{
  "date": "2026-10-23",
  "watches": [
    {
      "id": "night",
      "ranAt": "2026-10-24T02:45:00Z",
      "note": "First log of the new watch. Patch tonight: PHP2Shell (exploited), GitLab/Ruby regex RCE, and Node's Brotli bug, now shown to run code. LiteLLM carried in from Oct 21."
    }
  ],
  "items": [
    {
      "id": "litellm-1-107-0-compromise",
      "severity": "critical",
      "kind": "compromise",
      "ecosystems": [
        "PyPI",
        "Docker",
        "AI models"
      ],
      "packages": [
        "litellm==1.107.0",
        "ghcr.io/berriai/litellm:v1.107.0",
        "docker.io/litellm/litellm:v1.107.0"
      ],
      "title": "LiteLLM 1.107.0 shipped a credential stealer on PyPI and in its Docker images",
      "summary": "On Oct 21 a release built from a lookalike repository pushed backdoored litellm 1.107.0 wheels to PyPI and matching images to GHCR and Docker Hub. The payload runs on every Python start via a .pth file, harvests cloud, CI, SSH and AI-tool credentials (and proxy provider keys when DATABASE_URL is set), and polls for remote code hourly. PyPI pulled the release in under two hours; the latest and main-stable Docker tags pointed at the bad image for roughly 2.5 hours. Researchers report the 1.106.x line as clean.",
      "action": "Search lockfiles, image digests and mirrors for 1.107.0. If it ran anywhere with network access, rebuild that environment, pin litellm==1.106.2, block litellm.dev, and rotate every credential the host could reach.",
      "ids": [],
      "sources": [
        {
          "name": "StepSecurity",
          "url": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer"
        },
        {
          "name": "Help Net Security",
          "url": "https://www.helpnetsecurity.com/2026/10/22/litellm-compromised-supply-chain-attack-pypi-docker/"
        },
        {
          "name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/"
        }
      ],
      "addedAt": "2026-10-24T02:45:00Z",
      "watch": "night",
      "thread": "litellm-1-107-0-compromise",
      "status": "patched",
      "checks": [
        {
          "label": "Installed version",
          "cmd": "pip show litellm 2>/dev/null | grep -i '^version'"
        },
        {
          "label": "Lockfiles and requirements",
          "cmd": "grep -rnE 'litellm.{0,4}1\\.107\\.0' --include='*.txt' --include='*.lock' --include='*.toml' --include='*.cfg' ."
        },
        {
          "label": "Backdoor files on disk",
          "cmd": "find / -path '*site-packages*' \\( -name cook.pth -o -name cook.py \\) 2>/dev/null"
        },
        {
          "label": "Container images",
          "cmd": "docker images --digests | grep -i litellm"
        }
      ]
    },
    {
      "id": "gitlab-onigmo-rce-cve-2026-110264",
      "severity": "critical",
      "kind": "vulnerability",
      "ecosystems": [
        "Dev infrastructure",
        "RubyGems",
        "Runtimes"
      ],
      "packages": [
        "GitLab CE/EE < 19.5.1",
        "ruby < 4.0.9 / 3.4.12 / 3.3.13"
      ],
      "title": "GitLab CVSS 10 RCE through Ruby's regex engine; Ruby ships matching fixes",
      "summary": "GitLab's Oct 21 critical patch release fixes an unauthenticated remote code execution bug triggered by a crafted Org-mode file, rooted in an integer overflow in Onigmo, the regex engine inside Ruby. Fixed GitLab versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already patched. On Oct 23 the Ruby team released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying regex bugs. It is not in CISA KEV yet, but public repositories claiming proofs of concept have appeared.",
      "action": "Upgrade self-managed GitLab now (older than 18.11 means following upgrade stops to 18.11.13 or later). Update Ruby on self-compiled installs and on any service that compiles regexes from untrusted input.",
      "ids": [
        "CVE-2026-110264"
      ],
      "sources": [
        {
          "name": "Konfirmity",
          "url": "https://www.konfirmity.com/advisories/gitlab-critical-patch-release-19-5-1"
        },
        {
          "name": "Convika",
          "url": "https://convika.com/blog/gitlab-critical-patch-cve-2026-110264/"
        },
        {
          "name": "ruby-lang.org",
          "url": "https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"
        }
      ],
      "addedAt": "2026-10-24T02:45:00Z",
      "watch": "night",
      "thread": "gitlab-ruby-onigmo-rce",
      "status": "patched",
      "checks": [
        {
          "label": "GitLab version (Omnibus)",
