I. PHP2Shell: Webpage Master Key Copied
1. PHP is a "engine" language for website backends. Numerous websites (especially content management systems, e-commerce sites, and forums) use it to generate dynamic pages and connect to databases.
2. Two vulnerabilities were recently discovered that allow remote control of servers without usernames or passwords, affecting almost all versions of PHP from 5.4 to 8.5.11. An official patch was released on October 21st, but no further fixes are available for versions 8.1 and earlier.
II. GitLab: A Perfect 10/10 "Accessless Intrusion"
1. GitLab is a "one-stop shop" for software development. Development teams use it to store code, review modifications, automate testing, and deploy. Many companies install it on their own servers (self-hosted GitLab).
2. Self-hosted GitLabs from version 7.0 onwards are all affected. Attackers do not need to log in; they only need to submit a carefully crafted regular expression to execute arbitrary code on the server. An official patch was released on October 21st.
III. LiteLLM 1.107.0: Malicious Version Leads to Complete Key Loss
1. LiteLLM is a commonly used toolkit for AI applications. Many AI products and intelligent agents use it to manage keys, allocate requests, and control costs.
2. On October 21st, its release process was compromised. A malicious version 1.107.0 was stuck on PyPI and Docker for approximately 1 hour and 44 minutes. Once installed and started, it steals SSH keys, cloud service credentials, and AI tool keys, leaving a backdoor.
IV. Node.js: Three Version Lines Have Issues, the Most Serious One Allows Remote Code Execution
1. Node.js is a runtime environment that allows JavaScript to run on servers. Many website backends, real-time applications (chat, collaboration tools), and API services rely on it.
2. Node.js version lines 22, 24, and 26 patched a total of 10 vulnerabilities. The most serious issue is the Brotli decoder's out-of-bounds write (CVE-2026-111497), which could lead to remote code execution and is rated "high risk."
V. eMudhra: The Certificate Authority's "Lock" Was Opened in an Instant, Shaking the Foundation of HTTPS Trust
1. eMudhra is an Indian "Digital Identity/Certificate Authority."
2. Eight of the authority's intermediate certificates have serious security vulnerabilities in their associated private keys, with abnormally weak key strength, potentially allowing them to be used to forge trusted website certificates. Chrome, Firefox, and Apple have already blocked these certificates.
VI. Railway: The Hosting Platform's "Safe" Was Pried Open, Some Passwords Leaked
1. Railway is a cloud deployment platform for developers.
2. The Railway hosting platform's encrypted environment variables were accessed, and some have been decrypted. Deployment has been suspended, and the official requirement is for all users to rotate their keys.
VII. Agent2Shell: AI Programming Assistant "Execute First, Ask Later"
1. Agent2Shell is a type of attack targeting AI programming assistants. The AI programming tools involved (such as Claude Code, Cursor, Codex, and Gemini CLI) are intelligent assistants that help developers automatically write and modify code and execute terminal commands.
2. An attacker places a malicious configuration in the repository, and Claude Code, Cursor, Codex, and Gemini will execute the attacker's code before calling the model and displaying a trust confirmation.
VIII. Cisco Expressway: Root Access Without Login
1. Cisco Expressway is Cisco's enterprise video conferencing/unified communications gateway.
2. On October 21, Cisco disclosed a perfect edge-level vulnerability in its Expressway series. Attackers can execute arbitrary operating system commands with root privileges as long as they have access to the device, without authentication, and there are no temporary mitigation measures; only patching is possible.
IX. CISA Adds Six Newly Exploited Vulnerabilities
1. On October 20, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its list of known exploitable vulnerabilities, involving products such as Plex Media Server, EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center. Among them, the DLL sideloading vulnerability (CVE-2026-110936) in Siemens Software Center has been confirmed to be actively exploited.
