# Security alerts: what to do now Last updated October 22, 2026. Page: https://protocolwealthllc.com/bestpractices/alerts/ _General educational information, not personalized advice and not a security audit. Following it can reduce risk but cannot eliminate it. Links to government and third-party sites are provided for convenience; Protocol Wealth does not control those sites and is not affiliated with them. Protocol Wealth, LLC is an SEC-registered investment adviser (CRD #335298). Registration does not imply a certain level of skill or training._ ## 30 minutes this week (the week of October 19, 2026) ### 1. Update everything, then restart Update your phone, laptop, browser and home router, then restart each one. Many updates don't take effect until you do. - [Cyber security basics](https://protocolwealthllc.com/bestpractices/cyber-security/) - [All security best practices](https://protocolwealthllc.com/bestpractices/) ### 2. Remove apps you no longer use Remove apps and services you no longer use from your accounts. Attackers in the week of October 19, 2026 used access that had already been granted, without anyone signing in. - [Google: third-party connections](https://myaccount.google.com/connections) - [Microsoft: apps with access](https://account.live.com/consent/Manage) - [Apple Account](https://appleid.apple.com) - [GitHub: authorized applications](https://github.com/settings/applications) ### 3. Run Google's Security Checkup If you use Google, its Security Checkup walks through your devices, sign-ins and connected apps in a few minutes. - [Google Security Checkup](https://myaccount.google.com/security-checkup) ### 4. Check for exposed passwords Check your email address for known breaches. Change any password you have reused, and move to a password manager and passkeys. - [Have I Been Pwned](https://haveibeenpwned.com) - [Passwords, passkeys and two-factor sign-in](https://protocolwealthllc.com/bestpractices/cyber-security/) ### 5. Using AI tools? Rotate your keys Rotate your AI service API keys and set a monthly spending cap. Keys and secrets were what attackers went after at Railway and LiteLLM this week. - [Railway disclosure](https://blog.railway.com/p/security-disclosure-wednesday-october-21st) - [LiteLLM incident report](https://docs.litellm.ai/blog/security-incident-oct-21-2026) ### 6. Ask your vendors two questions Ask your custodian, CRM, payroll provider and web host, in writing: were you affected by the disclosures in the week of October 19, 2026, and when did you patch? A SOC 2 report describes controls over a past period; it does not show that anyone is watching today. ## Alerts from the week of October 19, 2026 ### PHP: two critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619) Published October 21, 2026. For: Businesses. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that, under the right conditions, let an unauthenticated attacker run code on servers running PHP. The PHP Foundation says: if you run PHP, update now. What to do: - Ask your web host or IT provider whether your sites run PHP and when it was updated. - If you run PHP yourself, update to a fixed release. Sources: - [The PHP Foundation: Today's PHP Security Release](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) (October 21, 2026) ### Node.js October 2026 security releases, including a Brotli flaw (CVE-2026-111497) Published October 21, 2026. For: Developers and IT teams. Node.js 22.23.4, 24.22.1 and 26.12.1 fix several high-severity issues, including a Brotli decoder out-of-bounds write that permits remote code execution, and update trusted certificates for the eMudhra intermediate CA compromise. What to do: - Update Node.js to 22.23.4, 24.22.1 or 26.12.1, or later. - Move off end-of-life versions; the Node.js project says they are always affected. Sources: - [Node.js: Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) (October 21, 2026) ### LiteLLM 1.107.0 was a malicious release Published October 21, 2026. For: Developers and IT teams. LiteLLM's release pipeline was compromised and published v1.107.0 to PyPI and Docker, containing malware that steals credentials. The releases have been pulled. What to do: - If you installed litellm 1.107.0, or ran the litellm Docker images tagged v1.107.0, latest, main-latest or main-stable on October 21, treat that environment as compromised. - Rebuild it, pin to 1.106.2 or another earlier version, and rotate every key and secret it could reach. Sources: - [LiteLLM: release v1.107.0 compromised](https://docs.litellm.ai/blog/security-incident-oct-21-2026) (October 21, 2026) ### Railway: customer environment variables may have been accessed Published October 21, 2026. For: Developers and IT teams. Railway says an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. It recommends all users act as a precaution. What to do: - Rotate every environment variable and API key stored in Railway, and any private registry credentials. - Review logs for those services for unusual activity. Sources: - [Railway: Security Disclosure, Wednesday October 21st](https://blog.railway.com/p/security-disclosure-wednesday-october-21st) (October 21, 2026) ### GitLab critical patch (CVE-2026-110264) Published October 21, 2026. For: Developers and IT teams. A flaw in