{ "lastUpdated": "October 22, 2026", "page": "https://protocolwealthllc.com/bestpractices/alerts/", "week": "the week of October 19, 2026", "thisWeek": [ { "title": "1. Update everything, then restart", "body": "Update your phone, laptop, browser and home router, then restart each one. Many updates don't take effect until you do.", "links": [ { "label": "Cyber security basics", "href": "https://protocolwealthllc.com/bestpractices/cyber-security/" }, { "label": "All security best practices", "href": "https://protocolwealthllc.com/bestpractices/" } ] }, { "title": "2. Remove apps you no longer use", "body": "Remove apps and services you no longer use from your accounts. Attackers in the week of October 19, 2026 used access that had already been granted, without anyone signing in.", "links": [ { "label": "Google: third-party connections", "href": "https://myaccount.google.com/connections" }, { "label": "Microsoft: apps with access", "href": "https://account.live.com/consent/Manage" }, { "label": "Apple Account", "href": "https://appleid.apple.com" }, { "label": "GitHub: authorized applications", "href": "https://github.com/settings/applications" } ] }, { "title": "3. Run Google's Security Checkup", "body": "If you use Google, its Security Checkup walks through your devices, sign-ins and connected apps in a few minutes.", "links": [ { "label": "Google Security Checkup", "href": "https://myaccount.google.com/security-checkup" } ] }, { "title": "4. Check for exposed passwords", "body": "Check your email address for known breaches. Change any password you have reused, and move to a password manager and passkeys.", "links": [ { "label": "Have I Been Pwned", "href": "https://haveibeenpwned.com" }, { "label": "Passwords, passkeys and two-factor sign-in", "href": "https://protocolwealthllc.com/bestpractices/cyber-security/" } ] }, { "title": "5. Using AI tools? Rotate your keys", "body": "Rotate your AI service API keys and set a monthly spending cap. Keys and secrets were what attackers went after at Railway and LiteLLM this week.", "links": [ { "label": "Railway disclosure", "href": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st" }, { "label": "LiteLLM incident report", "href": "https://docs.litellm.ai/blog/security-incident-oct-21-2026" } ] }, { "title": "6. Ask your vendors two questions", "body": "Ask your custodian, CRM, payroll provider and web host, in writing: were you affected by the disclosures in the week of October 19, 2026, and when did you patch? A SOC 2 report describes controls over a past period; it does not show that anyone is watching today.", "links": [] } ], "alerts": [ { "id": "2026-10-php-rce", "published": "2026-10-21", "audience": "business", "title": "PHP: two critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619)", "what": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that, under the right conditions, let an unauthenticated attacker run code on servers running PHP. The PHP Foundation says: if you run PHP, update now.", "doNow": [ "Ask your web host or IT provider whether your sites run PHP and when it was updated.", "If you run PHP yourself, update to a fixed release." ], "sources": [ { "label": "The PHP Foundation: Today's PHP Security Release", "href": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "date": "2026-10-21" } ] }, { "id": "2026-10-nodejs-security-releases", "published": "2026-10-21", "audience": "developers", "title": "Node.js October 2026 security releases, including a Brotli flaw (CVE-2026-111497)", "what": "Node.js 22.23.4, 24.22.1 and 26.12.1 fix several high-severity issues, including a Brotli decoder out-of-bounds write that permits remote code execution, and update trusted certificates for the eMudhra intermediate CA compromise.", "doNow": [ "Update Node.js to 22.23.4, 24.22.1 or 26.12.1, or later.", "Move off end-of-life versions; the Node.js project says they are always affected." ], "sources": [ { "label": "Node.js: Wednesday, October 21, 2026 Security Releases", "href": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "date": "2026-10-21" } ] }, { "id": "2026-10-litellm-1-107-0", "published": "2026-10-21", "audience": "developers", "title": "LiteLLM 1.107.0 was a malicious release", "what": "LiteLLM's release pipeline was compromised and published v1.107.0 to PyPI and Docker, containing malware that steals credentials. The releases have been pulled.", "doNow": [ "If you installed litellm 1.107.0, or ran the litellm Docker images tagged v1.107.0, latest, main-latest or main-stable on October 21, treat that environment as compromised.", "Rebuild it, pin to 1.106.2 or another earlier version, and rotate every key and secret it could reach." ], "sources": [ { "label": "LiteLLM: release v1.107.0 compromised", "href": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "date": "2026-10-21" } ] }, { "id": "2026-10-railway-env-vars", "published": "2026-10-21", "audience": "developers", "title": "Railway: customer environment variables may have been accessed", "what": "Railway says an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. It recommends all users act as a precaution.", "doNow": [ "Rotate every environment variable and API key stored in Railway, and any private registry credentials.", "Review logs for those services for unusual activity." ], "sources": [ { "label": "Railway: Security Disclosure, Wednesday October 21st", "href": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st", "date": "2026-10-21" } ] }, { "id": "2026-10-gitlab-cve-2026-110264", "published": "2026-10-21", "audience": "developers", "title": "GitLab critical patch (CVE-2026-110264)", "what": "A flaw in GitLab's regular expression compiler could let an unauthenticated user run code on a self-managed GitLab server. GitLab.com is already patched.", "doNow": [ "Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13." ], "sources": [ { "label": "GitLab Critical Patch Release: 19.5.1", "href": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/", "date": "2026-10-21" } ] }, { "id": "2026-10-storm-0940-connectwise", "published": "2026-10-21", "audience": "business", "title": "Microsoft: Storm-0940 and the ConnectWise supply chain compromise", "what": "Microsoft reports that Storm-0940 took control of several ConnectWise cloud apps and used their existing trust in customer tenants to authenticate without an interactive user sign-in.", "doNow": [ "If you use ConnectWise, keep its app connections disabled and preserve sign-in and audit logs before removing anything; Microsoft advises against deleting enterprise applications as a first response.", "Review which apps have access to your Microsoft 365 or other business accounts, and remove ones you don't use." ], "sources": [ { "label": "Microsoft Security: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "href": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "date": "2026-10-21" } ] }, { "id": "2026-10-fake-white-hat-pocs", "published": "2026-10-21", "audience": "crypto", "title": "Fake white-hat researchers send malicious exploit kits to crypto teams", "what": "Security Alliance reports attackers posing as white-hat researchers on Telegram, sending Solana protocol teams an 'exploit proof of concept' whose run instructions execute a hidden remote payload.", "doNow": [ "Treat any unsolicited exploit code sent over chat as hostile.", "Don't run it or its setup steps; if you must look at it, read it without running it, in an isolated virtual machine." ], "sources": [ { "label": "Security Alliance Radar: Fake White-Hat Researchers Target Solana Protocols With Malicious Exploit PoCs", "href": "https://radar.securityalliance.org/advisory-fake-white-hat-researchers-target-solana-protocols-with-malicious-exploit-pocs/", "date": "2026-10-21" } ] }, { "id": "2026-10-emudhra-intermediate-ca", "published": "2026-10-18", "audience": "everyone", "title": "eMudhra: private keys of intermediate certificate authorities compromised", "what": "A researcher reported, and Mozilla independently confirmed, that the private keys of eight eMudhra intermediate certificate authorities were generated so weakly that anyone could recover them. Firefox distrusted them, eMudhra revoked them, and Mozilla is removing trust in the emSign ECC Root CA - G3. Google says removing that root from the Chrome Root Store is expected to reach all devices that rely on it on Tuesday morning, October 27, 2026 (Pacific time), and sooner on Chrome Canary and Beta.", "doNow": [ "Update your browsers so they carry the new trust lists. On Android, restarting the phone can trigger Google's update.", "If you use Cloudflare's WARP / 1.1.1.1 app or cloudflared, update it; Cloudflare released fixes.", "Website owners: if your certificate chains to emSign ECC Root CA - G3, replace it with one from another certificate authority before October 27, 2026.", "Developers: update runtimes that ship their own certificate store, such as Node.js." ], "sources": [ { "label": "Mozilla Bugzilla 2083449: eMudhra private key compromise of intermediate certificates", "href": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083449", "date": "2026-10-18" }, { "label": "Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates", "href": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/", "date": "2026-10-20" }, { "label": "Cloudflare: eMudhra certificate compromise", "href": "https://blog.cloudflare.com/emudhra-certificate-compromise/", "date": "2026-10-20" } ] } ], "feeds": [ { "label": "GitHub Advisory Database (reviewed advisories)", "href": "https://github.com/advisories?query=type%3Areviewed" }, { "label": "CISA Known Exploited Vulnerabilities Catalog", "href": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "label": "Node.js vulnerability blog", "href": "https://nodejs.org/en/blog/vulnerability" }, { "label": "Chrome Releases", "href": "https://chromereleases.googleblog.com/" } ], "fourQuestions": [ { "question": "Does it affect me?", "why": "Check the exact product and version you use, not just the name." }, { "question": "Did I apply the fix?", "why": "Installing an update is not the same as running it; restart the device, app or service." }, { "question": "Is the running system actually fixed?", "why": "Confirm the version that is running now, on every device or server, not the one you meant to install." }, { "question": "Was I affected before I fixed it?", "why": "A fix closes the door; it does not undo anything that happened earlier. Change passwords or keys that may have been exposed, and look for activity you don't recognize." } ], "aiPrompt": "Use the security alerts page at https://protocolwealthllc.com/bestpractices/alerts/ (check its \"Last updated\" date). Explain it to me in plain language, at my level.\n1. Ask me which phones, computers, browsers, apps and online services I use, and tell me which alerts apply to me.\n2. Give me the few steps that matter most first, in order, with where to tap or click.\n3. For each alert that applies, keep four answers separate: does it affect me, did I apply the fix, is what's running now actually fixed, and could anything have happened before I fixed it.\n4. Don't claim you checked anything you can't see. Never ask me for passwords, one-time codes or recovery phrases.", "note": "General educational information, not personalized advice and not a security audit. Following it can reduce risk but cannot eliminate it. Links to government and third-party sites are provided for convenience; Protocol Wealth does not control those sites and is not affiliated with them. Protocol Wealth, LLC is an SEC-registered investment adviser (CRD #335298). Registration does not imply a certain level of skill or training." }