> infrastructure security
for people who build things
Tracking vulnerabilities, supply chain attacks, and threat intelligence that matters to engineers running real infrastructure.
LiteLLM 1.107.0 Backdoored on PyPI and Docker: Python Startup-Hook Stealer Hits AI Gateway Deployments
A malicious LiteLLM 1.107.0 release on PyPI and Docker registries installed a startup-hook credential stealer and an hourly remote code loader. Anything that ran it should be treated as compromised.
Your CI Runner Holds the Keys: A Field Guide to Hardening GitHub Actions After GhostAction, Megalodon, and TanStack
Three different attacks in 2026 reached the same place: a GitHub Actions runner with secrets and an OIDC token in scope. Here's the attacker's checklist and a concrete, ordered hardening plan, with config snippets and detections, for infra teams that own CI.
SiteGuard WAF CVE-2026-106931: Exploited Command Injection Gives Root/SYSTEM, and Patching Can Erase the Evidence
EG Secure Solutions' SiteGuard Server Edition WAF has an exploited OS command injection in its default-on statistics feature; CISA added it to KEV and the vendor says to save diagnostics before patching.
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Exploited in the Wild, Third VCO Zero-Day in Four Months
CISA added Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 (CVSS 9.9) to KEV; any authenticated user can escalate to operator-level superuser on on-prem deployments.
CVE-2026-110264: CVSS 10 Unauthenticated RCE in Self-Managed GitLab Reaches Back to Version 7.0
GitLab patched a maximum-severity unauthenticated code-execution flaw in self-managed CE and EE, caused by an integer overflow in regex compilation and present in every release since 2014.
Two CVSS 9.0 Linux KSMBD RCE Flaws Hit a Public Mailing List Before Any Kernel Fix Existed
Trend Micro ZDI reports for two CVSS 9.0 KSMBD flaws, one pre-authentication, were mistakenly posted to the public Linux kernel list with no mainline fix and no CVE assigned.
PHP2Shell: Leaked CVE-2026-109618 and CVE-2026-109619 Give Unauthenticated RCE in the PHP Engine
Two CVSS 9.2 flaws in the PHP engine leaked ahead of coordinated disclosure; PHP shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as exploit attempts appeared.
Unpatched Broadcom WPS Flaw Gives Radio-Range Root on ISP Gateways, No Password Required
Researcher Quentin Kaiser showed at Hexacon that Broadcom's proprietary Wi-Fi Protected Setup code can be corrupted by crafted packets, giving an attacker in radio range root code execution on home gateways with no Wi-Fi password. No CVE has been assigned.
Plex2Shell: Four-CVE Plex Media Server Chain Exploited Within a Day of PoC Release, Dropping XMRig and Proxy Malware
A public exploit chain for Plex Media Server (CVE-2026-96652, -96654, -96655, -96656) goes from SSRF to code execution; attackers began dropping XMRig and a proxy tool less than 24 hours after the PoC appeared.
PwnEscape (CVE-2026-99999): Linux Kernel Checksum Bug Lets KVM Guests Read and Corrupt Host Memory
PwnEscape, a Linux IPv4 checksum-validation flaw (CVE-2026-99999), lets a malicious guest leak host memory on KVM hosts using virtio-net/TAP networking; a leak was demonstrated against Vercel's production sandboxes.
Nextcloud Built-in CODE Server CVE-2026-110447: Unauthenticated Command Injection Exploited for Webshells Since September
A critical OS command injection in the Collabora-based built-in CODE server app for Nextcloud (richdocumentscode) has been exploited in the wild since about September 10; the CVE was published October 14, over a month after the patch.
Patching Is Not Eviction: What Ivanti, BeyondTrust, and NetScaler Teach Us About Post-Patch Compromise
Three edge-appliance zero-days in six weeks, three different persistence models, and one shared lesson: the patch closes the door but doesn't remove whoever is already inside. A practical playbook for compromise assessment after you upgrade.
SonicWall SMA1000 CVE-2026-102255: CVSS 10.0 Pre-Auth SSRF Probed Within Two Days of Patch
SonicWall's SNWLID-2026-0017 patches CVE-2026-102255, a maximum-severity pre-auth SSRF in SMA1000 that attackers reach an internal CouchDB through; exploitation attempts began two days after the fix.
GhostAction Returns: Stolen PATs Used to Push Malicious GitHub Workflows Across 30,000 Repositories
GitGuardian reports a resurgent GhostAction campaign: about 1,900 hijacked GitHub accounts pushed fake security workflows to harvest CI/CD secrets, with a spike on October 8-9 targeting over 30,000 repositories.
PEERSTITCH: Memory-Only FortiGate Implant Deployed via FortiOS CVE-2025-61624 After FortiManager Breach
Unit 42 details PEERSTITCH, a fileless implant injected into FortiOS miglogd and iked after FortiJump and a CVE-2025-61624 path traversal gave root on FortiGate firewalls.
BeyondTrust Remote Support CVE-2026-102764: Unauthenticated File-Operation Zero-Day Exploited by China-Linked Armory Castle
A CVSS 4.0 9.3 unauthenticated flaw in self-hosted BeyondTrust Remote Support has been exploited since late August by a China-linked cluster Google tracks as Armory Castle; patch BT26-05-RS and assume compromise on exposed appliances.
October Patch Tuesday Hits a Record ~1,400 CVEs; Windows Shell Mark-of-the-Web Zero-Day Exploited
Microsoft's largest Patch Tuesday yet fixes roughly 1,400 CVEs, including an actively exploited Windows Shell Mark-of-the-Web bypass and two publicly disclosed .NET-related zero-days.
Cisco Secure Email Gateway CVE-2026-76519: Unauthenticated Root File Write via AMP Exploited in the Wild
Cisco confirms in-the-wild exploitation of CVE-2026-76519, a CVSS 9.8 path traversal in Secure Email Gateway's AMP File Reputation that lets unauthenticated attackers write files and run commands as root.
Palo Alto PAN-OS CVE-2026-0322: Management Interface Code Injection Gives Root on Firewalls, Exploited as Zero-Day
Palo Alto Networks patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker run code as root; limited exploitation observed and CISA has added it to KEV.
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.