GitLab's regular expression compiler could let an unauthenticated user run code on a self-managed GitLab server. GitLab.com is already patched. What to do: - Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. Sources: - [GitLab Critical Patch Release: 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) (October 21, 2026) ### Microsoft: Storm-0940 and the ConnectWise supply chain compromise Published October 21, 2026. For: Businesses. Microsoft reports that Storm-0940 took control of several ConnectWise cloud apps and used their existing trust in customer tenants to authenticate without an interactive user sign-in. What to do: - If you use ConnectWise, keep its app connections disabled and preserve sign-in and audit logs before removing anything; Microsoft advises against deleting enterprise applications as a first response. - Review which apps have access to your Microsoft 365 or other business accounts, and remove ones you don't use. Sources: - [Microsoft Security: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) (October 21, 2026) ### Fake white-hat researchers send malicious exploit kits to crypto teams Published October 21, 2026. For: Crypto holders and teams. Security Alliance reports attackers posing as white-hat researchers on Telegram, sending Solana protocol teams an 'exploit proof of concept' whose run instructions execute a hidden remote payload. What to do: - Treat any unsolicited exploit code sent over chat as hostile. - Don't run it or its setup steps; if you must look at it, read it without running it, in an isolated virtual machine. Sources: - [Security Alliance Radar: Fake White-Hat Researchers Target Solana Protocols With Malicious Exploit PoCs](https://radar.securityalliance.org/advisory-fake-white-hat-researchers-target-solana-protocols-with-malicious-exploit-pocs/) (October 21, 2026) ### eMudhra: private keys of intermediate certificate authorities compromised Published October 18, 2026. For: Everyone. A researcher reported, and Mozilla independently confirmed, that the private keys of eight eMudhra intermediate certificate authorities were generated so weakly that anyone could recover them. Firefox distrusted them, eMudhra revoked them, and Mozilla is removing trust in the emSign ECC Root CA - G3. Google says removing that root from the Chrome Root Store is expected to reach all devices that rely on it on Tuesday morning, October 27, 2026 (Pacific time), and sooner on Chrome Canary and Beta. What to do: - Update your browsers so they carry the new trust lists. On Android, restarting the phone can trigger Google's update. - If you use Cloudflare's WARP / 1.1.1.1 app or cloudflared, update it; Cloudflare released fixes. - Website owners: if your certificate chains to emSign ECC Root CA - G3, replace it with one from another certificate authority before October 27, 2026. - Developers: update runtimes that ship their own certificate store, such as Node.js. Sources: - [Mozilla Bugzilla 2083449: eMudhra private key compromise of intermediate certificates](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449) (October 18, 2026) - [Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) (October 20, 2026) - [Cloudflare: eMudhra certificate compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/) (October 20, 2026) ## Four questions for every alert Keep these answers separate. A fix answers only one of them. - **Does it affect me?** Check the exact product and version you use, not just the name. - **Did I apply the fix?** Installing an update is not the same as running it; restart the device, app or service. - **Is the running system actually fixed?** Confirm the version that is running now, on every device or server, not the one you meant to install. - **Was I affected before I fixed it?** A fix closes the door; it does not undo anything that happened earlier. Change passwords or keys that may have been exposed, and look for activity you don't recognize. ## Ask your own AI assistant ```text Use the security alerts page at https://protocolwealthllc.com/bestpractices/alerts/ (check its "Last updated" date). Explain it to me in plain language, at my level. 1. Ask me which phones, computers, browsers, apps and online services I use, and tell me which alerts apply to me. 2. Give me the few steps that matter most first, in order, with where to tap or click. 3. For each alert that applies, keep four answers separate: does it affect me, did I apply the fix, is what's running now actually fixed, and could anything have happened before I fixed it. 4. Don't claim you checked anything you can't see. Never ask me for passwords, one-time codes or recovery phrases. ``` ## Sources we watch - [GitHub Advisory Database (reviewed advisories)](https://github.com/advisories?query=type%3Areviewed) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [Node.js vulnerability blog](https://nodejs.org/en/blog/vulnerability) - [Chrome Releases](https://chromereleases.googleblog.com/) ## For AI assistants This page is free to read, summarize and link. Machine-readable copies are at https://protocolwealthllc.com/bestpractices/alerts.json and https://protocolwealthllc.com/bestpractices/alerts.md. Please cite https://protocolwealthllc.com/bestpractices/alerts/ and its last-updated date.