---
title: "Security digest: October 21, 2026"
url: https://erroneo.us/security/2026-10-21/
description: "October 21, 2026 vulnerability digest: 3 briefs (PHP2Shell, Node.js October 2026 Security…); 3 critical advisories (PyPI, npm). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-21
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 21, 2026

3 editorial briefs and 3 critical advisories.

## Take stock

- Act now: PHP2Shell . Anyone running PHP behind a web server (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed), including WordPress, Drupal, Magento, Laravel and appliance or container images that bundle PHP.
- Act now: LiteLLM 1.107.0: Malicious PyPI and Docker Release . Anyone whose laptops, CI runners, containers or Kubernetes nodes resolved litellm (unpinned or >=) or a latest/main-* LiteLLM image between about 11:39 and 14:20 UTC on October 21, 2026.
- Patch this week: Node.js October 2026 Security Releases: 10 CVEs Fixed . Anyone running Node.js 22.x, 24.x or 26.x in production, especially services that decompress untrusted Brotli data or make TLS connections to hosts given as IP addresses.
- PyPI: 2 critical advisories ( Pillow ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( storybook , @storybook/core , @storybook/core-server , @storybook/experimental-addon-test , @storybook/addon-vitest , @storybook/addon-mcp ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [PHP2Shell: Critical Unauthenticated RCE in PHP](https://erroneo.us/security/briefs/php2shell-php-rce/index.md): If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped.
- **Patch this week** [Node.js October 2026 Security Releases: 10 CVEs Fixed](https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/index.md): Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.
- **Act now** [LiteLLM 1.107.0: Malicious PyPI and Docker Release](https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/index.md): Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-112900](https://erroneo.us/security/cve/CVE-2026-112900/index.md) Pillow: Argument Injection in Ghostscript call, potentially leading into RCE — PyPI Pillow >= 2.6.0, < 13.0.0 → 13.0.0
- [CVE-2026-114125](https://erroneo.us/security/cve/CVE-2026-114125/index.md) Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites — npm storybook >= 8.0.0, < 8.6.19 → 8.6.19; npm storybook >= 9.0.0, < 9.1.21 → 9.1.21; npm storybook >= 10.0.0, < 10.6.2 → 10.6.2
- [CVE-2026-112393](https://erroneo.us/security/cve/CVE-2026-112393/index.md) Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO — PyPI Pillow >= 2.0.0, < 13.0.0 → 13.0.0

---
Source page: https://erroneo.us/security/2026-10-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt