{
  "version": 1,
  "generated_at": "2026-10-22T03:58:17.687Z",
  "smell_index": 5,
  "count": 12,
  "data": [
    {
      "id": "php2shell",
      "url": "https://ohshit.app/incidents/php2shell/",
      "title": "PHP2Shell: two critical PHP core RCEs leak a day before the patch, and nearly every PHP back to 5.4 is in the bowl",
      "level": 5,
      "level_name": "shitstorm",
      "date": "2026-10-21",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "PHP",
        "RCE",
        "leaked early"
      ],
      "ecosystems": [
        "php"
      ],
      "summary": "CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2) give remote code execution in PHP itself. A proof-of-concept video leaked the evening before release, so the patch and the exploit arrived together.",
      "splash": "PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed: nearly every PHP back to 5.4",
      "wipe": "Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress only blunts one of the two bugs",
      "in_the_wild": "disputed",
      "source_exception": null,
      "cves": [
        {
          "id": "CVE-2026-109618",
          "score": 9.2,
          "name": "Half-built request on out-of-memory"
        },
        {
          "id": "CVE-2026-109619",
          "score": 9.2,
          "name": "Stale request state used after free"
        }
      ],
      "fixed": [
        {
          "product": "PHP 8.5",
          "branch": "8.5",
          "version": "8.5.12",
          "status": "Supported, patched"
        },
        {
          "product": "PHP 8.4",
          "branch": "8.4",
          "version": "8.4.27",
          "status": "Supported, patched"
        },
        {
          "product": "PHP 8.3",
          "branch": "8.3",
          "version": "8.3.36",
          "status": "Security fixes only, patched"
        },
        {
          "product": "PHP 8.2",
          "branch": "8.2",
          "version": "8.2.35",
          "status": "Security fixes only, patched. EOL Dec 31, 2026"
        },
        {
          "product": "PHP 8.1 and older",
          "version": "none",
          "status": "End of life. Distro / LTS vendors and source backports for 7.4–8.1 only"
        }
      ],
      "checklist": [
        {
          "title": "Find every PHP runtime",
          "hint": "Servers, Docker base images, CI runners, that forgotten WordPress box"
        },
        {
          "title": "Upgrade to a fixed version",
          "hint": "8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later. 8.1 and older need a distro or LTS build"
        },
        {
          "title": "Double-check with OpenAI's php2shell-checker",
          "hint": "Point it at a URL or run it on the box. UNKNOWN means it couldn't tell, not that you're clean"
        },
        {
          "title": "Rebuild and redeploy images",
          "hint": "A patched host does nothing for an old container"
        },
        {
          "title": "Disable session.upload_progress where you can't patch yet",
          "hint": "Partial mitigation for CVE-2026-109619 only"
        },
        {
          "title": "Hunt for web shells",
          "hint": "New .php files in upload and cache dirs since Oct 20"
        },
        {
          "title": "Rotate secrets the app could read",
          "hint": "DB passwords, API keys in .env, session signing keys"
        }
      ],
      "sources": [
        {
          "name": "php.net news",
          "url": "https://www.php.net/",
          "primary": true
        },
        {
          "name": "Patchstack",
          "url": "https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/",
          "primary": true
        },
        {
          "name": "Sophos",
          "url": "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619",
          "primary": true
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html",
          "primary": false
        },
        {
          "name": "Huntress",
          "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities",
          "primary": false
        },
        {
          "name": "JFrog Security Research",
          "url": "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/",
          "primary": false
        },
        {
          "name": "OpenAI php2shell-checker",
          "url": "https://github.com/openai/php2shell-checker",
          "primary": false
        }
      ]
    },
    {
      "id": "gitlab-regex-rce",
      "url": "https://ohshit.app/incidents/gitlab-regex-rce/",
      "title": "GitLab patches its second CVSS 10.0 regex-compiler RCE in nine days, and this one reaches back to GitLab 7.0",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-21",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "GitLab",
        "RCE",
        "self-managed"
      ],
      "ecosystems": [
        "gitlab",
        "ruby"
      ],
      "summary": "CVE-2026-110264 (CVSS 10.0) is an integer overflow in the Onigmo regex compiler that lets an unauthenticated user run code on self-managed GitLab, from 7.0 onwards. It lands nine days after CVE-2026-97229, a sibling bug that already has a public PoC. Servers patched on Oct 12 are still exposed.",
      "splash": "Every self-managed GitLab CE/EE from 7.0 up; GitLab.com and Dedicated are already patched",
      "wipe": "Upgrade to 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13. There is no workaround",
