October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks

  From Staff

"Black October" is a label for a run of unrelated but overlapping cyber incidents disclosed around October 21, 2026, not a single attack. The most urgent item is PHP2Shell, two critical PHP flaws (CVSS 9.2 each) that allow unauthenticated remote code execution in affected configurations.

• Active exploitation: Cloudflare reported early PHP2Shell attack attempts. Palo Alto GlobalProtect (CVE-2026-0257) and Plex servers (Plex2Shell) are also under active attack.
• Poisoned software: LiteLLM 1.107.0, the OVHcloud CLI (0.11.0 through 0.15.0) and the UpdraftCentral keys at TeamUpdraft were compromised to deliver credential theft or malicious code.
• Trust infrastructure: Eight eMudhra intermediate signing keys were recoverable from public certificates, creating a risk of forged certificates.
• Patching is not enough: Where credentials or backdoors were already planted, installing the update leaves the attacker's access in place. Rotate secrets and rebuild from clean systems.

Web platform vulnerabilities

Four web stacks need patches now, and PHP comes first because exploitation attempts are already under way.

Product	Flaw	Impact	Fixed versions
PHP (PHP2Shell)	CVE-2026-109618, CVE-2026-109619 (CVSS 9.2 each)	Unauthenticated remote code execution; one flaw corrupts memory when an operation runs out of memory, the other exposes invalid data left by earlier requests	8.5.12, 8.4.27, 8.3.36, 8.2.35
Node.js	Ten vulnerabilities, four high severity, including CVE-2026-111497 (Brotli decompression)	Code execution via an out-of-bounds memory write; weaker TLS hostname checks; DNS name mishandling	26.12.1, 24.22.1, 22.23.4
Next.js	Two critical RCE flaws fixed October 14 (React Server Components caching, SVG image processing on glibc Linux)	Remote code execution	16.4.1, 15.5.28
Apache Tomcat	Eight fixes, including CVE-2026-101296 (JNDIRealm)	Login without the correct password; mixed responses between users; AJP data leaks	11.0.27, 10.1.61, 9.0.123

• PHP: Researchers demonstrated code execution against Apache mod_php before application code ran. After patching, restart services and confirm the web workers use the patched build.
• Node.js: The releases also refresh certificate trust after the eMudhra incident. Rebuild container images so deployments pick up the new runtime.
• Next.js: Updating Node.js does not update application dependencies, so Next.js must be upgraded separately.
• Tomcat: Apache disclosed the flaws on October 20. Exposure depends on configuration.

Supply chain compromises

Three trusted distribution channels delivered malicious code, so a normal update or download was not a safe signal.

Target	What happened	Window	Action
LiteLLM	Version 1.107.0 reached PyPI and container registries carrying a credential stealer and remote code loader. All seven Python wheels and the latest and main-stable container tags were affected. Stolen GitHub credentials let attackers redirect a release workflow to a lookalike repository.	Reported October 21	Pin to 1.106.2, rebuild cleanly, rotate credentials
UpdraftPlus (TeamUpdraft)	Attackers accessed the TeamUpdraft website and used UpdraftCentral connection keys to install malicious plugins on connected WordPress sites. The UpdraftPlus download packages were unchanged.	October 17–18	Install 1.26.13 Free or 2.26.13 Premium, remove exposed keys, check for backdoors and unexpected admins
OVHcloud CLI	A compromised developer account was used to replace binaries for versions 0.11.0 through 0.15.0. Earlier clean downloads were unaffected.	94 minutes on October 19	Upgrade to 0.16.0, replace secrets stored on affected machines

• LiteLLM is the most dangerous for cloud and AI environments. Malicious Python startup hooks could run when any Python command started, even if the application never imported LiteLLM. Targets included cloud credentials, SSH keys and AI service secrets. Wiz observed stolen AWS credentials in use about four and a half hours after theft.
• Do not simply downgrade. Running pip inside a contaminated environment can trigger the hooks again.
• Updating does not remove malware already installed on WordPress sites reached through UpdraftCentral.

Trust and access infrastructure

The eMudhra key compromise is the one with the widest potential reach, but public evidence has not shown attacks on users through those keys.

• eMudhra certificate authority: Eight intermediate signing keys were compromised. Incorrect key generation made them recoverable from public certificates, creating a risk of forged certificates. Mozilla found all eight affected P-384 private keys were integers below 256, so recovery was almost instant. Browser vendors issued blocks, but applications with separate certificate bundles or that skip revocation checks may remain exposed. Update browsers, operating systems, runtimes and trust stores.
• Palo Alto GlobalProtect (CVE-2026-0257): Attackers can bypass authentication, including MFA, in affected configurations. Exploitation requires authentication override cookies and a vulnerable certificate setup. Unit 42 described attackers moving on to VMware vCenter, weakening ESXi controls and extracting credentials from a domain controller's virtual disk, which avoided its endpoint monitoring. Patch gateways and investigate suspicious successful VPN sessions.
• Plex2Shell: Four flaws chain together to run code without authentication: internal request abuse, an exposed owner token, a file write and a malicious codec load. Attackers have deployed cryptocurrency miners and proxy software. Fixes are in Plex 1.43.3.10861 and later. Check NAS installations and containers, and rebuild any system where compromise is found or cannot be ruled out.

