What this means for your clients: a popular tool that connects business apps to AI services briefly published a new version that steals passwords and keys. Any team that installed a compromised 1.107.0 wheel or ran an infected image should treat that environment as compromised, rebuild it, delete any cached copy and change every key that machine could reach. On the morning of October 21, a developer on your client's team pulled the newest LiteLLM to try a new model. The pro

What this means for your clients: a common piece of code that unpacks compressed web traffic has a serious flaw, and it hides inside apps and scripts that normal update checks do not see, so someone has to go looking for it. Picture a client's customer portal, built two years ago by a contractor and running on Node.js inside a container nobody has rebuilt since. This week the compression code inside it became a real risk, and your patch dashboard may well miss it. The fla

What this means for your clients: if a firewall was open to the internet, attackers may already hold a copy of the passwords stored inside it, so installing the update is only half the job and those passwords need to be changed too. Picture a hypothetical client firewall: patched, ticket closed. Two weeks before the patch, someone downloaded its configuration file, and that copy now sits on a machine you will never see. Inside it are the bind account passwords the firewall us

What this means for your clients: in our sandbox we built the last vulnerable and first fixed PHP 8.5 releases and sent the advisory's own trigger to both under Apache mod_php. On the vulnerable build the Zend memory manager flagged its own heap as corrupted and the worker aborted. On the fixed build the same input was handled cleanly and the worker stayed up. That is strong evidence the update works, not proof against every attack path, so patch now. Update, Oct 24, 2026: We

Update, 30 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26. Dream Research reports a campaign that chained a custom PHP2Shell exploit with the Linux kernel flaw CVE-2026-46300, which it calls Fragnesia, and rooted 25 Palo Alto Networks PAN-OS firewall and management servers. Dream says the attacker targeted the PAN-OS 12.1 and 12.2 branches running PHP 8.0.30, and that the exploit was built for PAN-OS and was not a copy of

What this means for your clients: criminals are now letting AI agents spend a day probing online shops at what NorForge estimates is a few dollars per attempt, and the file they leave behind can look like an ordinary upload form. Take a popular online store with enough traffic to make an attacker's shortlist. Before any agent touches it, a script checks that the store really takes orders. Then a set of AI agents gets one goal: find a way to run code on the site without loggin

What this means for your clients: any client website that switched on a Rank Math PRO 3.0.123 copy downloaded or updated during the affected window on October 15 or 16 should be treated as hacked, and installing the newer version alone does not clean it up. Picture a small agency that looks after a stack of client sites, every one running the same premium WordPress plugin, with updates switched on. On a Thursday afternoon, the agency's scheduled update job pulls the latest bu

The firewall admin signs in on a Monday and the password is wrong. It worked on Friday. The admin list now holds an account called something like forticloud-sync that nobody remembers creating. Someone knew a password that still worked. On 6 October 2026, the FBI and the US Secret Service published joint advisory JCSA-20261006-01 on FortiBleed, "an active, global credential-compromise campaign" against internet-facing FortiGate firewalls and SSL VPN gateways. SOCRadar, cited

A reported AI-driven intrusion in Spain raises a harder question than which model was used: what could one successful login reach? Our analysis examines attack hypotheses, evidence gaps, preventive controls, and a practical SMB response plan.