      "in_the_wild": "no",
      "source_exception": null,
      "cves": [
        {
          "id": "CVE-2026-110264",
          "score": 10,
          "name": "Integer overflow in regex compilation"
        },
        {
          "id": "CVE-2026-97229",
          "score": 10,
          "name": "Integer overflow in the CI/CD regex compiler"
        }
      ],
      "fixed": [
        {
          "product": "GitLab 19.5",
          "branch": "19.5",
          "version": "19.5.1"
        },
        {
          "product": "GitLab 19.4",
          "branch": "19.4",
          "version": "19.4.3",
          "status": "Includes DB migrations"
        },
        {
          "product": "GitLab 19.3",
          "branch": "19.3",
          "version": "19.3.6",
          "status": "Includes DB migrations"
        },
        {
          "product": "GitLab 19.2",
          "branch": "19.2",
          "version": "19.2.9",
          "status": "Backport (critical fix only)"
        },
        {
          "product": "GitLab 19.1",
          "branch": "19.1",
          "version": "19.1.9",
          "status": "Backport (critical fix only)"
        },
        {
          "product": "GitLab 19.0",
          "branch": "19.0",
          "version": "19.0.10",
          "status": "Backport (critical fix only)"
        },
        {
          "product": "GitLab 7.0 – 18.11",
          "branch": "*",
          "version": "18.11.13",
          "status": "Backport. Anything older: upgrade to 18.11.13 or later"
        }
      ],
      "checklist": [
        {
          "title": "Find every self-managed GitLab",
          "hint": "Including forgotten Omnibus VMs and Docker images"
        },
        {
          "title": "Upgrade to the fixed version for your line",
          "hint": "The Oct 12 patch is not enough. Plan downtime for 19.4.3 / 19.3.6 on single-node setups"
        },
        {
          "title": "Close self-registration if you don't need it",
          "hint": "Open sign-up turned the Oct 12 bug from \"needs an account\" into \"anyone\""
        },
        {
          "title": "Turn on GitLab's two detection rules",
          "hint": "“Onigmo native worker crash” and “Org mode render error burst”"
        },
        {
          "title": "Rotate CI/CD variables and runner tokens if you were exposed",
          "hint": "Code runs as the git user, which can read them"
        },
        {
          "title": "Update a self-hosted AI Gateway too",
          "hint": "CVE-2026-90970 needs gateway 19.2.4 / 19.3.2 / 19.4.1"
        }
      ],
      "sources": [
        {
          "name": "GitLab patch release 19.5.1",
          "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/",
          "primary": true
        },
        {
          "name": "GitLab patch release 19.4.2",
          "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/",
          "primary": true
        },
        {
          "name": "Rapid7",
          "url": "https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/",
          "primary": true
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html",
          "primary": false
        }
      ]
    },
    {
      "id": "litellm-pypi-compromise",
      "url": "https://ohshit.app/incidents/litellm-pypi-compromise/",
      "title": "LiteLLM 1.107.0 on PyPI and Docker was a credential stealer with a remote-code loader, built from a lookalike repo",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-21",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "supply chain",
        "PyPI",
        "Docker",
        "AI",
        "secrets"
      ],
      "ecosystems": [
        "pypi",
        "docker"
      ],
      "summary": "Attackers used stolen GitHub CLI tokens from three LiteLLM engineers to publish litellm 1.107.0 to PyPI and Docker from a lookalike repo. It steals cloud, AI and LiteLLM proxy keys on every Python start. Live ~2 hours.",
      "splash": "Anyone who installed litellm 1.107.0 or pulled latest / main-latest / main-stable / v1.107.0 images on Oct 21",
      "wipe": "Rebuild affected hosts from scratch on litellm 1.106.2 pinned by hash/digest, then rotate every credential the host could read",
      "in_the_wild": "yes",
      "source_exception": null,
      "cves": [],
      "fixed": [
        {
          "product": "LiteLLM (PyPI)",
          "version": "1.106.2",
          "status": "Last clean release; 1.107.0 removed"
        },
        {
          "product": "LiteLLM Docker images",
          "version": "v1.106.2 (pin by digest)",
          "status": "Floating tags were repointed"
        },
        {
          "product": "LiteLLM Enterprise (private registry)",
          "version": "not affected",
          "status": "Per LiteLLM"
        }
      ],
      "checklist": [
        {
          "title": "Find every 1.107.0 install",
          "hint": "requirements, uv.lock, poetry.lock, Pipfile.lock, CI caches, wheelhouses, and any container started from latest/main-* on Oct 21. Grep for litellm-1.107.0.dist-info"
        },
        {
          "title": "Check images by digest, not tag",
          "hint": "Bad index is sha256:1bbcb1443bc9…c339e (litellm); litellm-database and litellm-non_root had their own bad digests. The tag looks innocent now"
        },
        {
          "title": "Don't pip install your way out",
