Swartz (Rajcyber068)

October 2026 Cybersecurity: Major breaches, supply-chain compromises, and critical patches. 1. LiteLLM supply-chain attack: On Oct 21, attackers pushed a malicious 1.107.0 release to PyPI and Docker. It contained hidden code to steal credentials and execute remote commands. LiteLLM removed it; users should downgrade and rotate keys immediately. 2. Zeabur breach: Cloud platform Zeabur disclosed a breach (Oct 14–15) where 3.2M environment variables and 321k account records were stolen. Attackers used leaked internal creds to access DBs. Zeabur advised rotating any secrets stored there. 3. Tensorlake npm worm: On Oct 8, v0.5.144 of tensorlake (18k installs/week) was published with a credential-stealing worm. It exfiltrated npm/GitHub/AWS tokens and spread itself. If you installed it, remove it and rotate all developer tokens . 4. GhostAction campaign: The GitHub Actions “GhostAction” continues. By Oct 12 it had compromised ~1,900 maintainer accounts and injected fake security-audit workflows into ~30,000 repos. These stole CI secrets (GitHub PATs, AWS keys). GitHub has since blocked the malicious jobs . Rotate any exposed tokens. 5. PHP2Shell RCE: Oct 21 saw urgent patches for two critical PHP RCEs (CVE-2026-109618 & -109619, CVSS 9.2). These affect every PHP 5.4+ web server. Attacks are live in the wild. Admins: apply PHP 8.3.1+/8.2.8+ (etc) patches now or risk full compromise. 6. Node.js TLS/DNS fixes: Also Oct 21, Node.js v26/24/22 releases fixed high-severity flaws (e.g. DNS rebinding bypass, TLS host spoofing, Brotli OOB write). All server-side apps using Node should update to the patched versions immediately. 7. Siemens Software Center RCE: Siemens found its Software Center auto-update utility was abused (Oct 19) to load attacker DLLs (CVE-2026-110936). Romulus APT used this to install “FofaDoor” malware. Fixed in SCC v4.0.9.8 (Oct 15). Update ASAP and block IoCs. 8. eMudhra CA keys: On Oct 17 a researcher proved eight eMudhra CA keys were trivially factorable (one key = “4”!). Browsers (Chrome/Firefox) promptly revoked them. Any code-signed or TLS cert from those CAs is now untrusted. Rotate and reissue certs if you rely on eMudhra. 9. ConnectWise Cloud Backup: SkyKick (ConnectWise Cloud Backup) announced an incident (mitigations Oct 17). They reset access and suspended services. ConnectWise reports no data loss seen so far. Tenants should reset any SkyKick-related credentials and watch logs per their guidance. 10. PingCAP/TiDB leak (unverified): A security group claims they exfiltrated ~10.6 TB from PingCAP’s TiDB Cloud, including 180k tenant configs and 115k plaintext API keys. PingCAP hasn’t confirmed this. If you use TiDB Cloud, tighten access keys anyway and await official audit. 11. Other patches: Chrome 117 patched dozens of use-after-free bugs (CVE-2026-17650–56), Drupal released security updates, and Oracle’s Oct CPU was published. Also watch for WordPress plugin backdoors – e.g. Rank Math PRO had a malicious update in Oct. Immediate Response Checklist:- - Patch systems now: Apply all vendor fixes from Oct 2026 (PHP updates, Node.js updates, Oracle CPU, Chrome update, Drupal/WordPress updates, Siemens Software Center 4.0.9.8, etc.). Enable auto-updates or use a patch management tool. - Rotate credentials: Assume any exposed CI or cloud tokens are compromised. Reset GitHub/PATs, AWS/GCP keys, database passwords, API keys, etc., especially those stored in breached systems or found in intercepted workflows. - Audit and monitor: Review logs around the dates of incidents (Oct 8–21). Look for unusual logins, workflow activations (security-audit.yml), or data exfiltration. Check GitHub orgs for unauthorized workflow files. Use IDS/EDR for IoCs . - Harden supply chain: Lock down build/deploy pipelines. For npm/PyPI: use vetted registries or allowlist critical packages. Vet any new release (e.g. enable installation cooldowns, dependency scanning). On GitHub, require signed commits or restrict action usage. - Revoke and re-issue certificates: After the eMudhra incident, update all TLS/SSH/trusted certs signed by those intermediates. Ensure systems trust the latest CA bundles (browser/OS updates). Re-sign code with a different CA if needed. - Prepare incident response: Ensure backups are offline or encrypted. Review incident response plans for supply-chain and cloud breaches. Notify affected customers/partners per regulations if data may have leaked.