Security news
Railway security incident: environment variables may be exposed. A practical secret rotation guide
PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch, what to check and how a WAF helps
LiteLLM 1.107.0 supply chain compromise: what to check, what to rotate and the 2026 CVEs
On 21 October a hijacked release pipeline pushed a credential stealer as LiteLLM 1.107.0 to PyPI and Docker. Here is how to tell if you ran it, what to rotate, the IOCs, and every LiteLLM CVE of 2026 in one table.
Railway security incident: environment variables may be exposed. A practical secret rotation guide
Railway says an intruder queried customer environment variables and decrypted some of them, hunting for AI provider keys. What we know, and a practical guide to rotating secrets in the right order and spotting misuse.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch, what to check and how a WAF helps
Two critical PHP flaws allow unauthenticated remote code execution. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, turn off session upload progress, and check your logs for the signs we list here.