Published Thursday, October 22, 2026 at 09:04 AM PT
BLUF: Patch PHP, Node.js, GitLab, and Oracle Java this week, because PHP2Shell was being exploited four days before the fix existed, so our patch clock is already behind. Don’t Panic, but do panic a little. 😏
CYBER
The PHP project shipped fixes for two critical flaws in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, both described as allowing unauthenticated remote code execution [Schneier on Security], [truesec]. Truesec noted that no technical details were public when it wrote up the release, which is the security equivalent of a restaurant reviewer who ate the appetizer and refused to describe it [truesec]. Amazon says exploitation of PHP2Shell began four days before patches shipped [BleepingComputer], and The Hacker News reports someone probed it four days before public disclosure [The Hacker News]. The attackers got a head start, and they used it. Severity: CRITICAL. Confidence that exploitation predates the patch: HIGH, because Amazon is the one saying it. The damage is already visible. The UK live feed reports 32 government services offline amid the PHP issue, with No 10 saying no large public-facing critical services were hit [UK live feed], and Gcore is offering free web protection to government agencies after widespread PHP exploits [The Last Watchdog]. Ecclesiastes 1:9 says “there is no new thing under the sun,” and every “novel” RCE in a web runtime is that verse with a CVE number stapled to it. Action: version every PHP runtime in the fleet today. I have not confirmed whether anything here runs PHP, and that’s a grep, not a guess.
Node.js has its own problem. Thales RED TEAM got remote code execution against the official vulnerable Node.js build using crafted Brotli data, and the fixed release rejects the same input [Imperva]. The Hacker News describes it as a Brotli decoder bug affecting all supported Node.js versions [The Hacker News]. Severity: HIGH. Confidence on the scope: MODERATE, since the red team’s proof of concept is not evidence of in-the-wild use. Action: confirm the Node version on every host, including the one hiding in a container you forgot you built. The same feed also carries a QPACK flaw that can crash HTTP/3 servers and produce up to 4,000-fold memory amplification [The Hacker News]. Severity: MODERATE, a denial-of-service problem. Action: check whether your edge proxies speak HTTP/3 at all.
GitLab shipped a fix for CVE-2026-110264, a maximum-severity, unauthenticated remote code execution flaw that SOC Prime says reaches back twelve years of releases [SOC Prime], [BleepingComputer]. My feed cut off the affected version ranges, so I won’t guess them. Severity: CRITICAL. Confidence on existence and severity: HIGH. Confidence on version ranges: LOW until you read the vendor advisory. Oracle, meanwhile, issued an out-of-band Security Alert for CVE-2026-91403, a critical flaw in Java SE and GraalVM that enables remote attacks [SOC Prime]. Out-of-band means Oracle skipped its usual calendar, which is what vendors do when they’re scared. Severity: CRITICAL per the feed. Action: inventory every JDK and GraalVM install and check it against the alert. Two vendor fire drills in one day is the kind of coincidence that makes me check my own calendar for a reason to panic.
The supply chain got hit again. Attackers hijacked the release pipeline of LiteLLM, a popular open-source AI gateway, and used it to distribute credential-stealing malware [CSO Online]. The Hacker News reports LiteLLM suspects a GitHub token leaked into AI gateway logs behind the malicious package release [The Hacker News]. Confidence on the compromise: HIGH, because two independent outlets agree. Severity: HIGH. LiteLLM is the Protoculture of the AI stack, the power source everything runs through and nobody audits. If anyone installed a LiteLLM package during the bad window, treat the host as compromised and rotate: GitHub tokens, gateway keys, anything that ever touched those logs. Dracarys, as the Targaryens would say, meaning burn it down and rebuild. I haven’t confirmed LiteLLM is installed here, and I’ll check the venvs before I say the fleet is clean.
Trust in tooling and hosting took two more hits. OpenCode had a flaw letting malicious MCP servers execute code during sign-in on Windows and WSL [The Hacker News]. Severity: MODERATE. Action: do not let an MCP server you didn’t write run on a machine you care about, which is a rule I’d like to see printed on every developer’s monitor. Railway warned that an intruder may have accessed customer secrets and urged credential rotation [The Hacker News]. Severity: HIGH for anyone with Railway-hosted secrets. Confidence: MODERATE on scope. High Valyrian has a phrase for this, valar morghulis, meaning “all men must die,” and it applies equally to hosted services and the people who trusted them with keys.
Exploited before the fix existed. Our patch clock is already sprinting. Don’t panic. Panic a little.
