Last week was busy enough that some trackers started calling it “Black October”. Here is what matters if you write and ship software, most urgent first.
A note on sources: much of this week’s coverage comes from vendor blogs and incident trackers rather than the affected companies. Every item links to where it was reported. Before you act on a version number or a deadline, check the vendor’s advisory or CISA’s catalog.
Supply chain: the one developers should read first
LiteLLM was poisoned on PyPI and Docker Hub (21 October)
Attackers published a malicious LiteLLM 1.107.0 to PyPI and Docker Hub. It carried an info-stealer aimed at cloud credentials, AI provider keys and developer secrets, and sent them to a server the attackers controlled. The bad release was on PyPI for about an hour and three quarters, from roughly 11:40 to 13:23 UTC.
The GitHub tag for v1.107.0 was clean. That means the attackers got into the release pipeline, not the source code, so reading the code on GitHub would not have shown anything wrong. As of 25 October, how they got in was still being investigated. (Aviatrix, Shattered)
If you installed 1.107.0, or pulled that image, during that window: treat every secret on that machine or CI runner as stolen. Rotate cloud credentials, AI API keys and tokens, then pin to a known-good version.
The pattern: hijacked releases, not lookalike packages
Two days earlier, five OVHcloud CLI releases were reportedly swapped for builds that steal secrets (AgentBeam tracker). One weekly review calls the campaign the first publicly attributed large-scale supply-chain attack driven by agentic AI (Shieldworkz).
The common thread is that attackers take over a real maintainer account or release pipeline instead of publishing a package with a similar name. Checking the package name doesn’t help when the name is right. What helps:
- Pin exact versions and commit lockfiles.
- Install in CI without lifecycle scripts where you can (
npm ci --ignore-scripts). - Keep long-lived secrets off the machines that install dependencies.
Exploited right now: patch these first
These are on CISA’s Known Exploited Vulnerabilities list, which means attackers are already using them.
| Product | CVE | What it is | Status |
|---|---|---|---|
| Arista VeloCloud Orchestrator (on-premises) | CVE-2026-114625 | SQL injection, CVSS 9.9 | Disclosed 22 October and added to the list 23 October. The federal deadline to patch is 26 October. |
| BeyondTrust Remote Support | CVE-2026-102764 | Zero-day | Flagged as the most urgent item of the week (briefing) |
| Ivanti Connect Secure | CVE-2026-104935 | Authentication bypass | Added 13 October and still being exploited |
Critical bugs to patch
- Node.js (advisory, 21 October): security releases for 22.x, 24.x and 26.x fix two bugs:
- DNS resolution silently cut short hostnames that contain a NUL byte;
- the HTTP Agent reused connections when it shouldn’t have.
- Brotli decoder (CVE-2026-111497): an out-of-bounds write in versions 1.0.3 to 1.2.0. It was first disclosed for Node.js as “Node2Shell” and has since reached Python packages. Check what bundles a Brotli decoder in your dependency tree, not just your direct imports. (HN digest)
- GitLab: a vulnerability rated CVSS 10.0 (Shieldworkz).
- PHP: two critical remote code execution flaws (same source).
- Dell: five flaws in Dell System Update, one of which lets an unauthenticated remote attacker run code as root (eSecurityPlanet).
- Certificates: a compromised certificate authority was reported, and an eMudhra certificate key-generation flaw was discussed on Hacker News.
AI coding agents are now a target
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package (HN digest).
No exploit was needed. The attack only needs an agent that reads files it was never meant to trust and then runs commands with the developer’s permissions. It is the clearest real-world case so far for running coding agents in a sandbox, with limits on:
- which files the agent can read and write;
- which network addresses it can reach;
- which credentials it can see.
Many agent tools ship such a sandbox, often turned off by default (guide).
Ransomware and breaches
Most of these are claims posted on ransomware groups’ leak sites and have not been confirmed by the victims.
- Qilin listed:
- N0n claimed:
- Earlier in October (SharkStriker):
- ransomware forced the cloud provider IDCF Frontier to shut down, affecting 495 companies and local governments;
- Daiwa Securities reported more than 110,000 client records exposed;
- Skyticket reported 14.64 million records exposed.
This week’s checklist
- Search lockfiles, images and CI logs for
litellm==1.107.0and the OVHcloud CLI. If you find either, rotate every secret that machine could reach. - Update Node.js on every supported line.
- Find and update anything that bundles a Brotli decoder between 1.0.3 and 1.2.0.
- If you run Arista VeloCloud Orchestrator on-premises, BeyondTrust Remote Support or Ivanti Connect Secure, patch now and look for signs of compromise.
- Turn on your coding agent’s sandbox, and stop it from reading folders like Downloads.