1. Red
  2. Learn
  3. Other incidents

Security incidents: dated write-ups and what to do

Dated October 2026 incident write-ups for site owners and developers: GitLab, Plex, LiteLLM, Node.js, Railway and more, with fixed versions and what to rotate.

This topic collects incidents that do not fit a single platform: critical bugs in tools you host, supply chain compromises and breaches at services that hold your secrets. Each write-up separates what the vendor confirmed from what is still unconfirmed, and says what to update, check or rotate. If you run any of the software below, the dates matter, because patches and advisories keep moving.

What matters right now

  • GitLab CVE-2026-110264 is rated CVSS 10.0 and affects self-managed releases from 7.0 up to 18.11.13. GitLab lists fixed releases for every supported line, and its patch notice reports detected attempts.
  • Plex Media Server has four CVEs fixed in 1.43.3.10861, and CISA added them to its Known Exploited Vulnerabilities catalog on 20 October 2026.
  • LiteLLM 1.107.0 only was compromised on PyPI and Docker in exact time windows. LiteLLM's incident notice says to rotate everything the host could read.
  • Node.js shipped fixes on 21 October 2026 for a Brotli RCE and several TLS and certificate-validation CVEs, in 22.23.4, 24.22.1 and 26.12.1, per the Node.js release notice.
  • Railway says secrets may have been decrypted and told users to rotate everything, according to its 21 October disclosure.

Where to start

  • If you host GitLab yourself, check which version you run and the upgrade stops, then read the CVE details and fixed releases.
  • If you run Plex, read the exploited-in-the-wild update notes, then how to close the server down.
  • If you install Python packages or pull container images, see the LiteLLM 1.107.0 check.
  • If you deploy on Node.js, the October patch list shows your fixed version.
  • If your app lives on Railway, follow the rotation order.
  • If you use TiDB Cloud, read what PingCAP says was taken and which keys to rotate.
  • If you host on Zeabur, the customer guide covers the December dates.
  • If you want the wider picture, the 2026 incidents timeline dates each event with its source.

Red by run.cloud offers a free scan that reads the stack your site serves and matches versions to known vulnerabilities, one per domain, no card.

Every other incidents guide

2 articles, newest update first. Each one is dated and points at its primary sources.

Check your own site

The free scan reads the stack your site serves and matches each version to known vulnerabilities. Updated 24 October 2026.

Other topics