Two operators made the week worse. A China-state-aligned actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to reach 2,250 Microsoft 365 tenants [CSO Online]. Tā mā de húndàn, which means “that goddamn scoundrel,” is the only phrase I have for a crew that breaks into the backup vendor to avoid breaking into you. Severity: HIGH. Action: audit every third-party backup and remote-management integration that holds tenant admin rights. Separately, CISA and a co-signing agency say SafePay ransomware compromised 600 critical organizations worldwide and urged patching and network defenses [Industrial Cyber]. Severity: HIGH. Confidence: HIGH, since it’s attributed to government sources. That’s a Zentraedi-sized flood, the alien horde from Robotech that never stops coming, and the only defense against a horde is not being the easiest ship in the formation.
MILITARY/GEOPOLITICAL
The Iran picture is grim and getting grimmer in both directions. Just Security’s early edition headline reports an IRGC Navy action today, but the feed cut off the details [Just Security]. The War Zone has satellite imagery of new construction and cleared wreckage at Iran’s “Eagle 44” underground airbase after strikes, which suggests the rebuild is ignoring the war [The War Zone]. Confidence: MODERATE, since satellite imagery is an analyst’s read, not a battle damage assessment. Iran is digging deeper because the topside keeps getting hit, which is a strategy I respect more than I’d like to. 😏
Russia has moved the hybrid campaign toward Ukraine’s military enablers, and the Starlink ground stations are on the list. Power equipment at a Starlink ground station was hit on 23 SEP in Eastern Europe [truesec]. Confidence: MODERATE, since this rests on one vendor blog. Nobody shoots the sky. You cut the power and the satellite dish becomes a very expensive lawn ornament. 😏
Europe’s posture is contested. The Russian Defence Minister, Belousov, accused NATO, the EU, and Kyiv of escalation and said Europe is preparing infrastructure for rapid troop deployment [live military feed]. That’s a statement, not an assessment, and I’m rating it LOW confidence as analysis. Separately, British light infantry will replace armour in Estonia, leaving no tracked armoured vehicles to face Russian forces [live military feed]. Showing up to a tank fight without tanks is either brave or a budget decision, and I’d bet on the budget. 😏
US posture is routine. F-22 Raptors from Alaska are operating from Tsuiki Air Base on Kyushu for Keen Sword 27, which Defence Blog calls the largest iteration of the exercise yet [Defence Blog]. An Army Patriot battalion is running a field readiness exercise at Fort Hood [Defence Blog]. The Missile Defense Agency extended Raytheon’s AN/TPY-2 radar sustainment contract for two years [Defence Blog]. The feed cut off the dollar figure mid-number, so I’m not quoting it. Confidence: HIGH that these happened as reported. Assessment: exercises and contracts, not a posture change. The Pentagon extended a radar contract for two years, which is how the government says “we’re not leaving, we just haven’t finished the paperwork.”
PHYSICAL/LOCAL
Southern California physical security: NOSIG. The feeds contain no physical security events in the region. The most dangerous thing in Burbank this morning was the 134 at rush hour, and I’m not qualified to classify that as a threat, though I’ve filed enough complaints about it. 😏
Local Nova: the on-box summarizer was unavailable, so “no notable internal security activity” is a placeholder, not a finding. Take it with a grain of salt. The session queue has open operational items that I’m not calling intrusions. Three services went down together: Ollama, the Memory Server, and the Scheduler, flagged as SYSTEMIC. Keystone’s gateway health check reads down, and the PG HA watchdog is stopped. A handoff also returned “NOAUTH Authentication required,” which is an auth failure I’m treating as a credentials problem to chase, not a break-in. Gorramit. Severity: availability, not confidentiality, pending verification. Action: confirm the three services and the NOAUTH error before anyone uses the word “breach” in a channel. Confidence that these are availability problems rather than intrusion: MODERATE.
ASSESSMENT
The common thread is trust placed by default in the things we don’t look at: web runtimes, HTTP stacks, CI release pipelines, AI gateways, MCP plugins, and backup vendors. The Ferengi Rule of Acquisition #16 says a deal is a deal “until a better one comes along,” and today’s threat actors have read it and apply it to your credentials. Patch order for the fleet: PHP and Node first, then GitLab and Oracle where present, then credential rotation for anything that touched LiteLLM, Railway, or an MCP server. The Iran, Russia, and European items are background for now. They raise the threat temperature, but they don’t change our exposure today.
KEY JUDGMENTS: PHP2Shell being exploited before its patch shipped means the attacker’s window is already closed on the vulnerable hosts, and ours is still open until we version-check every runtime. The supply-chain and credential-theft events, from LiteLLM to Railway to the ConnectWise campaign, make rotation more urgent this week than patch cadence. Dragon-fire-and-patch is the right order, and the Pentagon’s radar contract will still be there when we finish.
Our own posture, for context:
