Security alerts: what to do now

1. Update everything, then restart

Update your phone, laptop, browser and home router, then restart each one. Many updates don't take effect until you do.

• Cyber security basics
• All security best practices

2. Remove apps you no longer use

Remove apps and services you no longer use from your accounts. Attackers in the week of October 19, 2026 used access that had already been granted, without anyone signing in.

• Google: third-party connections
• Microsoft: apps with access
• Apple Account
• GitHub: authorized applications

3. Run Google's Security Checkup

If you use Google, its Security Checkup walks through your devices, sign-ins and connected apps in a few minutes.

• Google Security Checkup

4. Check for exposed passwords

Check your email address for known breaches. Change any password you have reused, and move to a password manager and passkeys.

• Have I Been Pwned
• Passwords, passkeys and two-factor sign-in

5. Using AI tools? Rotate your keys

Rotate your AI service API keys and set a monthly spending cap. Keys and secrets were what attackers went after at Railway and LiteLLM this week.

• Railway disclosure
• LiteLLM incident report

6. Ask your vendors two questions

Ask your custodian, CRM, payroll provider and web host, in writing: were you affected by the disclosures in the week of October 19, 2026, and when did you patch? A SOC 2 report describes controls over a past period; it does not show that anyone is watching today.

PHP: two critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619)

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that, under the right conditions, let an unauthenticated attacker run code on servers running PHP. The PHP Foundation says: if you run PHP, update now. Published October 21, 2026. For: Businesses.

• Ask your web host or IT provider whether your sites run PHP and when it was updated.
• If you run PHP yourself, update to a fixed release.

• Source: The PHP Foundation: Today's PHP Security Release

Node.js October 2026 security releases, including a Brotli flaw (CVE-2026-111497)

Node.js 22.23.4, 24.22.1 and 26.12.1 fix several high-severity issues, including a Brotli decoder out-of-bounds write that permits remote code execution, and update trusted certificates for the eMudhra intermediate CA compromise. Published October 21, 2026. For: Developers and IT teams.

• Update Node.js to 22.23.4, 24.22.1 or 26.12.1, or later.
• Move off end-of-life versions; the Node.js project says they are always affected.

• Source: Node.js: Wednesday, October 21, 2026 Security Releases

LiteLLM 1.107.0 was a malicious release

LiteLLM's release pipeline was compromised and published v1.107.0 to PyPI and Docker, containing malware that steals credentials. The releases have been pulled. Published October 21, 2026. For: Developers and IT teams.

• If you installed litellm 1.107.0, or ran the litellm Docker images tagged v1.107.0, latest, main-latest or main-stable on October 21, treat that environment as compromised.
• Rebuild it, pin to 1.106.2 or another earlier version, and rotate every key and secret it could reach.

• Source: LiteLLM: release v1.107.0 compromised

Railway: customer environment variables may have been accessed

Railway says an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. It recommends all users act as a precaution. Published October 21, 2026. For: Developers and IT teams.

• Rotate every environment variable and API key stored in Railway, and any private registry credentials.
• Review logs for those services for unusual activity.

• Source: Railway: Security Disclosure, Wednesday October 21st

GitLab critical patch (CVE-2026-110264)

A flaw in GitLab's regular expression compiler could let an unauthenticated user run code on a self-managed GitLab server. GitLab.com is already patched. Published October 21, 2026. For: Developers and IT teams.

• Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.

• Source: GitLab Critical Patch Release: 19.5.1

Microsoft: Storm-0940 and the ConnectWise supply chain compromise

Microsoft reports that Storm-0940 took control of several ConnectWise cloud apps and used their existing trust in customer tenants to authenticate without an interactive user sign-in. Published October 21, 2026. For: Businesses.

• If you use ConnectWise, keep its app connections disabled and preserve sign-in and audit logs before removing anything; Microsoft advises against deleting enterprise applications as a first response.
• Review which apps have access to your Microsoft 365 or other business accounts, and remove ones you don't use.

• Source: Microsoft Security: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Fake white-hat researchers send malicious exploit kits to crypto teams

Security Alliance reports attackers posing as white-hat researchers on Telegram, sending Solana protocol teams an 'exploit proof of concept' whose run instructions execute a hidden remote payload. Published October 21, 2026. For: Crypto holders and teams.

• Treat any unsolicited exploit code sent over chat as hostile.
• Don't run it or its setup steps; if you must look at it, read it without running it, in an isolated virtual machine.

• Source: Security Alliance Radar: Fake White-Hat Researchers Target Solana Protocols With Malicious Exploit PoCs

eMudhra: private keys of intermediate certificate authorities compromised

A researcher reported, and Mozilla independently confirmed, that the private keys of eight eMudhra intermediate certificate authorities were generated so weakly that anyone could recover them. Firefox distrusted them, eMudhra revoked them, and Mozilla is removing trust in the emSign ECC Root CA - G3. Google says removing that root from the Chrome Root Store is expected to reach all devices that rely on it on Tuesday morning, October 27, 2026 (Pacific time), and sooner on Chrome Canary and Beta. Published October 18, 2026. For: Everyone.

• Update your browsers so they carry the new trust lists. On Android, restarting the phone can trigger Google's update.
• If you use Cloudflare's WARP / 1.1.1.1 app or cloudflared, update it; Cloudflare released fixes.
• Website owners: if your certificate chains to emSign ECC Root CA - G3, replace it with one from another certificate authority before October 27, 2026.
• Developers: update runtimes that ship their own certificate store, such as Node.js.

• Source: Mozilla Bugzilla 2083449: eMudhra private key compromise of intermediate certificates
• Source: Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
• Source: Cloudflare: eMudhra certificate compromise

Public vulnerability and release feeds

These free public sources are where new flaws, fixes and confirmed attacks are announced.

• GitHub Advisory Database (reviewed advisories)
• CISA Known Exploited Vulnerabilities Catalog
• Node.js vulnerability blog
• Chrome Releases

Does it affect me?

Check the exact product and version you use, not just the name.

Did I apply the fix?

Installing an update is not the same as running it; restart the device, app or service.

Is the running system actually fixed?

Confirm the version that is running now, on every device or server, not the one you meant to install.

Was I affected before I fixed it?

A fix closes the door; it does not undo anything that happened earlier. Change passwords or keys that may have been exposed, and look for activity you don't recognize.

Copy this into your AI assistant, with a link to this page

Use the security alerts page at https://protocolwealthllc.com/bestpractices/alerts/ (check its "Last updated" date). Explain it to me in plain language, at my level. 1. Ask me which phones, computers, browsers, apps and online services I use, and tell me which alerts apply to me. 2. Give me the few steps that matter most first, in order, with where to tap or click. 3. For each alert that applies, keep four answers separate: does it affect me, did I apply the fix, is what's running now actually fixed, and could anything have happened before I fixed it. 4. Don't claim you checked anything you can't see. Never ask me for passwords, one-time codes or recovery phrases.

Reading and citing this page

This page is free to read, summarize and link. Machine-readable copies are at /bestpractices/alerts.json and /bestpractices/alerts.md. Please cite this page and its last-updated date.

• alerts.json
• alerts.md