          "hint": "The .pth runs on every Python start, pip included. Isolate the host, kill the daemon holding /tmp/remote_code_loader.lock, then rebuild from scratch"
        },
        {
          "title": "Rotate every key the process could read",
          "hint": "All provider keys in the LiteLLM DB, master and virtual keys, the DATABASE_URL password, instance/task IAM roles, env vars, SSH/git/npm/PyPI/kube creds. Yes, all of them"
        },
        {
          "title": "Hunt the IOCs",
          "hint": "Egress to litellm[.]dev, raw.githubusercontent.com/letters9813/…; files cook.pth, cook.py, sitecustomize.py, /tmp/.pc_once_72129118c59f5636c0bb; env PRIVCOLLECT_ACTIVE=1"
        },
        {
          "title": "Check cloud audit logs",
          "hint": "CloudTrail GetCallerIdentity from your instance role near install time, and any use from 168.100.8.57 or 165.227.201.8"
        },
        {
          "title": "Pin to 1.106.2 by hash and stop using floating tags",
          "hint": "Hash-pinned lockfiles and image digests would have made this a non-event. The proxy was supposed to be the only middleman"
        }
      ],
      "sources": [
        {
          "name": "LiteLLM incident report",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
          "primary": true
        },
        {
          "name": "GitHub issue BerriAI/litellm#47826",
          "url": "https://github.com/BerriAI/litellm/issues/47826",
          "primary": true
        },
        {
          "name": "Socket",
          "url": "https://socket.dev/blog/litellm-compromise",
          "primary": false
        },
        {
          "name": "JFrog Security Research",
          "url": "https://research.jfrog.com/post/litellm-hijacked-again/",
          "primary": false
        },
        {
          "name": "Wiz",
          "url": "https://www.wiz.io/blog/litellm-compromised-steals-credentials",
          "primary": false
        },
        {
          "name": "Datadog Security Labs",
          "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/",
          "primary": false
        }
      ]
    },
    {
      "id": "nodejs-oct-2026",
      "url": "https://ohshit.app/incidents/nodejs-oct-2026/",
      "title": "Node.js October security releases for 22, 24 and 26: ten CVEs, including a Brotli RCE and TLS hostname bypasses",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-21",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "Node.js",
        "TLS",
        "RCE"
      ],
      "ecosystems": [
        "node"
      ],
      "summary": "Four HIGH, three MEDIUM and three LOW. An out-of-bounds write in the Brotli decoder, dns.resolve truncating names at a NUL byte, and IP spellings that sneak past certificate hostname checks. The release also rejects the compromised eMudhra keys.",
      "splash": "Node.js 22.x, 24.x, 26.x and every end-of-life line",
      "wipe": "Upgrade to 22.23.4 / 24.22.1 / 26.12.1, rebuild containers, then restart so old TLS sessions drop",
      "in_the_wild": "n/a",
      "source_exception": null,
      "cves": [
        {
          "id": "CVE-2026-111497",
          "score": null,
          "name": "Brotli decoder out-of-bounds write"
        },
        {
          "id": "CVE-2026-105482",
          "score": null,
          "name": "dns.resolve truncates at NUL"
        },
        {
          "id": "CVE-2026-105483",
          "score": null,
          "name": "Fullwidth-digit IP hostname bypass"
        },
        {
          "id": "CVE-2026-106069",
          "score": null,
          "name": "Loose IP resolution hostname bypass"
        },
        {
          "id": "CVE-2026-105481",
          "score": null,
          "name": "Premature keep-alive response"
        },
        {
          "id": "CVE-2026-106072",
          "score": null,
          "name": "Non-canonical IPv4 certificate validation"
        },
        {
          "id": "CVE-2026-106074",
          "score": null,
          "name": "Repeated entropy after startup snapshots"
        },
        {
          "id": "CVE-2026-106070",
          "score": null,
          "name": "Invalid ZIP header prefix returned"
        },
        {
          "id": "CVE-2026-106071",
          "score": null,
          "name": "Filesystem wildcard permission over-grant"
        },
        {
          "id": "CVE-2026-106073",
          "score": null,
          "name": "realpathSync permission bypass"
        }
      ],
      "fixed": [
        {
          "product": "Node.js 26",
          "branch": "26",
          "version": "26.12.1",
          "status": "Current"
        },
        {
          "product": "Node.js 24",
          "branch": "24",
          "version": "24.22.1",
          "status": "Active LTS"
        },
        {
          "product": "Node.js 22",
          "branch": "22",
          "version": "22.23.4",
          "status": "Maintenance LTS"
        },
        {
          "product": "Node.js 20 and older",
          "version": "none",
          "status": "End of life, affected, no fix"
        }
      ],
      "checklist": [
        {
          "title": "Inventory Node versions",
          "hint": "Servers, Lambda/Vercel/Cloud Run runtimes, Docker base images, CI"
        },
        {
          "title": "Upgrade to 22.23.4 / 24.22.1 / 26.12.1",
          "hint": "Bump .nvmrc, engines and base images too"