Data exposure and operational impact

The State Bank of India disclosure is smaller than the headline number suggests: 3,897 customer records were identified within roughly 375,000 reviewed dark-web records, and the larger figure is not a confirmed count of affected customers.

• State Bank of India: Reported fields include names, mobile numbers, addresses and loan-related details. The bank said services remained operational while it examined the data's authenticity and source. The disclosure did not establish a breach of core banking systems or theft of customer funds.
• French supermarkets: Hackers gained control of refrigeration software at hundreds of stores. Coopérative U said more than 100 of its supermarkets were targeted, and 180 Intermarché and Netto stores were affected, with some units reaching 50°C overnight and spoiling food worth millions of euros.
• Other reports from roundups: Aggregator and social media summaries also mention theft of California public school student data since 2023, a Zeabur breach of 321,810 accounts, and an outage at Ahold Delhaize. I did not verify these against primary sources.

Response priorities

Work in this order: exposed systems under active attack first, then vulnerable runtimes and dependencies, then clean-up of anything an attacker may already have reached.

• Patch internet-facing PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart services and confirm workers run the patched build
• Patch Palo Alto GlobalProtect gateways and review successful VPN sessions for misuse
• Update Plex to 1.43.3.10861 or later, check NAS installs and containers, and rebuild any suspect system
• Check whether LiteLLM 1.107.0 was ever installed or pulled; if so, rebuild clean and rotate cloud credentials, SSH keys and AI service secrets
• Check OVHcloud CLI use between versions 0.11.0 and 0.15.0 and move to 0.16.0, replacing stored secrets
• Check WordPress sites using UpdraftCentral: install 1.26.13 or 2.26.13, remove exposed keys, look for backdoors and unexpected administrators
• Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 and rebuild container images
• Upgrade Next.js to 16.4.1 or 15.5.28 and Tomcat to 11.0.27, 10.1.61 or 9.0.123
• Update browsers, operating systems, runtimes and trust stores for the eMudhra block
• Review cloud activity, VPN sessions and administrator changes for signs of misuse
• Revoke and reissue secrets from clean systems, not from the ones that may be compromised

Caveats and sources

The technical detail comes from one detailed incident roundup, so treat it as a single source until vendor advisories confirm each item.

• "Black October" is an informal label coined by commentators; it is not an official designation, and describing it as the most serious 48 hours in cybersecurity history is an opinion.
• Most roundup claims are unverified here. The Zeabur, Ahold Delhaize and California items come from aggregator posts and are not confirmed against primary sources.
• An unverified claim on social media says a group called CyberCartel used Claude and Grok to automate attacks on 400+ Latin American banks. I found nothing beyond that post.
• Exposure varies by configuration, especially for PHP2Shell, Tomcat and GlobalProtect. Confirm against each vendor's advisory.

Sources:

• October 21 Cybersecurity Nightmare, Cyber Security News
• From compromised certificates to malicious software, BusinessToday
• Black October: Major Cyber Incidents Flood the Last 48 Hours, MobyGeek
• Fridges in French supermarkets hit by cyber attack, Security Today

He Helped Run Immigration Under Biden. Now He Works For The Chinese.

 Michael Valverde, a former senior immigration official during Biden's presidency, is now serving as an advisor for a Chinese immigration consultancy, Yingzhong Overseas Consulting. This partnership raises concerns about the implications of his previous government experience.

Valverde was the associate director of field operations at USCIS during Biden's term and is now collaborating with Yingzhong, which promotes itself as adept at navigating the U.S. immigration system.

Yingzhong's marketing strategy emphasizes incorporating insights from immigration officers to enhance the chances of approval for clients’ cases.

A presentation displaying Valverde next to slides on USCIS internal standards highlights how his experience is leveraged to attract clients.

Yingzhong has ties to organizations linked to the Chinese Communist Party (CCP), although it is unclear if there are direct connections to the CCP's direction or control over Valverde's advisory role.

The consultancy offers various services, including difficult-case consultations and private reviews, reflecting the desire to use Valverde's knowledge to improve case outcomes.

Valverde's engagement in this consultancy raises ethical questions regarding the use of expertise gained in public service for private gain, especially in relation to a foreign entity.

