October 2026 security incidents have triggered urgent responses across major open-source software projects and internet infrastructure. Critical PHP vulnerabilities forced government websites offline, while Node.js issued security updates and LiteLLM disclosed a software supply chain attack.
Reuters reported that government websites in several European countries were temporarily unavailable. The disruption followed the discovery of two serious PHP vulnerabilities that could let attackers run malicious code on affected servers.
PHP developers released emergency patches on Wednesday to address flaws identified through AI-assisted research. A separate report on the discovery detailed how researchers working with OpenAI and Google’s Wiz uncovered weaknesses dating back years.
The National Security Agency issued an urgent advisory recommending immediate updates. Organizations that couldn’t secure affected systems were advised to take them offline until they could address the vulnerabilities.
October 2026 security incidents extend to Node.js
On the same day, Node.js, the JavaScript runtime widely used for server applications, released patches for four high-severity vulnerabilities.
The October security release addressed a flaw that allowed remote code execution and two weaknesses involving TLS certificate hostname verification; a fourth issue involved handling DNS names. Details of Node.js vulnerabilities are also available through the OpenCVE database.
LiteLLM supply chain attack exposes credentials
LiteLLM, an open-source platform for connecting applications to different AI models, also disclosed a security compromise. In a public statement, the company confirmed that attackers had distributed malicious software releases.
Security researchers at Aikido Security identified credential-stealing malware and a remote access trojan in LiteLLM version 1.107.0. The compromised software appeared on PyPI, Docker Hub and GitHub Container Registry.
The company removed the affected releases and advised users to follow its remediation guidance. A GitHub security report documented the malicious components and potential exposure of cloud credentials, passwords and AI service secrets.
Certificate failures create additional security risks
Separate concerns emerged over digital certificates issued by Indian certificate authority eMudhra. Security reporting revealed that some private keys were exceptionally weak and could be recovered from publicly available information.
The affected certificates could allow attackers to impersonate legitimate websites. An analysis of eight compromised certificates described the extensive cleanup required across browsers and other systems.
Other security incidents added to the workload. Database provider PingCAP disclosed unauthorized access to cloud resources, while Plex Media Server faced active exploitation involving four vulnerabilities collectively known as Plex2Shell.
Self-hosted server users reported attacks, while security researchers documented cryptocurrency miners and malicious proxy software installed through the vulnerabilities.
Meanwhile, BeyondTrust patched an actively exploited vulnerability in its Remote Support software. The company said attackers had been exploiting the flaw since August.
Although unrelated, the incidents created overlapping demands for security teams. Organizations must prioritize patching, investigate potential compromises and verify that affected software and credentials are secure.