        },
        {
          "title": "Rebuild and redeploy containers",
          "hint": "node:22-alpine from last week is still vulnerable"
        },
        {
          "title": "Restart long-running services",
          "hint": "Resumed TLS sessions are not re-verified against the new CA store"
        },
        {
          "title": "Get off end-of-life Node",
          "hint": "Node 20 and older are affected and get no fix"
        }
      ],
      "sources": [
        {
          "name": "Node.js blog",
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
          "primary": true
        },
        {
          "name": "Vercel KB",
          "url": "https://vercel.com/kb/bulletin/node-js-security-advisory",
          "primary": false
        }
      ]
    },
    {
      "id": "railway-env-vars",
      "url": "https://ohshit.app/incidents/railway-env-vars/",
      "title": "Railway says an intruder reached the store holding customer environment variables and decrypted some of them",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-21",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "PaaS",
        "secrets",
        "credentials",
        "supply chain"
      ],
      "ecosystems": [
        "railway"
      ],
      "summary": "Railway detected unusual activity in the systems that store customer environment variables. An unauthorized party may have read encrypted variables and, for some, the decrypted values. Railway paused all deploys, reset bucket and GitHub credentials, and tells every user to rotate every secret.",
      "splash": "Every Railway user with secrets in environment variables; Railway says a subset was hit but won't say who yet",
      "wipe": "Rotate and revoke every secret stored in Railway variables, check provider logs since Oct 21, redeploy once builds return",
      "in_the_wild": "n/a",
      "source_exception": null,
      "cves": [],
      "fixed": [],
      "checklist": [
        {
          "title": "Rotate every secret stored in Railway variables, starting with the expensive ones",
          "hint": "AI provider keys, cloud (AWS/GCP) keys, Stripe, DB passwords, OAuth client secrets, webhook signing secrets. If it's in Variables, assume it's gone"
        },
        {
          "title": "Revoke the old values at the provider, don't just add new ones",
          "hint": "A new key next to a live old key fixes nothing. Delete the old key in the provider console"
        },
        {
          "title": "Rotate Railway-hosted database passwords",
          "hint": "Railway has guides for PostgreSQL, MySQL, MongoDB and Redis; update every service that references them"
        },
        {
          "title": "Revoke GitHub tokens you stored as registry credentials",
          "hint": "Railway removed them from its side, but they keep working on GitHub until you revoke them yourself"
        },
        {
          "title": "Check provider audit logs and billing since Oct 21 (earlier if you can)",
          "hint": "Unknown IPs in AWS CloudTrail / GCP audit logs, new GitHub tokens or deploy keys, odd Stripe API calls, surprise AI token bills"
        },
        {
          "title": "Reconnect GitHub and redeploy once builds are back for your plan",
          "hint": "Containers only read variables at startup, so new secrets and the reset bucket keys do nothing until you redeploy"
        },
        {
          "title": "Review your Railway account and deploy history",
          "hint": "Audit log for changes you didn't make (Railway's own resets show as \"Railway Staff\"), unknown members, tokens or deploys"
        },
        {
          "title": "Watch your inbox for a Railway email",
          "hint": "Railway says it will email accounts it confirms as affected"
        }
      ],
      "sources": [
        {
          "name": "Railway blog: Security Disclosure, Wednesday October 21st",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
          "primary": true
        },
        {
          "name": "Railway status page (incident QH8L8B3E)",
          "url": "https://status.railway.com/incident/QH8L8B3E",
          "primary": true
        },
        {
          "name": "Railway blog: Redeploy Buckets and Reconnect GitHub After the Credential Reset",
          "url": "https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset",
          "primary": true
        },
        {
          "name": "Railway on X",
          "url": "https://x.com/Railway/status/2113025284148715845",
          "primary": true
        },
        {
          "name": "Cybersecurity News",
          "url": "https://cybersecuritynews.com/railway-security-incident/amp/",
          "primary": false
        },
        {
          "name": "StartupHub.ai",
          "url": "https://www.startuphub.ai/cybersecurity/railway-tells-all-users-to-rotate-secrets-after-breach",
          "primary": false
        }
      ]
    },
    {
      "id": "tidb-cloud",
      "url": "https://ohshit.app/incidents/tidb-cloud/",
      "title": "PingCAP confirms TiDB Cloud intrusion: a stolen service account roamed internal systems for a month",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-19",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "cloud database",
        "credentials",
        "extortion"
      ],
      "ecosystems": [
        "tidb",
        "mysql"
