Patch Day for the Web: Today’s Big Breaches, Explained

The short version. Wednesday was a patch-everything kind of day. Two critical flaws in PHP, the language under an estimated 70% of websites, went public with fixes at 7 AM Pacific, and governments told anyone who could not patch to unplug. Hours earlier, someone hijacked the release pipeline of LiteLLM, a popular AI gateway, and shipped a version that steals API keys. A security firm published an inside look at a criminal group that pointed Claude and Grok agents at more than 400 Latin American financial targets. And three data leaks surfaced in Asia, at Nikkei, at a cloud provider used by Japanese police, and at State Bank of India. Here is what happened, who is affected, how each attack worked, and what to do now.

All times below are given in UTC with Pacific time (PT) alongside. Every claim is attributed; the full source list is at the end. Where something is one company's account and nobody else has confirmed it, we say so.

What happened today

Also today: Nikkei said 1.83 million records were stolen from a cloud service it uses for system development. A cyberattack on Arcadia, an Osaka cloud provider, may have exposed details of about 125,000 Japanese police officers and staff. And State Bank of India told stock exchanges that 3,897 customer records turned up on the dark web.

1. php2shell: two critical flaws in PHP

What happened

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday. The release fixes two critical vulnerabilities that can let an attacker run code on a server without logging in, the PHP Foundation says. The flaws carry the IDs CVE-2026-109618 and CVE-2026-109619, and CISA says they are known as "php2shell."

The official severity score is 9.2 out of 10, according to the PHP Foundation and Google Cloud. A score of 10.0 circulated after the leak; the Foundation says that figure was wrong.

AI was central to the discovery. OpenAI says its models helped researchers in its Patch the Planet initiative find the flaws, and calls this "one of the most impactful vulnerabilities in recent memory." Per Nextgov/FCW, OpenAI says the security firm Calif found a critical flaw using its GPT-5.6 Sol model, while Wiz independently found and reported both. Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.

The PHP Foundation is candid about the history. A Foundation-contracted developer saw the first signs of the memory problem in 2024, during an audit, but the fix stalled for months. "We won't pretend otherwise: the delay was a structural failure," it writes.

The plan was a coordinated release on October 22. It slipped forward a day. On Tuesday at about 15:00 UTC (8 AM PT), the two CVE IDs started circulating online, the PHP Foundation says, though no technical details leaked. PHP then brought the release forward to Wednesday at 14:00 UTC (7 AM PT). Around 20:00 UTC Tuesday, Calif mistakenly published a video of its proof of concept, and copies spread. Then at 07:41 UTC Wednesday (12:41 AM PT), the Foundation says Chainguard "unilaterally broke the embargo" by publishing fixed images early.

The response was unusually loud. The NSA, FBI and CISA urged organizations to patch and to take systems offline if they could not, Nextgov/FCW reports. The UK's NCSC gave the same advice, according to the BBC. Finland temporarily shut its government's public web services, and the Wikimedia Foundation took some systems down as a precaution, the BBC reports.

Who is affected

• Anyone running PHP to serve web pages. CISA says the flaws "affect all PHP installations serving web requests." Google Cloud lists every version from 5.4 through 8.5.11 as vulnerable.
• WordPress, Drupal and Joomla sites. Wiz says it demonstrated attacks against all three, Nextgov/FCW reports.
• People on old PHP. The PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life, Google Cloud says.
• A very large number of servers. Palo Alto Networks' Unit 42 counted more than 22.6 million internet-exposed instances potentially vulnerable, per Nextgov/FCW.

Is anyone being hacked yet? Accounts differ. CISA said it had "not observed exploitation" as of publication. The BBC quotes Cloudflare CTO Dane Knecht saying the company is "seeing early attacks emerging." The PHP security team says it found no functional exploits at the time of release.

How it worked

Both bugs live in parts of PHP that nearly every request touches: memory management and error handling, the PHP Foundation explains. In the first, a request that hits PHP's memory limit at exactly the wrong moment leaves half-built internal data behind, which PHP later treats as valid. In the second, a fatal error leaves internal state pointing at memory from a previous request, and a later request on the same worker uses it.

On Apache with mod_php, the Foundation says, an unauthenticated request can trigger the first bug before any application code runs. That is why careful site code does not help. Researchers also showed they could read passwords and access credentials from a server's working memory, Nextgov/FCW reports.

What to do now

1

Step 1: If you run your own server or VPS

You do

• Update PHP now. On a distribution like Ubuntu, install the security update from your package manager rather than compiling upstream.
• Restart PHP, every worker process, afterward. Then confirm the version that is actually running.
• If you cannot patch today, take internet-facing PHP systems offline. That is the CISA, NSA and NCSC advice.
• Watch for PHP worker processes launching shells or downloading tools, CISA says.

Under the hood

Do not be alarmed if your distribution's version number looks lower than 8.5.12. @levelsio hit exactly this with Ubuntu. "Ubuntu and other distros routinely backport security patches to their packaged PHP versions," he quoted in reply. Check your distribution's security notice instead; for Ubuntu that is USN-8948-1.