          "cmd": "cat /opt/gitlab/embedded/service/gitlab-rails/VERSION"
        },
        {
          "label": "Ruby version",
          "cmd": "ruby -v"
        }
      ],
      "match": [
        "gitlab-ce",
        "gitlab-ee"
      ]
    },
    {
      "id": "nodejs-oct-2026-security-release",
      "severity": "critical",
      "kind": "vulnerability",
      "ecosystems": [
        "Runtimes",
        "npm"
      ],
      "packages": [
        "node 26.12.1",
        "node 24.22.1",
        "node 22.23.4"
      ],
      "title": "Node.js Brotli bug (Node2Shell) shown to run code on an official build; patch to 24.22.1 and peers",
      "summary": "Node's Oct 21 security release fixed 10 CVEs across the 22.x, 24.x and 26.x lines. The worst, an out-of-bounds write in the bundled Brotli decoder, is no longer theoretical: on Oct 23 Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 build, including through Express 5.0-5.3 and body-parser 2.0-2.3 request handling, though not on every attempt. Three high-severity TLS and DNS bugs in the same release let certificates match the wrong host or let a NUL byte truncate a hostname. No in-the-wild exploitation reported yet; Node 20.x and older are end-of-life and get no fix.",
      "action": "Move to 26.12.1, 24.22.1 or 22.23.4 everywhere, including base images, CI runners and serverless runtimes; replace any Node 20.x. Until then, limit untrusted Brotli traffic at the edge.",
      "ids": [
        "CVE-2026-111497",
        "CVE-2026-105482",
        "CVE-2026-105483",
        "CVE-2026-106069"
      ],
      "sources": [
        {
          "name": "Node.js 24.22.1 release notes",
          "url": "https://nodejs.org/en/blog/release/v24.22.1"
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html"
        },
        {
          "name": "Astra",
          "url": "https://www.getastra.com/blog/security-advisory/node-js-security-release/"
        },
        {
          "name": "cve.now",
          "url": "https://cve.now/CVE-2026-105482"
        }
      ],
      "addedAt": "2026-10-24T02:45:00Z",
      "watch": "night",
      "updatedAt": "2026-10-24T03:05:00Z",
      "thread": "nodejs-brotli-node2shell",
      "status": "patched",
      "checks": [
        {
          "label": "Local Node version",
          "cmd": "node -v"
        },
        {
          "label": "Node base images",
          "cmd": "docker images --format '{{.Repository}}:{{.Tag}}' | grep -E '(^|/)node:'"
        },
        {
          "label": "Pinned versions in repo",
          "cmd": "grep -rnE '(node-version|FROM node|\"node\":)' --include='*.yml' --include='*.yaml' --include='Dockerfile*' --include='package.json' --include='.nvmrc' ."
        }
      ],
      "match": [
        "nodejs"
      ]
    },
    {
      "id": "electron-emudhra-intermediate-cve-2026-115570",
      "severity": "high",
      "kind": "advisory",
      "ecosystems": [
        "npm"
      ],
      "packages": [
        "electron 44.9.1",
        "electron 43.8.1",
        "electron 42.11.16",
        "electron 45.0.0-beta.6"
      ],
      "title": "Electron distrusts compromised CA intermediates that allowed TLS impersonation",
      "summary": "eMudhra said on Oct 22 it will leave the global TLS certificate business after eight of its intermediate CA keys were found to be easily guessable. Electron published fixes that stop trusting the affected intermediates; until then, an attacker on the network holding a certificate from one of them could impersonate servers to Electron apps through Chromium networking or Node's tls, https and fetch. Rated CVSS 7.4; no known exploitation.",
      "action": "Bump electron to a fixed release for your major line and ship an app update, especially for apps that auto-update or call internal APIs over TLS.",
      "ids": [
        "CVE-2026-115570",
        "GHSA-jr5w-w6x2-84p9"
      ],
      "sources": [
        {
          "name": "cve.now",
          "url": "https://cve.now/CVE-2026-115570"
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html"
        }
      ],
      "addedAt": "2026-10-24T02:45:00Z",
      "watch": "night",
      "updatedAt": "2026-10-24T03:05:00Z",
      "checks": [
        {
          "label": "Electron version in a project",
          "cmd": "npm ls electron"
        }
      ]
    },
    {
      "id": "tokio-1-54-0-interval-uaf",
      "severity": "medium",
      "kind": "vulnerability",
      "ecosystems": [
        "crates.io"
      ],
      "packages": [
        "tokio 1.54.0"
      ],
      "title": "tokio 1.54.0 timer race can corrupt memory in safe Rust; fixed in 1.54.1",