      ],
      "summary": "From Sep 9 to Oct 7 an intruder used stolen service-account credentials to copy account metadata, billing info, SQL editor text, encrypted API-key values and source code. Extortion group FulcrumSec claims 10.6 TB; PingCAP has not confirmed that.",
      "splash": "TiDB Cloud customers' account, billing and SQL-editor data; no evidence customer databases were read",
      "wipe": "Rotate TiDB Cloud API keys and DB passwords, scrub secrets from SQL editor history, review access logs",
      "in_the_wild": "n/a",
      "source_exception": null,
      "cves": [],
      "fixed": [],
      "checklist": [
        {
          "title": "Rotate TiDB Cloud API keys",
          "hint": "The exported table held encrypted key values; treat them as exposed"
        },
        {
          "title": "Rotate database users and passwords",
          "hint": "Especially any that ever appeared in the SQL editor"
        },
        {
          "title": "Scrub secrets from SQL editor history",
          "hint": "Queries and error text were copied"
        },
        {
          "title": "Review org and project access logs",
          "hint": "Look for logins and API calls you can't explain since Sep 9"
        },
        {
          "title": "Watch for targeted phishing",
          "hint": "Contact names, emails and contract details were taken"
        }
      ],
      "sources": [
        {
          "name": "PingCAP security update",
          "url": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/",
          "primary": true
        },
        {
          "name": "Dark Reading",
          "url": "https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security",
          "primary": false
        },
        {
          "name": "TokenPost",
          "url": "https://www.tokenpost.com/news/technology/35907",
          "primary": false
        }
      ]
    },
    {
      "id": "emudhra-ca",
      "url": "https://ohshit.app/incidents/emudhra-ca/",
      "title": "eMudhra CA intermediate private keys were so weak that every one was a number below 256",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-17",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "PKI",
        "CA",
        "TLS"
      ],
      "ecosystems": [
        "go",
        "python",
        "node",
        "browsers"
      ],
      "summary": "Eight intermediate certificates (six TLS, two code signing) under emSign ECC Root CA - G3, cross-signed by Sectigo, had P-384 private keys that were integers below 256. Anyone could recover them instantly and mint certificates for any domain.",
      "splash": "Anything trusting emSign ECC Root CA - G3 or the Sectigo cross-signs: browsers, OSes, Go, Python, Node",
      "wipe": "Update browsers and OSes, certifi 2026.10.19, Go 1.27.3 / 1.26.10, Node 22.23.4+; block the 8 intermediates in custom trust stores",
      "in_the_wild": "no",
      "source_exception": null,
      "cves": [
        {
          "id": "CVE-2026-111943",
          "score": null,
          "name": "Go crypto/x509 trusts the compromised intermediates"
        },
        {
          "id": "CVE-2026-113470",
          "score": null,
          "name": "Firefox trusts the compromised intermediates"
        }
      ],
      "fixed": [
        {
          "product": "Go",
          "version": "1.27.3 / 1.26.10",
          "status": "CVE-2026-111943. Go 1.25 and older get no fix"
        },
        {
          "product": "Python certifi",
          "version": "2026.10.19"
        },
        {
          "product": "Node.js",
          "version": "22.23.4 / 24.22.1 / 26.12.1",
          "status": "Ships NSS 3.131.1 CA bundle"
        },
        {
          "product": "Mozilla NSS",
          "version": "3.131.1",
          "status": "Root removed Oct 20"
        },
        {
          "product": "Cloudflare WARP / 1.1.1.1 / cloudflared",
          "version": "2026.10.2"
        },
        {
          "product": "Java (cacerts)",
          "version": "unknown",
          "status": "Not covered by sources we reviewed. Check your vendor"
        }
      ],
      "checklist": [
        {
          "title": "Update browsers and operating systems",
          "hint": "Chrome, Firefox, Safari, Edge, Android and Windows have all shipped blocks"
        },
        {
          "title": "Update language trust stores",
          "hint": "certifi 2026.10.19, Go 1.27.3 / 1.26.10, Node 22.23.4 / 24.22.1 / 26.12.1"
        },
        {
          "title": "Patch custom trust stores",
          "hint": "Java cacerts, internal CA bundles, appliances, distroless images"
        },
        {
          "title": "Check code-signing trust",
          "hint": "Two of the eight were code-signing CAs that Microsoft trusted"
        },
        {
          "title": "Replace any certificate of yours that chains to emSign ECC Root CA - G3",
          "hint": "Reissue from another CA. The eight intermediates already fail, and Chrome drops the root around Oct 27"
        },
        {
          "title": "Search your CT monitor for emSign-issued certs",
          "hint": "Anything on your domains you didn't request is a red flag"
        }
      ],
      "sources": [
        {
          "name": "Mozilla Bugzilla 2083449",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083449",
          "primary": true
        },
