Two critical engine flaws. Match the web-serving runtime and its distributor build, then verify the deployment.
Understand the alert.
Take the next step.
Free incident guides and local tools. Check the evidence, decide what applies, and record your next step.
The incident library
11 response guides. 2 evidence notes. Original sources alongside the next steps.
Public 1.107.0 artifacts carried malware. Do not start Python or pip in a potentially affected environment.
Vendor-wide rotation precaution, with specific follow-ups for AWS, GCP and MySQL. Track old-key revocation separately.
A critical CE/EE flaw spans multiple branches. Find the matching floor and follow the required upgrade stops.
Brotli remote code execution (CVE-2026-111497) and TLS defects affect supported runtimes. Include containers, CI and applications with embedded Node.
Older internet-reachable servers may already be compromised. A version update alone is not a recovery plan.
Browsers, operating systems and runtime bundles have different trust stores. One updated browser cannot clear them all.
All customers are asked to rotate active management API keys. The reported data volume is not independently established.
Service wind-down begins in December. Export, restore, test and plan cutover before the relevant service expiry.
Compromised relay hosts intercepted SSH. Verify host identity; the report does not establish broken SSH encryption.
Joint guidance covers edge access, identity controls and protected recovery. There is no single universal version fix.
A cross-government alert is supported. The quoted formal emergency declaration and exact prime-minister claim remain unverified here.
The original exchange attachment was located but returned 403. Reported filing details are not promoted to verified primary findings.
No matching topic. Try a product name or clear the filters.
Keep the tools close.
Download individual files or the whole collection. Read scripts before running them.
The whole kit. Yours to keep.
All 13 guides and evidence notes, three read-only scripts, CSV registers, the response checklist, and the source register. Works as an offline reference.
Dependency-file inspector
Check selected requirements, lockfiles, Dockerfiles and Compose files for LiteLLM declarations. No Python, pip, project imports or network.
Download file →Usage and limitationsInstalled metadata inspector
Inspect a supplied offline site-packages copy. Reports metadata and marker filenames without reading contents or executing packages.
Download file →Usage and limitationsPHP version comparator
Compare one supplied upstream version against four fixed branch floors. Distro backports need separate evidence.
Download file →Usage and limitationsCredential rotation register
Key aliases, issuers, dependents, revocation and verification receipts. Never put secret values in it.
Download CSV →Asset inventory
Record actual runtime, package origin, owner, observation time and the unresolved exposure question.
Download CSV →Migration acceptance checklist
Track source expiry, backup, isolated restore, application tests, write cutover, rollback and acceptance.
Download CSV →Incident response checklist
A portable record for decisions, actions, owners, evidence and the next check.
Download file →Website source and tests
The static website, browser-tool source, command-line tools and test suite. No application dependencies.
Download ZIP →Useful to you? Keep it free.
Every manual, tool and download is available without payment. If this saved you time, you can support the work with a voluntary donation.
Native USDC on Base. A donation does not purchase incident response or support. No wallet connection is needed.
USDC network details from CircleVerify the network and complete address in your wallet. Copying this address sends no funds.