2

Step 2: If you are a small business with a hosted website

You do

• Ask your host or web agency one question today: has PHP been updated for CVE-2026-109618 and CVE-2026-109619?
• Many managed platforms patch for you. Google Cloud says App Engine standard (PHP 8.2 and newer) updates automatically, while container users must rebuild and redeploy.
• If you are on PHP 8.1 or older, plan an upgrade. There is no official fix for those versions.

Under the hood

A web application firewall (WAF) rule can buy time, but treat it as temporary. Cloudflare pushed a rule, a user told @levelsio, who replied: "It's only an imperfect STOP GAP solution." CISA agrees a WAF "may provide some protection" until systems are patched.

3

Step 3: If you just use websites

You do

• There is little to do directly. The fix is on site owners' side.
• Expect some sites to be down or "in maintenance" today. The BBC lists several, including parts of Wikipedia.
• As always, use unique passwords, so that a breach at one site cannot open your others.

Under the hood

Some outages today are deliberate safety moves. @levelsio took every site he runs offline before the patch, then brought them back after installing the Ubuntu fix. To a critic who called it insane, he replied: "It's not insane, it's safety first."

2. LiteLLM 1.107.0: a poisoned AI gateway

What happened

LiteLLM's release pipeline was compromised early Wednesday, and version 1.107.0 was pushed to PyPI and Docker with malware inside, the LiteLLM team says. The malware "steals credentials and loads remote-code execution tools." LiteLLM says the bad releases have been pulled and that all earlier versions are safe. Our source @MiaAI_lab flagged it on X: "If you installed 1.107.0, pin 1.106.2 and rotate your keys."

OX Security notes this is the second time LiteLLM has been hijacked this year, after versions 1.82.7 and 1.82.8 in March. This time the attacker used different tooling and infrastructure, OX says.

Who is affected

LiteLLM spells out the windows, all on Wednesday, October 21:

Artifact	Compromised window (UTC)	Pacific time
PyPI litellm==1.107.0, all seven wheels	11:39 to 13:23	4:39 to 6:23 AM
Docker Hub tags v1.107.0, latest, main-latest, main-stable	11:46 to 14:20	4:46 to 7:20 AM
GHCR tags, same names	11:46 until unavailable by 13:51	4:46 to 6:51 AM

You are affected if you installed an unpinned LiteLLM from pip in that window, or started one of those Docker images, the team says. Customers on the private enterprise release were not affected. OX Security adds that the malware runs every time Python starts, even if your project never uses LiteLLM.

How it worked

LiteLLM says the attacker used three engineers' GitHub accounts, apparently through stolen GitHub CLI OAuth tokens. One account overrode branch protection and changed the release workflow. A second approved the production release, and a third deleted workflow records, limiting the logs. The team has not yet found how the tokens were stolen.

The trick was that the malware lived only in the built packages. The official 1.107.0 source tag on GitHub was clean, LiteLLM says, so reading the repository would show nothing wrong. OX Security says the payload calls home to litellm[.]dev, a lookalike domain the attacker bought.

What to do now

• Check first, then clean. Run pip show litellm in each environment. Search for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py. Finding one confirms exposure; finding none does not prove you are clean, LiteLLM says.
• Clean from the shell, outside Python. Delete cook.pth, cook.py, sitecustomize.py and matching __pycache__ files, kill the detached Python process holding /tmp/remote_code_loader.lock, then reinstall litellm==1.106.2. Rebuilding from scratch is better.
• Assume the secrets are gone. If 1.107.0 ran on a host with internet access, LiteLLM says to assume the theft succeeded. Rotate the instance's cloud role, every provider key stored in the LiteLLM proxy database, the master and virtual keys, and the database password.
• Small teams: if one developer laptop ran it, treat that laptop as compromised. OX Security also lists SSH keys and CI tokens among the secrets to rotate.
• Everyone using AI tools: pin versions in production, and give new releases a short cooling-off period before you adopt them.

3. CARLIY0S: AI agents aimed at Latin American banks

What happened

The security startup Straiker published an investigation Wednesday into a group it calls CyberCartel, operating as "Tr4nsHack Team." Straiker says the group used an AI agent system named CARLIY0S to attack more than 400 financial targets across Latin America in a matter of months. The research was shared exclusively with The Information, Benzinga reports. Our source @kimmonismus flagged it on X, writing: "I guess this is just the beginning."

According to The Information's account, the agents "appear to have stolen passwords and customer data and to have accessed people's bank accounts autonomously with little human effort." Straiker says Anthropic has revoked the compromised credential used to reach Claude, and xAI is looking into the activity.

Who is affected

Straiker describes the victims only as Latin American and Mexican financial institutions, banking entities and fintech payment gateways. The stolen-credential store it saw held 4,493 records, it says, including 2,911 email addresses and 903 account numbers. It also lists 391 general API keys, 67 cleartext passwords and 43 database connection strings. Straiker says the material could enable abuse of SPEI, Mexico's interbank payment system.

