{
  "asOf": "2026-10-22",
  "scope": "Dated public-source record, not a live feed",
  "incidents": [
    {
      "id": "php",
      "title": "PHP",
      "category": "runtime",
      "label": "Patches available",
      "date": "21 Oct 2026",
      "summary": "Two critical engine flaws. Match the web-serving runtime and its distributor build, then verify the deployment.",
      "action": "Fixed upstream floors: 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12",
      "tags": "WordPress Magento Joomla Laravel MediaWiki Drupal CVE-2026-109618 CVE-2026-109619",
      "source": "https://www.php.net/archive/2026.php#2026-10-21-5",
      "tool": "versions"
    },
    {
      "id": "litellm",
      "title": "LiteLLM",
      "category": "supply-chain",
      "label": "Compromised release",
      "date": "21 Oct 2026",
      "summary": "Public 1.107.0 artifacts carried malware. Do not start Python or pip in a potentially affected environment.",
      "action": "Establish artifact history → clean rebuild → revoke reachable credentials.",
      "tags": "AI Python PyPI wheel Docker latest main-stable supply chain",
      "source": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
      "tool": "litellm"
    },
    {
      "id": "railway",
      "title": "Railway",
      "category": "credentials",
      "label": "Credential rotation",
      "date": "21–22 Oct 2026",
      "summary": "Vendor-wide rotation precaution, with specific follow-ups for AWS, GCP and MySQL. Track old-key revocation separately.",
      "action": "Inventory issuers and dependents. Replace, deploy, verify and revoke.",
      "tags": "secrets environment variables AWS GCP MySQL hosting API keys",
      "source": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
      "tool": "rotation"
    },
    {
      "id": "gitlab",
      "title": "GitLab",
      "category": "runtime",
      "label": "Patches available",
      "date": "21 Oct 2026",
      "summary": "A critical CE/EE flaw spans multiple branches. Find the matching floor and follow the required upgrade stops.",
      "action": "18.11.13 · 19.0.10 · 19.1.9 · 19.2.9 · 19.3.6 · 19.4.3 · 19.5.1",
      "tags": "CVE-2026-110264 self managed git repo CVSS10",
      "source": "https://docs.gitlab.com/ja-jp/releases/patches/patch-release-gitlab-19-5-1-released/",
      "tool": "versions"
    },
    {
      "id": "node",
      "title": "Node.js",
      "category": "runtime",
      "label": "Patches available",
      "date": "21 Oct 2026",
      "summary": "Brotli remote code execution (CVE-2026-111497) and TLS defects affect supported runtimes. Include containers, CI and applications with embedded Node.",
      "action": "Security releases: 22.23.4 · 24.22.1 · 26.12.1",
      "tags": "JavaScript TLS Brotli RCE CVE-2026-111497 CVE-2026-105483 CVE-2026-106069",
      "source": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
      "tool": "versions"
    },
    {
      "id": "plex",
      "title": "Plex Media Server",
      "category": "infrastructure",
      "label": "Active exploitation",
      "date": "19 Oct 2026 update",
      "summary": "Older internet-reachable servers may already be compromised. A version update alone is not a recovery plan.",
      "action": "Floor: 1.43.3.10861. Review clean rebuild, sessions and service-account access.",
      "tags": "Plex2Shell NAS media server CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656",
      "source": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/3",
      "tool": "versions"
    },
    {
      "id": "emudhra",
      "title": "eMudhra certificates",
      "category": "infrastructure",
      "label": "Trust-store updates",
      "date": "17–22 Oct 2026",
      "summary": "Browsers, operating systems and runtime bundles have different trust stores. One updated browser cannot clear them all.",
      "action": "Check each store; review Chrome’s scheduled 27 October root removal.",
      "tags": "CA TLS emSign certificate private key NSS certifi Windows macOS Ubuntu Firefox Chrome Android",
      "source": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
    },
    {
      "id": "tidb",
      "title": "TiDB Cloud / PingCAP",
      "category": "credentials",
      "label": "Management API keys",
      "date": "20 Oct 2026 actions",
      "summary": "All customers are asked to rotate active management API keys. The reported data volume is not independently established.",
      "action": "Organization owner: Settings → API Keys. Revoke immediately if misuse is suspected.",
      "tags": "database cloud PingCAP SQL 10.6 terabytes stolen credentials",
      "source": "https://www.pingcap.com/trust-hub/security/customer-actions-october-2026/",
      "tool": "rotation"
    },
    {
      "id": "zeabur",
      "title": "Zeabur",
      "category": "infrastructure",
      "label": "Migration deadlines",
      "date": "17 Oct 2026 notice",
      "summary": "Service wind-down begins in December. Export, restore, test and plan cutover before the relevant service expiry.",
      "action": "1 December changes; 31 December final shutdown. Individual expiry can be earlier.",
      "tags": "hosting shutdown migration backup Postgres MySQL Redis Docker",
      "source": "https://zeabur.com/blogs/zeabur-is-shutting-down"
    },
    {
      "id": "tor",
      "title": "Tor / SSH interception",
      "category": "infrastructure",
      "label": "Operator alert",
      "date": "5 Oct 2026 notice",
      "summary": "Compromised relay hosts intercepted SSH. Verify host identity; the report does not establish broken SSH encryption.",
      "action": "Relay owners: offline, preserve, rebuild. SSH users: investigate bypassed host-key checks.",
      "tags": "exit relay password Ebury 333 SSH known hosts",
      "source": "https://forum.torproject.org/t/tor-relays-security-incident-affecting-some-relay-operators/22231"
    },
    {
      "id": "safepay",
      "title": "SafePay ransomware",
      "category": "infrastructure",
      "label": "Campaign guidance",
      "date": "20 Oct 2026 bulletin",
      "summary": "Joint guidance covers edge access, identity controls and protected recovery. There is no single universal version fix.",
      "action": "Review exposed edge systems, privileged access and actual backup restore ability.",
      "tags": "CISA ransomware 600 critical infrastructure VPN NAS recovery",
      "source": "https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42fd782"
    },
    {
      "id": "japan",
      "title": "Japan’s cybersecurity alert",
      "category": "context",
      "label": "Claim correction",
      "date": "9 Oct 2026 remarks",
      "summary": "A cross-government alert is supported. The quoted formal emergency declaration and exact prime-minister claim remain unverified here.",
      "action": "Separate the government notice from vendor-specific remediation.",
      "tags": "Japan NCO prime minister emergency October9 5:55",
      "source": "https://www.digital.go.jp/speech/minister-261009-01"
    },
    {
      "id": "sbi",
      "title": "State Bank of India",
      "category": "context",
      "label": "Primary access blocked",
      "date": "21 Oct 2026 reported filing",
      "summary": "The original exchange attachment was located but returned 403. Reported filing details are not promoted to verified primary findings.",
      "action": "Verify account-related approaches through the bank’s established official channels.",
      "tags": "India bank SBI data loss filing 3897 375000",
      "source": "https://www.bseindia.com/xml-data/corpfiling/AttachLive/e16e3a1a-ee15-4971-977c-5f9f6aef1fb9.pdf"
    }
  ]
}