        {
          "name": "eMudhra statement",
          "url": "https://emudhra.com/en/post/certificate-security-incident",
          "primary": true
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html",
          "primary": false
        },
        {
          "name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/",
          "primary": false
        }
      ]
    },
    {
      "id": "connectwise-cloud-backup",
      "url": "https://ohshit.app/incidents/connectwise-cloud-backup/",
      "title": "ConnectWise Cloud Backup's app secret got stolen, and attackers walked into Microsoft 365 tenants through the front door",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-16",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "SaaS",
        "OAuth",
        "Microsoft 365"
      ],
      "ecosystems": [
        "microsoft-365",
        "entra-id"
      ],
      "summary": "An API secret for ConnectWise's multi-tenant backup app (formerly SkyKick) was stolen. Every Microsoft 365 tenant that had consented to the app was suddenly reachable with the permissions customers had granted it. ConnectWise suspended several cloud services.",
      "splash": "Microsoft 365 tenants using ConnectWise Cloud Backup or Cloud Management: 173 confirmed, ~1,000 touched",
      "wipe": "Remove or re-consent the ConnectWise apps, review Entra sign-ins from 144.172.64.x, check for new Global Admins and app secrets",
      "in_the_wild": "yes",
      "source_exception": null,
      "cves": [],
      "fixed": [],
      "checklist": [
        {
          "title": "Find the ConnectWise / SkyKick apps in Entra ID",
          "hint": "Enterprise applications → filter by publisher"
        },
        {
          "title": "Review sign-in and audit logs since Oct 13",
          "hint": "IOCs 144.172.64.128, 144.172.64.99, 144.172.64.60"
        },
        {
          "title": "Check for new Global Admins",
          "hint": "Role assignments made by service principals are the big tell"
        },
        {
          "title": "Check every app for new secrets or certificates",
          "hint": "The attacker added credentials to other apps in the tenant"
        },
        {
          "title": "Re-consent only after ConnectWise restores service",
          "hint": "Grant the minimum permissions the backup actually needs"
        }
      ],
      "sources": [
        {
          "name": "ConnectWise Trust Center",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "primary": true
        },
        {
          "name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "primary": true
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html",
          "primary": false
        },
        {
          "name": "SecurityWeek",
          "url": "https://www.securityweek.com/connectwise-suspends-cloud-services-in-response-to-cyberattack/",
          "primary": false
        }
      ]
    },
    {
      "id": "nginx-oct-2026",
      "url": "https://ohshit.app/incidents/nginx-oct-2026/",
      "title": "nginx 1.30.6 and 1.31.7 fix five worker-process bugs: three heap overflows/UAF, HTTP/3 body injection, forged TLS sessions",
      "level": 3,
      "level_name": "sharted",
      "date": "2026-10-14",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "nginx",
        "F5",
        "HTTP/3",
        "TLS",
        "memory corruption"
      ],
      "ecosystems": [],
      "summary": "nginx.org rates all five Medium, but F5's CVE records score three memory-corruption bugs at CVSS 8.1. Each needs a specific config: alias plus rewrite, regex map captures, AIO with SSI, HTTP/3, or rotated TLS session tickets. No exploitation reported.",
      "splash": "nginx Open Source before 1.30.6 / 1.31.7, NGINX Plus R33 to 37.x, and products that bundle them",
      "wipe": "Upgrade to nginx 1.30.6 (stable) or 1.31.7+ (mainline), or the F5 hotfix for NGINX Plus, then reload",
      "in_the_wild": "no",
      "source_exception": null,
      "cves": [
        {
          "id": "CVE-2026-15176",
          "score": 8.1,
          "name": "Buffer overflow with alias and rewrite"
        },
        {
          "id": "CVE-2026-93479",
          "score": 8.1,
          "name": "Buffer overflow evaluating variables"
        },
        {
          "id": "CVE-2026-95101",
          "score": 5.3,
          "name": "HTTP/3 request body injection"
        },
        {
          "id": "CVE-2026-97629",
          "score": 6.5,
          "name": "TLS session forgery with ticket key rotation"
        },
        {
          "id": "CVE-2026-97205",
          "score": 8.1,
          "name": "Use-after-free with AIO and SSI"
        }
      ],
      "fixed": [
        {
          "product": "nginx mainline 1.31.x",
          "branch": "1.31",
          "version": "1.31.7",
          "status": "Mainline"
        },
        {
          "product": "nginx stable 1.30.x",
          "branch": "1.30",
          "version": "1.30.6",
          "status": "Stable"
        },
        {
          "product": "nginx 1.28 and older",
          "branch": "*",
          "version": "none",
          "status": "Unsupported, upgrade to 1.30.6+"
        }
      ],
      "checklist": [
        {
          "title": "Find every nginx you run",
          "hint": "nginx -v on hosts, Docker base images, ingress controllers, appliances that bundle it"
        },
