US Cybersecurity Briefing – Friday, Oct 23, 2026

Nothing new to report.

Malicious litellm 1.107.0 was published to PyPI (11:39–13:23 UTC Oct 21) and to Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable (from 11:46 UTC until pulled by 13:51–14:20). LiteLLM's post-mortem says attackers obtained developer GitHub CLI OAuth tokens, reportedly from logs of an internet-exposed internal deployment. An org-owner token was used to disable branch protection and point the release workflow at a lookalike repo (Berri-AI/litellm). The payload (cook.pth, cook.py, sitecustomize.py) runs on every Python start. It steals cloud, Kubernetes, AI-provider, Git/CI and SSH secrets plus browser data, and exfiltrates to litellm[.]dev; a loader polls for second-stage code hourly. Enterprise private-registry customers were not affected. No actor attributed; number of victims unknown.

Action: Check for 1.107.0 or image digest sha256:1bbcb1443bc9… without launching Python. Rebuild from clean images, pin 1.106.2, and rotate every secret the host could reach.

LiteLLM →    BleepingComputer →

Railway detected anomalous activity on systems that store customer environment variables. It says an unauthorized party may have accessed the encrypted variables and, for some, obtained decrypted contents (API keys, database and registry credentials). Railway paused all deployments and told all users to rotate secrets and registry credentials. It believes the attack is part of a campaign against platform companies aimed at compromising AI inference providers. Root cause, attacker and number of affected customers have not been disclosed. Railway published follow-up guidance on Oct 22 for checking AWS and GCP for anomalous access.

Action: If you deploy on Railway, rotate every stored variable and review the downstream services' logs.

Railway →    TechCrunch →

Microsoft says Storm-0940 gained access to ConnectWise Cloud Backup and took control of several ConnectWise cloud application identities. The actor then used AI agents built on the open-source ARTEX framework, authenticating from 144.172.64.x, to attempt sign-ins into more than 2,250 customer tenants. In some tenants it ran Graph reconnaissance, added app credentials and changed privileged roles. One ConnectWise app self-assigned Global Administrator. Targeted sectors include government, defense, energy, finance, legal and manufacturing. No victim organizations other than ConnectWise are named. ConnectWise suspended the affected services.

Action: Keep ConnectWise app connections disabled until the vendor issues restoration steps. Preserve Entra/Purview logs, search by the four application IDs Microsoft lists, and review activity back to Oct 1.

Microsoft →    The Record →

The district discovered the attack Oct 22 and cancelled classes for Oct 23 and Oct 26, with students expected back Oct 27. The technology team took steps to limit further unauthorized access. Threat actor, affected systems and data exposure have not been disclosed. Only an incident tracker was reachable for this item; no district statement or local news report could be verified.

DysruptionHub →

The data-extortion group SilentRansomGroup added Chicago-based Kirkland & Ellis to its leak site on Oct 22 (16:58 UTC). On Oct 21 (19:03 UTC) it added Porter Hedges LLP, a Houston business law firm with a large energy client base. The tracker does not show what data, if any, is claimed for either firm. Neither firm has confirmed an incident. These are criminal claims only and should be treated as unverified.

Ransomware.live →

An authenticated user with as little as Enterprise Read Only can gain operator privileges and impersonate a local superuser operator. Arista says the flaw is actively exploited. It affects VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12; hosted VCO is already patched. Arista lists attacker IPs 74.82.197.86 and 38.54.50.151. No victims are named. KEV status could not be confirmed because cisa.gov was unreachable during this run.

Action: Upgrade, restrict the VCO web UI to admin networks, and review logs for the listed IPs.

Arista →

Amazon Threat Intelligence says its honeypots saw a first exploit attempt on Oct 17, four days before PHP's Oct 21 emergency patches. Varied payloads after disclosure suggest multiple actors, and broad attempts are ongoing. Whether any of the attempts succeeded is still unknown, and no compromised organizations have been named. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 need distro or LTS packages, and 7.3 and older have no fix. watchTowr reported the CVEs were not on KEV as of Oct 22.

Action: Patch internet-facing PHP now, and hunt from Oct 17 onward. Amazon suggests searching upload POSTs for PHP_SESSION_UPLOAD_PROGRESS.

AWS Security →    watchTowr →

An integer overflow in the regular expression compiler could let an unauthenticated attacker run code on the server. It affects every version from 7.0 onward; fixes are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is patched. This is the second max-severity GitLab regex-compiler flaw in about 10 days.

GitLab →

CISA lists four chained Plex flaws as exploited, and BleepingComputer reports the federal patch deadline as Oct 23. The chain affects versions before 1.43.3.10861. The same batch added Siemens Software Center CVE-2026-110936 (used in ClickFix malware delivery) and SiteGuard Server Edition CVE-2026-106931. Additions to KEV since Thursday morning could not be checked because cisa.gov was unreachable during this run.

BleepingComputer →

1. LiteLLM – Security incident post-mortem, Oct 21
2. BleepingComputer – LiteLLM release pipeline hacked
3. Railway – Security disclosure, Oct 21
4. TechCrunch – Railway urges users to revoke keys
5. Microsoft – Storm-0940 ConnectWise supply chain compromise
6. The Record – Microsoft blames ConnectWise attacks on Chinese state hacker
7. DysruptionHub – Oneonta City School District incident
8. Ransomware.live – Kirkland & Ellis listing
9. Ransomware.live – Porter Hedges listing
10. Arista – Security Advisory 0199 (CVE-2026-114625)
11. AWS Security – PHP2Shell exploitation before disclosure
12. watchTowr – PHP2Shell FAQ
13. GitLab – Patch release 19.5.1
14. BleepingComputer – CISA: Plex2Shell attacks