Security1 hOctober 24, 2026, 20:42

Patch roundup: critical RCEs in PHP, Node.js, GitLab and LiteLLM supply-chain attack

Between Oct 12 and Oct 22, 2026, critical fixes shipped for PHP (CVE-2026-109618 and CVE-2026-109619, unauthenticated RCE), Node.js (Brotli decoder RCE), GitLab (a second RCE in ten days) and the compromised LiteLLM 1.107.0 release that stole credentials.

DEV Community

Open source

Patch roundup: critical RCEs in PHP, Node.js, GitLab and LiteLLM supply-chain attack

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix RCE rated CVSS 9.2; no patch for 8.1 and older
Node.js 22.23.4, 24.22.1 and 26.12.1 fix a Brotli decoder RCE and nine other flaws
GitLab 19.5.1, 19.4.3 and 19.3.6 patch a second CVSS 10.0 RCE in ten days
Malicious litellm 1.107.0 on PyPI and Docker Hub stole keys and browser data

#PHP#Node.js#GitLab#LiteLLM

Microsoft ties ConnectWise supply-chain attack to China-aligned Storm-0940

Security

GitHub Actions adds workflow lockfiles to block CI/CD supply-chain attacks

Security

Brevo supply-chain attack exposed over 100,000 sites

Security

Patch roundup: critical RCEs in PHP, Node.js, GitLab and LiteLLM supply-chain attack

Microsoft ties ConnectWise supply-chain attack to China-aligned Storm-0940

GitHub Actions adds workflow lockfiles to block CI/CD supply-chain attacks

Brevo supply-chain attack exposed over 100,000 sites

TanStack npm supply-chain attack: Mini Shai-Hulud worm hit 42 packages