After the alert.

The alert is free.
So is the
next step.

Incident guides, practical tools, and the sources behind them. All free to use.

For the person who has to turn a security headline into a checked version, a rotated credential, or a working backup.

Find your next step Read the full manual

No account. No paywall.Source snapshot: 22 October 2026. Read vendor updates before acting.

FIELD NOTES / 22 OCT 2026FIVE INCIDENTS

One headline is
not the whole story.

Start with the right question.

PHPPatching

Is the running build fixed?Check the branch and provenance.
GitLabPatching

Which branch is deployed?Match its exact version boundary.
LiteLLMSupply chain

What actually executed?A current pin is not history.
RailwayCredentials

What needs rotation?Follow the vendor precaution.
ZeaburMigration

Can the backup restore?Plan before the shutdown dates.
Source → evidence → next actionThe manual

Find the work
behind the warning.

Different incidents need different evidence. Start with the service you use.

Snapshot, not a live status feed.

PHP

Critical vulnerabilities

Check the runtime, then the fix.

PHP published fixed releases for the critical issues on 21 October: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. In those branches, earlier releases need remediation. “No patches” is stale.

Next step: Identify the actual running build and package source. Match it to the PHP or distributor advisory, then verify the deployed update.

A version string does not settle whether a distribution backported the fix. A patched application does not prove there was no earlier compromise.

Read the PHP guide PHP advisory

GitLab

Critical vulnerability

The version boundary matters.

GitLab assigns CVSS 3.1 10.0 to CVE-2026-110264. The fixed releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1, for their respective affected intervals.

Next step: Confirm whether you run GitLab yourself, record the exact CE/EE version, and follow the vendor’s matching upgrade instructions.

GitLab says its managed infrastructure, including GitLab.com and Dedicated, is patched. The affected version range is not proof of successful exploitation.

Read the GitLab guide GitLab advisory

LiteLLM

Compromised artifacts

A clean pin is not a clean history.

The vendor identifies malicious 1.107.0 PyPI wheels and affected container artifacts distributed on 21 October. The payload can execute on Python interpreter startup without an explicit LiteLLM import.

Next step: Compare retained artifact and deployment history with the vendor’s affected artifacts and distribution windows.

Do not start Python or pip in a potentially affected environment just to check it. A current older pin or missing local marker does not prove that a malicious artifact never executed.

Read the LiteLLM guide Vendor incident report

Railway

Credential precaution

Rotate with the dependencies in mind.

Railway disclosed possible access to encrypted environment variables and decrypted contents for some. It recommends rotating stored environment variables and private registry credentials for all users as a precaution.

Next step: Map stored credentials to their issuers and dependent services. Coordinate replacement, revocation, and verification with the authorized operator.

This is not confirmation that every user’s secrets were stolen. Replacing a value is not proof that the old credential was revoked.

Read the Railway guide Railway disclosure

Zeabur

Service wind-down

A backup needs a restore test.

Zeabur announced a wind-down on 17 October. From 1 December, dedicated-server renewals stop and shared-cluster services pause. The final dedicated-server and shared-cluster shutdown date is 31 December.

Next step: Inventory your services and their individual expiry dates. Export the required data and configuration, then verify a restore at the destination.

Some servers shut down at their own expiry dates. The final December deadline does not promise every service continues until then. Export and data-deletion details remained unfinalized in the announcement.

Read the Zeabur guide Founder announcement

Take the tools.
Keep the evidence.

Free downloads. Read the tool and its limits before running it. Keep results with the incident record.

Instructions and full manual

PHP version comparator

Compare a supplied PHP version with the published fixed branch boundaries.

JavaScript module · Node.js

LiteLLM metadata inspector

Inspect on-disk metadata without starting Python or importing LiteLLM.

Shell script · read the manual first

Response checklist

Record scope, evidence gaps, actions, owners, and verification.

Plain text · editable anywhere

Follow the source.
Keep the limits.

These notes summarize public information. They do not inspect your systems or establish that a system is safe or compromised.

Each guide links to the vendor’s advisory or announcement. The retained research was checked on 22 October 2026; the page is a dated snapshot. Follow the linked vendor source for later corrections and operational updates.

GitLab’s advisory and LiteLLM’s vendor report were retrieved through search text after direct opening failed. The original LiteLLM researcher issue provided corroborating artifact analysis.

A published vulnerability is not proof of a breach. A fixed version is not proof that credentials were revoked. A backup file is not a successful restore. Keep those checks separate.

Full source register in the manual