        {
          "title": "Upgrade to 1.30.6 or 1.31.7+",
          "hint": "Distro packages may backport instead; check your vendor's CVE tracker, not just the version string"
        },
        {
          "title": "Grep your config for the risky features",
          "hint": "alias with rewrite, $request_filename, map with regex, aio, ssi on, listen ... quic, ssl_session_cache shared"
        },
        {
          "title": "Pin session ticket keys or disable tickets",
          "hint": "Also stops ticket keys drifting between workers and hosts"
        },
        {
          "title": "Patch NGINX Plus and F5 products too",
          "hint": "Use the hotfix versions in the F5 K-articles"
        }
      ],
      "sources": [
        {
          "name": "nginx security advisories",
          "url": "https://nginx.org/en/security_advisories.html",
          "primary": true
        },
        {
          "name": "nginx CHANGES-1.30",
          "url": "https://nginx.org/en/CHANGES-1.30",
          "primary": true
        },
        {
          "name": "nginx.org news",
          "url": "https://nginx.org/",
          "primary": true
        },
        {
          "name": "CVE-2026-15176 (F5 CNA record)",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15176",
          "primary": true
        },
        {
          "name": "CVE-2026-93479 (F5 CNA record)",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93479",
          "primary": true
        },
        {
          "name": "CVE-2026-95101 (F5 CNA record)",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-95101",
          "primary": true
        },
        {
          "name": "CVE-2026-97629 (F5 CNA record)",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97629",
          "primary": true
        },
        {
          "name": "CVE-2026-97205 (F5 CNA record)",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97205",
          "primary": true
        },
        {
          "name": "F5 K000162416 (CVE-2026-15176)",
          "url": "https://my.f5.com/manage/s/article/K000162416",
          "primary": true
        },
        {
          "name": "Canadian Centre for Cyber Security AV26-1049",
          "url": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-1049",
          "primary": false
        }
      ]
    },
    {
      "id": "ivanti-connect-secure-chain",
      "url": "https://ohshit.app/incidents/ivanti-connect-secure-chain/",
      "title": "Ivanti Connect Secure zero-day chain: unauthenticated root on fully patched VPN boxes, again",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-13",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "zero-day",
        "VPN",
        "edge device"
      ],
      "ecosystems": [
        "ivanti"
      ],
      "summary": "Attacker UTA0576 chained an auth bypass, a file write and a privilege escalation to take over VPN appliances running the latest release, then went after AD credentials, LAPS passwords and BitLocker keys. CISA added it to KEV the same day.",
      "splash": "Internet-facing Ivanti Connect Secure 22.8R2.4, 25.1.1.1, 25.1.2.2 and earlier",
      "wipe": "Patch to 22.8R2.5 / 25.1.1.2 / 25.1.3.x, run Ivanti's external Integrity Checker, rotate every credential that touched the box",
      "in_the_wild": "yes",
      "source_exception": null,
      "cves": [
        {
          "id": "CVE-2026-104935",
          "score": 8.6,
          "name": "Auth bypass + arbitrary file write"
        }
      ],
      "fixed": [
        {
          "product": "Ivanti Connect Secure 22.8",
          "version": "22.8R2.5"
        },
        {
          "product": "Ivanti Connect Secure 25.1",
          "version": "25.1.1.2 / 25.1.3.0 / 25.1.3.1"
        },
        {
          "product": "Privilege escalation in dsinvoked",
          "version": "none",
          "status": "No CVE, no patch at disclosure. Fix promised “in coming weeks”"
        }
      ],
      "checklist": [
        {
          "title": "Patch every Connect Secure appliance",
          "hint": "22.8R2.5 or 25.1.1.2 / 25.1.3.x"
        },
        {
          "title": "Run the external Integrity Checker Tool",
          "hint": "The attacker tampered with logs to fool the internal one"
        },
        {
          "title": "Reset AD service accounts the VPN uses",
          "hint": "LDAP bind accounts were a target"
        },
        {
          "title": "Rotate LAPS passwords and BitLocker recovery keys",
          "hint": "Both were pulled from AD"
        },
        {
          "title": "Hunt for Kerberoasting",
          "hint": "Unusual TGS requests from the VPN's IP since Oct 1"
        },
        {
          "title": "Plan for the unpatched privesc",
          "hint": "Restrict management access and watch for Ivanti's follow-up fix"
        }
      ],
      "sources": [
        {
          "name": "Volexity",
          "url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/",
          "primary": true
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html",
          "primary": false
        },
        {
          "name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/",
          "primary": false
        },
        {
          "name": "CyberScoop",
          "url": "https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/",
          "primary": false
        }
      ]
