PHP, Node.js, GitLab and LiteLLM hit critical security incidents the same day
alex_verem · x · 2026-10-22
mardehaym flags that PHP, Node.js, GitLab and LiteLLM all had critical security incidents on the same day, with an action list for production teams:
- Patch internet-facing services first: PHP 8.5.12/8.4.27/8.3.36/8.2.35; Node.js October 21 security releases for 22, 24 and 26; self-managed GitLab critical patch from October 21
- Find anything on PHP 8.1 or older: no upstream fixes; get a vendor backport or upgrade, keep off the public internet meanwhile
- Search every environment for LiteLLM 1.107.0: that release shipped a credential stealer; rotate every cloud and model API key the machine could reach and rebuild — removing the package is not enough
- Stop pulling "latest" blindly
More from Infra
- Rescale built an AI triage agent in 5 days with Strands Agents and Claude on Bedrock — AWS ML Blog · 2026-10-23
- Tesla and NVIDIA back $2.8B expansion of Samsung's advanced chip substrate supply — XFreeze · 2026-10-23
- Analyst Ben Bajarin: think of data centers as prime real estate — BenBajarin · 2026-10-23
- CoreWeave launches Physical AI Launchables: run Isaac Sim, CARLA, MuJoCo with one command — wandb · 2026-10-23
- Micron exec insights suggest HBM supply stays tight through 2029 — BenBajarin · 2026-10-23
- Shadeform launches dedicated CLI and official MCP server for agent access to global compute — thisdudelikesAI · 2026-10-23