      "summary": "A race between Interval ticking and the multi-threaded runtime's time driver could drop a timer entry while it was firing, causing a use-after-free. Symptoms range from assertion panics to heap corruption. Only 1.54.0 is affected; local, high-complexity, CVSS 5.8.",
      "action": "If Cargo.lock pins tokio 1.54.0, run cargo update -p tokio to reach 1.54.1 or later.",
      "ids": [
        "CVE-2026-115567",
        "GHSA-5wjr-9356-4wc8",
        "RUSTSEC-2026-0384"
      ],
      "sources": [
        {
          "name": "cve.now",
          "url": "https://cve.now/CVE-2026-115567"
        }
      ],
      "addedAt": "2026-10-24T02:45:00Z",
      "watch": "night",
      "checks": [
        {
          "label": "Resolved tokio version",
          "cmd": "grep -A1 'name = \"tokio\"' Cargo.lock"
        }
      ]
    },
    {
      "id": "php2shell-cve-2026-109618",
      "severity": "critical",
      "kind": "vulnerability",
      "ecosystems": [
        "Runtimes",
        "Packagist"
      ],
      "packages": [
        "php < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35"
      ],
      "title": "PHP2Shell: unauthenticated RCE in PHP is under mass exploitation; emergency fixes out since Oct 21",
      "summary": "PHP shipped emergency releases on Oct 21 for two critical flaws that let an attacker without an account run code on a server. Exploit attempts reported since then number in the millions, with attackers trying to install Mirai botnet malware. On Oct 23 PHP flagged a separate, lower-risk session issue that the emergency builds do not fix; it only affects unusual session-handler configurations.",
      "action": "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, including container base images. As a stopgap (and to cover the Oct 23 issue), set session.upload_progress.enabled=0.",
      "ids": [
        "CVE-2026-109618",
        "CVE-2026-109619",
        "CVE-2026-115560"
      ],
      "sources": [
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"
        },
        {
          "name": "The Hacker News (exploitation)",
          "url": "https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html"
        }
      ],
      "addedAt": "2026-10-24T03:05:00Z",
      "watch": "night",
      "thread": "php2shell",
      "status": "active",
      "exploit": true,
      "checks": [
        {
          "label": "PHP version",
          "cmd": "php -v | head -1"
        },
        {
          "label": "Stopgap setting in effect",
          "cmd": "php -i | grep session.upload_progress.enabled"
        },
        {
          "label": "PHP base images",
          "cmd": "docker images --format '{{.Repository}}:{{.Tag}}' | grep -E '(^|/)php:'"
        }
      ]
    },
    {
      "id": "pillow-13-0-0-security-fixes",
      "severity": "high",
      "kind": "vulnerability",
      "ecosystems": [
        "PyPI"
      ],
      "packages": [
        "pillow < 13.0.0"
      ],
      "title": "Pillow 13.0.0 fixes image-parsing bugs rated up to CVSS 9.2, including command execution paths",
      "summary": "Pillow 13.0.0, released Oct 16, fixes several flaws now drawing attention: command execution through EPS files when Ghostscript is installed (versions 2.6.0 to 12.3.0), a crafted FPX file that can run commands on a single Image.open() when olefile is present, and memory overflows in lossless JPEG thumbnails and in-memory TIFF saves, the latter with a public proof of concept. The 9.2 scores overstate some of these, since each needs specific conditions; maintainers rate the EPS issue moderate. No exploitation reported.",
      "action": "Upgrade pillow to 13.0.0 (it requires Python 3.11+). If you can't yet, avoid opening untrusted EPS/FPX files, and remove ghostscript and olefile from images that don't need them.",
      "ids": [
        "CVE-2026-112900",
        "CVE-2026-112403",
        "CVE-2026-112393",
        "GHSA-w889-685w-c8fh",
        "GHSA-5x8w-8jj5-q52h"
      ],
      "sources": [
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html"
        },
        {
          "name": "cve.now",
          "url": "https://cve.now/CVE-2026-112900"
        }
      ],
      "addedAt": "2026-10-24T03:05:00Z",
      "watch": "night",
      "exploit": true,
      "checks": [
        {
          "label": "Installed version",
          "cmd": "pip show pillow 2>/dev/null | grep -i '^version'"
        },
        {
          "label": "Requirements and lockfiles",
          "cmd": "grep -rniE '^pillow|name = \"pillow\"' --include='*.txt' --include='*.lock' --include='*.toml' -A1 ."
        }
      ]
    }
  ]
}