    },
    {
      "id": "ghostaction-returns",
      "url": "https://ohshit.app/incidents/ghostaction-returns/",
      "title": "GhostAction is back: hijacked maintainer accounts plant “security-audit.yml” workflows that ship your CI secrets out",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-09",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "supply chain",
        "GitHub Actions",
        "secrets"
      ],
      "ecosystems": [
        "github-actions"
      ],
      "summary": "Compromised GitHub accounts pushed workflows dressed up as security jobs that exfiltrate Actions secrets. A new variant scans full git history, so the key you deleted three years ago still counts. GitHub started blocking the workflow on Oct 9.",
      "splash": "~1,900 accounts and 30,000+ repos targeted (GitGuardian); 3,174 secrets attempted",
      "wipe": "Search .github/workflows for security-audit.yml and friends, rotate every CI secret and any key ever committed, revoke old PATs",
      "in_the_wild": "yes",
      "source_exception": null,
      "cves": [],
      "fixed": [],
      "checklist": [
        {
          "title": "Search for the malicious workflows",
          "hint": "security-audit.yml, github_actions_security.yml, security-check.yml, including in forks"
        },
        {
          "title": "Check Actions logs for POSTs to 193.32.204.199",
          "hint": "Any run of those workflows means assume every secret is gone"
        },
        {
          "title": "Rotate every Actions and environment secret",
          "hint": "Cloud keys, npm/PyPI tokens, deploy keys, webhooks"
        },
        {
          "title": "Rotate anything ever committed to git history",
          "hint": "The variant runs git log -p --all, so deleted secrets count"
        },
        {
          "title": "Revoke and re-issue maintainer PATs",
          "hint": "Prefer fine-grained tokens with expiry; enforce 2FA"
        }
      ],
      "sources": [
        {
          "name": "Socket",
          "url": "https://www.socket.dev/blog/ghostaction-cloud-credentials",
          "primary": true
        },
        {
          "name": "StepSecurity",
          "url": "https://www.stepsecurity.io/blog/ghostaction-returns",
          "primary": true
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html",
          "primary": false
        },
        {
          "name": "The New Stack",
          "url": "https://thenewstack.io/hackers-hijacked-1900-github-accounts-then-they-went-after-30000-repos/",
          "primary": false
        }
      ]
    },
    {
      "id": "oracle-health-20m",
      "url": "https://ohshit.app/incidents/oracle-health-20m/",
      "title": "The Oracle Health breach tally quietly climbs to nearly 20 million patients",
      "level": 4,
      "level_name": "septic-tank-blew",
      "date": "2026-10-05",
      "date_is_approximate": false,
      "updated": null,
      "tags": [
        "healthcare",
        "data leak"
      ],
      "ecosystems": [
        "cerner"
      ],
      "summary": "Stolen logins on two legacy Cerner servers in early 2025. The true size only surfaced through a Texas attorney-general filing: 19.9 million people, with SSNs, diagnoses, medications and medical images. Oracle still hasn't published a total.",
      "splash": "~19.9M patients of legacy Cerner clients in the US, at least 29 hospitals and health systems",
      "wipe": "Freeze your credit, watch for fake “Oracle Health” notices; providers: enforce MFA and retire legacy servers",
      "in_the_wild": "yes",
      "source_exception": "The national total is reported by multiple outlets, but the underlying Texas AG filing is not linked here and remains unverified.",
      "cves": [],
      "fixed": [],
      "checklist": [
        {
          "title": "Freeze your credit",
          "hint": "Equifax, Experian and TransUnion. It's free in the US"
        },
        {
          "title": "Watch for medical identity theft",
          "hint": "Read your Explanation of Benefits for care you never got"
        },
        {
          "title": "Ignore unsolicited “Oracle Health” notices with links",
          "hint": "Breach news always brings phishing"
        },
        {
          "title": "Providers: inventory legacy Cerner servers",
          "hint": "Retire or isolate anything not migrated"
        },
        {
          "title": "Providers: enforce MFA everywhere",
          "hint": "This started with a stolen password"
        }
      ],
      "sources": [
        {
          "name": "HIPAA Journal",
          "url": "https://www.hipaajournal.com/oracle-health-data-breach/",
          "primary": false
        },
        {
          "name": "Becker's Hospital Review",
          "url": "https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/oracle-health-breach-exposed-data-of-nearly-20-million-people-report/",
          "primary": false
        },
        {
          "name": "BankInfoSecurity",
          "url": "https://www.bankinfosecurity.com/oracle-healths-cerner-ehr-breach-figure-soars-to-20-million-a-33033",
          "primary": false
        },
        {
          "name": "Yahoo Finance / Bloomberg",
          "url": "https://finance.yahoo.com/healthcare/articles/oracle-2025-health-breach-compromised-230919298.html",
          "primary": false
        }
      ]
    }
  ]
}