How it worked

Straiker says a "commander," Claude running in the Cursor IDE, hands goals to specialist agents through the Anthropic API. Three of them debate each target, and a fourth called MAXIMUS returns one decision. A headless browser, routed through residential proxies, logs into a content management system's admin panel and injects code. Five Grok-based "miners" then collect the secrets.

What to do now

• If you bank in Latin America: no institution has been named, so there is no specific account to check. Turn on transaction alerts and treat unexpected calls or messages about your account with suspicion.
• If you run a fintech or a small financial firm: the stolen material Straiker lists is mostly secrets. Rotate API keys, signing keys and database passwords on a schedule, and keep them out of code and config files.
• If you run AI agents: Straiker's advice is to know what each agent can reach, test it against real attacks, and keep a way to cut its access fast.

Also today: three data leaks in Asia

Nikkei: 1.83 million records

Japanese media group Nikkei, owner of the Financial Times, said 1.83 million records were stolen from a cloud service it uses for system development, IT Pro reports. The access began in the early hours of October 7. About 150,000 records contained a name, email address, postal address, phone number or date of birth, and about 120,000 included an email address. Nikkei says no credit card information leaked, and it has disabled the credentials used. It does not yet know how they were stolen. It is the third breach to hit the company in the last few weeks, IT Pro says.

What to do: Nikkei says it is contacting everyone affected. Be wary of emails that use Nikkei's name to ask for logins or payment.

Arcadia: about 125,000 Japanese police officers and staff

A cyberattack on Arcadia, a cloud provider in Minoh, Osaka Prefecture, may have exposed details of about 125,000 police officers and staff. The Japan Times reports this, citing National Police Agency sources. Names and email addresses at 20 prefectural police forces are involved. The data sat in an emergency safety-check system, so many addresses are believed to be personal phone accounts. More than 18,000 email addresses from people and businesses signed up for crime alerts may also be exposed. No misuse has been confirmed, the sources said.

What to do: if you signed up for a prefectural police crime-alert email, watch for phishing that uses police branding.

State Bank of India: 3,897 customer records

State Bank of India told stock exchanges on Wednesday that it found 3,897 customer records with personal information among about 375,000 records on the dark web, The Hindu reports. The exposed details include mobile numbers, dates of birth, names, email and home addresses, and loan-related data. SBI says its core operations are unaffected and it has hired an independent cybersecurity agency to investigate. The Internet Freedom Foundation says SBI learned of the leak from outside agencies and had not said whether it had told affected customers.

What to do: the Foundation warns that affected customers are the most likely to get calls from people posing as SBI staff "who can recite their account details back to them." A caller who knows your details is not proof they are from the bank. Hang up and call the number on your card.

How to check if you're affected

What we left out

A hacker group claimed on BreachForums to have breached the Rajasthan Police website, India Today reports, but the paper says it cannot confirm the claim. Rajasthan Police had not commented. We left it out until it is confirmed.

Sources

php2shell

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
• php.announce: PHP 8.5.12 Released
• PHP advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption
• PHP advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state
• Wiz: PHP2Shell
• Google Cloud: Responding to core PHP vulnerabilities
• Nextgov/FCW: US agencies urge fixes for programming language flaws
• BBC: Websites taken down worldwide as critical PHP cyber-security update issued
• Tenable: php2shell FAQ
• Ubuntu security notice USN-8948-1
• On X: @OpenAI, @TheRundownAI, @levelsio, @levelsio on patches, @levelsio on WAFs, @levelsio on backports, @levelsio, back up, @levelsio, safety first

LiteLLM

• LiteLLM: Oct 21, 2026 release v1.107.0 compromised
• OX Security: LiteLLM 1.107.0 compromised with a RAT infostealer
• Socket: LiteLLM PyPI package and Docker images compromised
• JFrog Security Research: LiteLLM hijacked again
• Endor Labs: LiteLLM 1.107.0 compromised
• Aikido: LiteLLM compromised and GitHub issue #47826, as linked by @MiaAI_lab
• On X: @MiaAI_lab

CARLIY0S

• Straiker: Inside CARLIY0S
• The Information: Hackers Used Claude and Grok to Fully Automate Attacks on Banks (paywalled; quoted via Benzinga)
• Benzinga: Hackers Used Claude and Grok to Fully Automate Attacks on Banks
• Dealroom: Hackers used Claude and Grok to automate attacks on 400+ Latin American banks
• PYMNTS: Hackers Employ Grok and Claude to Attack LatAm Banks
• On X: @kimmonismus

Also today

• IT Pro: Nikkei admits millions of records stolen
• The Japan Times: Data breach potentially exposes information of 125,000 police officers and staff
• The Hindu: SBI admits exposure of its customer data on the Dark Web
• India Today: Rajasthan govt website data breach reported (unconfirmed; see above)