Daily Vulnerability Digest · updated October 21, 2026
Security Digest
What got disclosed or exploited, does it affect you, and do you really need to act today? Every item links to its original sources: vendor advisories, CVE records, CISA and GitHub.
If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped.
Must act: Anyone running PHP behind a web server (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed), including WordPress, Drupal, Magento, Laravel and appliance or container images that bundle PHP.
Can relax: Hosts where PHP is only used from the command line (scripts, cron, Composer) and never handles untrusted HTTP requests, and RHEL 7 or older, which Red Hat says ships unaffected PHP.
Inventory every PHP that serves HTTP: servers, containers, appliances, shared hosting.
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's fixed package, then restart every PHP worker (php-fpm, Apache).
Rebuild and redeploy container images from refreshed php:* or distro base images; do not just restart old containers.
Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.
Must act: Anyone running Node.js 22.x, 24.x or 26.x in production, especially services that decompress untrusted Brotli data or make TLS connections to hosts given as IP addresses.
Can relax: Nobody needs to drop everything today: no exploitation is reported, and the low-severity Permission Model and ZIP fixes only matter if you use those features.
Check every runtime that serves traffic: node -v in each container, VM and CI image.
Upgrade to 26.12.1, 24.22.1 or 22.23.4 (nvm install 24.22.1, or your package manager / official node:* images), then restart processes.
Rebuild and redeploy container images and single executable applications (SEAs) so they embed the fixed runtime.
Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen.
Must act: Anyone whose laptops, CI runners, containers or Kubernetes nodes resolved litellm (unpinned or >=) or a latest/main-* LiteLLM image between about 11:39 and 14:20 UTC on October 21, 2026.
Can relax: Teams pinned to 1.106.2 or earlier by hash/lockfile, image users pinned by digest to a pre-incident image, and LiteLLM Enterprise private-registry customers, which LiteLLM says were not affected.
Find exposure: pip show litellm, grep lockfiles and CI logs for 1.107.0, and list running image digests.
On any hit, isolate the host or container and preserve evidence; do not run that environment's python or pip first.
Kill the detached daemon holding /tmp/remote_code_loader.lock and delete cook.pth, cook.py, sitecustomize.py (and their .pyc) from site-packages, or better, destroy and rebuild the environment.
Know what you run. Keep an inventory of internet-facing products (VPNs, firewalls, file-transfer, mail, CMS) and a lockfile or SBOM for every app. You can only act on a digest if you can answer “do we use this?” in minutes.
KEV first. A CVE in CISA’s Known Exploited Vulnerabilities catalog has confirmed exploitation in the wild. If you run the product, it outranks any higher-CVSS bug that nobody is exploiting.
Exposure second. Network-reachable, no-login bugs on internet-facing systems come before local or authenticated ones. A critical CVE behind a VPN you already patched is a scheduled task, not an emergency.
Run the audit command for your stack.npm audit, pip-audit, govulncheck ./..., composer audit, cargo audit, bundle audit, dotnet list package --vulnerable.
Supply-chain incident? Rotate, don’t just upgrade. If a malicious package version ran in your CI or on a laptop, treat every secret it could read as stolen.
Nothing applies? You are done. Most days most teams need to do nothing. The point of reading is knowing that for sure.
Find a CVE, product or package
Searches 3781 briefs, CVE pages and digest days, in your browser.
If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped.
Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.
Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen.
A public proof of concept chains four Plex bugs into code execution without credentials, and attackers have used it since October 17: update any internet-reachable server now, then check it for a miner or proxy.
Anyone can mint certificates from these broken CA keys, but only clients that skip Certificate Transparency and still trust the emSign root are exposed, and only to an on-path attacker: update those trust bundles this week, build machines first.
If any tenant you run or manage ever consented to a ConnectWise or SkyKick app, disable those apps and audit the tenant today; attackers used the vendor's own credential to sign in as the app, so MFA did not stop them.
If your service opens images that users or the internet supply, move to Pillow 13.0.0 this week; the worst bugs are memory corruption reachable from a crafted file, and reproducers are in the published advisories.
If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.
Siemens users get the fix automatically, but the real threat is attackers shipping their own signed, older copy as a malware loader, so Windows defenders should block the indicators and hunt rather than rely on patching.