Valverde's transition from a government role to a consultancy that targets U.S. immigration approvals for Chinese clients invites scrutiny about potential ethical conflicts. As he utilizes his immigration experience in the private sector, transparency about how that experience is applied is essential for public trust. 

https://nataliegwinters.substack.com/p/he-helped-run-immigration-under-biden?utm_source=post-email-title&publication_id=3382126&post_id=218655567&utm_campaign=email-post-title&isFreemail=true&r=6dl2nb&triedRedirect=true&utm_medium=email

How Is This Not Election Interference?

 The reporting of early voting data leading up to elections, questioning its availability and potential influence on voter behavior. It raises concerns about the integrity of elections when media outlets disclose voting trends before polls close.

1. Early Voting Trends: Headlines suggest a Democratic advantage in early voting, which can shape public perception before Election Day. The article cites multiple reports highlighting Democratic performance in various states.

2. Reliability of Data: Election experts emphasize that early voting numbers are not reliable indicators of election outcomes. The reported figures are estimates based on demographics and historical voting patterns, rather than definitive results.

3. Public Access to Data: Many states release early voting data on a daily basis, sometimes even detailing individual voter information. This practice raises questions about its public utility and how it may affect those who have not yet voted.

4. Voting Behavior Influences: Historical examples, like the 2000 Presidential Election, illustrate how reporting early results can impact voter turnout. The article references a drop-off in Republican voting in Florida when early results were prematurely announced.

5. Call for Action: The editorial board argues for an outright ban on releasing early voting data before Election Day, suggesting it serves no public interest and could compromise election integrity. They also urge news outlets to refrain from reporting early voting data to protect the election process.

The article stresses that the early release of voting data can disrupt the fairness of elections, potentially influencing undecided voters. It calls for stricter regulations on the disclosure of early voting information and encourages news organizations to act responsibly in their reporting.

https://issuesinsights.com/2026/10/22/how-is-this-not-election-interference/

Launching a Second Scientific Revolution

 The scientific revolution shifted the authority of scientific knowledge from a few ecclesiastical powers to many capable scientists. However, today we see a concentration of power among a few authorities, which can impact public health discussions and decisions. The National Institutes of Health (NIH), while historically significant in advancing biomedicine, faces challenges in improving health outcomes in the U.S., particularly as life expectancy stagnates.

1. Historical Contribution of NIH:

The NIH is the largest public funder of biomedical research globally, supporting significant advances in treatments for various conditions, including heart disease and cancer.

Despite its contributions, the NIH has struggled to improve American life expectancy since 2010, unlike many European countries.

2. The Health Crisis:

There is a growing concern that American children may live shorter, less healthy lives than their parents, highlighting an urgent need to address chronic diseases through effective science.

3. Challenges in Science:

The NIH currently faces three major problems that hinder scientific progress:

Replication Crisis:

Many scientific studies fail to be replicated, leading to doubts about their findings' validity.

Historically significant findings, often portrayed confidently, are frequently not replicable, undermining public trust in science.

Suggested solutions:

Emphasize the importance of replication in scientific research and shift funding towards replication studies.

Enhance public databases, like PubMed, to include information on whether studies have been replicated.

Scientific Stagnation:

The efficacy of biomedical research has decreased over the years, as proven by the reduced health advancements generated per research paper.

More focus is required on new, innovative ideas rather than relying on older concepts.

Suggested solutions:

Adopt a funding model that encourages young scientists with new ideas.

Implement the Unified Funding Strategy to prioritize innovative ideas that may initially fail but hold potential long-term benefits for public health.

Funding Concentration:

NIH funding is heavily concentrated in a few institutions, limiting opportunities for outstanding scientists nationwide.

Suggested solutions:

Decouple funding for research from facility costs to allow broader competition and innovation.

Encourage funding to reach diverse institutions, enabling scientists outside major centers to receive support.

To ensure scientific progress and improve public health outcomes in the U.S., the NIH must address the replication crisis, overcome stagnation, and diversify its funding distribution. By fostering an environment conducive to innovation and collaboration, the NIH can contribute significantly to solving critical health challenges faced by Americans, ultimately leading to healthier future generations. 

https://brownstone.org/articles/launching-a-second-scientific-revolution/

Desperate Democrats Sue to Keep Voter Rolls Bloated With Illegal Voters

 On October 22, 2026, Liz Sheld reported on significant political occurrences involving Democrats and election integrity, particularly focusing on a lawsuit filed against the Trump administration regarding voter registration practices. This overview includes key actions by President Trump and reactions from Democratic leaders.

1. Trump's Agenda for the Day:

President Trump’s schedule included various activities such as receiving an intelligence briefing and delivering remarks in Sioux City, Iowa.

2. Democratic Lawsuit:

Senate Minority Leader Chuck Schumer and House Minority Leader Hakeem Jeffries announced a federal lawsuit against the Trump administration.

