Good morning. GitLab shipped a fix for a 10.0 flaw that lets outsiders run code on self-hosted servers, so Friday starts with a GitLab upgrade. Attackers are already using a new VeloCloud Orchestrator bug, a fake LiteLLM release spent two hours stealing keys, and Amazon says PHP2Shell attacks began four days before the patch.
Lead Story
GitLab fixed a 10.0 code-execution flaw in every self-managed version since 7.0; GitLab.com is already patched. Pick your upgrade build →
Also Worth Your Attention
Attackers are exploiting a VeloCloud Orchestrator flaw that turns a read-only login into a superuser. Upgrade and check logs →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
A malicious LiteLLM 1.107.0 release stole credentials for about two hours on October 21. Check your installs →
Amazon says PHP2Shell attacks started October 17, four days before the patch. Start the hunt →
Also on the radar: Splunk fixed four groups of internally found bugs in Splunk Enterprise, two rated 9.9, in 9.4.16, 10.0.11, 10.2.8 and 10.4.4 (Splunk SVD-2026-1008). Cloud host Railway asked all users to rotate secrets stored in environment variables after someone may have obtained decrypted copies (BleepingComputer).
Source: GitLab patch release; Arista advisory 0199; LiteLLM incident report; Amazon Threat Intelligence
Go Deeper
- Identity and access management: rotating keys and cutting stale accounts
- Cybersecurity tools for asset inventory and patch tracking
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
