What the news means for the people who have to act on it: the controls that matter, what regulation asks for, and how to explain it to the board.
Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.
Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.
Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.
CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), allow unauthenticated remote code execution. Exploitation began four days before the 21 Oct patches. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 tonight.
On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.