The lawsuit challenges efforts to identify and remove suspected non-citizens from state voter-registration lists, claiming that the Department of Homeland Security provided unreliable information to states.

3. Claims of Voter Rights Interference:

The Democrats argue that the administration's actions undermine the rights of eligible voters and improperly influence state-level election management.

A specific example from Nevada cited in the complaint indicated a dramatic reduction in the number of suspected non-citizen registrants, raising concerns about the accuracy of the initial claims.

4. Historical Context:

A comparison was made with former President Biden's Executive Order 14019, issued in March 2021, which aimed to increase access to voting by promoting voter registration through federal agencies.

This order mandated that agencies consider methods to assist voter registration and incorporate it into their public services.

5. Trump’s Response:

After assuming office, President Trump rescinded Biden’s voter-registration initiatives through an executive order, directing federal agencies to stop actions related to the previous administration’s efforts to expand voter registration.

6. Concerns About Election Integrity:

The piece emphasizes the controversy surrounding the balance between ensuring legal voter registration and the perceived attempts by Democrats to maintain control over voter rolls.

7. News Roundup:

Other current news topics included public opinion on AI, childcare costs affecting voters, military actions by Israel, and various political and legal developments involving key figures and ongoing issues like immigration.

The ongoing political tension regarding voter registration and election integrity reflects broader themes of governance and electoral policy in the United States. As the legal battle unfolds, major implications for future elections and federal-state relationships in voter management are anticipated. The situation underscores the polarized nature of current American politics, especially as midterm elections approach. 

https://amgreatness.com/2026/10/22/morning-greatness-desperate-democrats-sue-to-keep-voters-rolls-bloated-with-illegal-voters/

Neil Bush, son of George H. W. Bush, backs Talarico in Texas Senate race

 Neil Bush, a member of the prominent Bush political family, publicly announced his support for Democrat James Talarico in the Texas Senate race, a notable departure from his lifelong affiliation with the Republican Party.

1. Vote for Change: In a Facebook post, Neil Bush revealed that he voted for Talarico due to concerns about current Texas Attorney General Ken Paxton's record, particularly regarding his challenge to the 2020 election results, which Bush views as damaging to democracy.

2. Character Over Party: Bush emphasized the importance of character in leadership, stating, "character matters more than party affiliation." He believes that true democratic leadership involves accountability and unity.

3. Talarico's Background: Talarico, a Presbyterian seminarian, has faced criticism for some of his views on Christianity, especially concerning abortion and gender identity. He has expressed provocative opinions, such as claiming the Bible does not explicitly mention abortion and suggesting that God is “non-binary.”

4. Religious Views Controversy: Despite his controversial statements, Talarico believes his faith underpins his values of humility and compassion.

Neil Bush's decision to endorse James Talarico illustrates a shift in his political beliefs, highlighting the significance of personal values over party loyalty during a highly scrutinized Senate race in Texas, which has seen increased voter turnout. 

https://www.oann.com/newsroom/neil-bush-son-of-george-h-w-bush-backs-talarico-in-texas-senate-race/

Black Pill Society

 The concept of "black pilling" has taken hold in American culture, leading many to surrender emotionally and mentally in the face of negative odds. This phenomenon reflects a broader trend of despair and defeatism prevalent in society today.

Black Pill Society: Americans are increasingly adopting a mindset of defeatism, often believing the worst outcomes are inevitable. This outlook emerges from continuous exposure to negative narratives in media and social platforms.

Character and Agency: Emphasizing the philosophy of Marcus Aurelius, the article highlights that a person's character is shaped by their focus. When individuals believe their actions have no impact, they relinquish their right to self-governance.

Nihilism: The pervasive belief that efforts are futile breeds a culture of social isolation. It glamorizes detachment from society and fosters a mindset of resignation rather than activism.

Impact on Society: Constant focus on despair diminishes our ability to engage meaningfully with society. Many succumb to hopelessness, neglecting opportunities to partake in their communities or uphold their principles.

The Highest Good: Drawing from Western civilization's Christian background, the article argues that life's purpose lies not in material success, but in striving toward eternal truths and goodness, which should guide individual actions despite uncertainties.

Confronting Challenges: To counteract nihilism, individuals must take responsibility for societal issues. This entails developing practical solutions rather than succumbing to despair and accepting the status quo.

Legacy and Responsibility: Allowing negativity to dominate our outlook risks bequeathing a broken society to future generations. The founding principles of the nation were established through risk-taking and action, rather than fear and resignation.

The article emphasizes the necessity of rejecting fatalism in favor of proactive engagement with societal challenges. Cultivating a disciplined mindset and seeking constructive actions can revive hope and empower individuals to contribute positively. Embracing the fight against despair is essential to preserving the values and society we cherish for future generations.

https://www.americanthinker.com/articles/2026/10/black-pill-society/