final account or a customer list. Required action: rotate every variable stored in Railway, review logs for those services and create new API and project tokens, because Railway invalidated the old ones on 22 October. Its status incident was still open on 23 October. Source: Railway.

TiDB Cloud

PingCAP reports that an unauthorised party used stolen service-account credentials between 9 September and 7 October to reach internal systems, copy data and obtain source code. PingCAP says it has no evidence that data in customer TiDB databases was affected, and that it is still mapping the exported data to customers. Required action: replace TiDB Cloud API keys, verify your applications, then revoke the old keys. Treat unexpected billing or contract emails with suspicion and verify them through a known channel. Source: PingCAP.

Zeabur

Zeabur's preliminary report describes a second breach on 14 and 15 October. Attackers used internal credentials, read the platform database and signed in to 101 GCP dedicated servers as root. Separately, Zeabur announced on 17 October that it is winding down, with shutdowns between 1 and 31 December. Required action: replace every credential stored in Zeabur, create new access tokens, change database passwords inside shared-cluster databases, and rebuild affected GCP servers. Sources: incident report, shutdown notice.

Node.js

The Node.js project shipped security releases on 21 October covering ten CVEs, four rated High. They include a Brotli decoder out-of-bounds write that can lead to remote code execution when an application decompresses attacker-supplied data, and TLS hostname-check flaws. The release also updates the bundled CA list for the eMudhra incident. Required action: upgrade to 22.23.4, 24.22.1 or 26.12.1, rebuild images and leave end-of-life lines. No credential rotation is called for. Source: Node.js.

Plex

Plex fixed four related flaws in Plex Media Server 1.43.3.10861 and says that, chained, they let an unauthenticated attacker run code as the server process. Plex reports widespread attacks on unpatched internet-facing servers, used for cryptocurrency miners and proxy software. CISA added all four CVEs to its KEV catalog on 20 October. Required action: update, and if the server was reachable before patching, follow Plex's rebuild and sign-out steps. Source: Plex.

Tor

On 5 October the Tor Project told relay operators that some Linux relay hosts had been compromised and their configuration changed to intercept SSH connections. The directory authorities are rejecting flagged relays. A researcher, kaba, reported 333 of roughly 3,000 tested exits redirecting SSH. That count is theirs, not Tor's. Required action: operators audit, reinstall and generate a new relay identity. SSH users treat an unexpected host-key change as a warning, as the SSH interception write-up explains. Source: Tor Project.

eMudhra

Mozilla received a report on 17 October that the private keys of eight eMudhra intermediate certificates were weak enough to recover almost immediately. Six are TLS intermediates and two are for code signing. Mozilla blocked them in Firefox the same day and eMudhra revoked all eight on 18 October. Required action: keep browsers and operating systems current, update runtime and container trust stores, and rebuild images with stale bundles. The Firefox, NSS and Chrome root changes are in the linked sources. Source: Mozilla.

SafePay

CISA, the FBI and partners published advisory AA26-293A on 20 October about the SafePay ransomware group. The authors say it has affected at least 600 organisations since August 2024. That is the advisory's estimate, not a published victim list. It lists stolen credentials, phishing, VPN abuse and unpatched internet-facing systems as entry routes. Required action: patch edge and VPN devices, require multifactor authentication, limit admin rights and test offline backups. Source: CISA.

Japan advisories

On 9 October the Japanese government's National Cybersecurity Office issued an advisory after repeated unauthorised-access incidents that led to personal-data leaks. At a ruling-party meeting the same day, the chair of its cybersecurity headquarters described the situation as an emergency (what happened). The party's own account reports no formal declaration. Required action: organisations in Japan assess web-system vulnerabilities, supplier access and monitoring, as the advisory asks. Source: National Cybersecurity Office.

How do I use this page?

Find the products you run or the platforms that hold your secrets. Read only those rows. The fixed version or action column says what to do, and the primary source says why.

Rows with a version number are for people who run the software. Rows about platform breaches (Railway, TiDB Cloud, Zeabur, LiteLLM) are about secrets: what a host could read is what you rotate. Rows about advisories (SafePay, Japan) have no single patch and ask for general hygiene.

Every row carries the date we checked it. These pages move, so open the primary source before you act on a version number. We update this page when a source changes, and the date at the top changes only when a row does.

What are we not saying, and why?

We leave out several claims that spread alongside these incidents. They fall into five groups.

• Data volumes and extortion figures for a platform breach. The vendor's own report does not support them, and the vendor says the attacker's claims in support materials are unverified.
• Victim counts and named victims. Where a number appears here, it is an advisory's or vendor's estimate and is labelled as one. We name no affected customer.
• Claims of declarations. A party official's remarks about an emergency are not a government declaration, and we found no declaration in the sources.
• Sweeping descriptions of scope. The LiteLLM incident is one version. The Railway disclosure covers a subset that Railway has not yet defined. Neither is "everything".
• Origin stories for bugs. An old affected version number is not the date a bug was introduced.

Our rule is simple. A fact goes in this page when a vendor advisory, CVE record, CISA entry or official status page says it, and the link sits next to it. Everything else is a lead until a primary source confirms it. If a source we cite changes, tell us and we will re-check.

For your own site, the checklist for this week is the shortest path from this table to a to-do list. The same events with dates are in the 2026 incident timeline, and the other incident write-ups cover each in depth.