GitLab patches a maximum-severity vulnerability.

Summary

By the N2K CyberWire staff

GitLab patches a maximum-severity vulnerability.

GitLab has issued patches for a maximum-severity vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE), BleepingComputer reports. The vulnerability (CVE-2026-110264) “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.”

GitLab has released threat detections to help users detect exploitation attempts. Users are urged to apply the patches immediately.

See attack paths across AWS, Okta, GitHub, and more.

BloodHound Enterprise extends attack path management across your hybrid environment, mapping how identities, permissions, and trust connect across AWS, cloud, and identity providers so teams can find and break the paths that reach critical assets. Try BloodHound Enterprise today.

Threat actors compromise LiteLLM.

Threat actors compromised the open-source AI gateway LiteLLM yesterday, pushing a malicious release to its PyPI and Docker registries, the Register reports. The malicious version contained a credential harvester and a remote access trojan capable of executing arbitrary code. The compromised release was live for about 1 hour and 40 minutes, during which time it received approximately 49,000 downloads.

Users who installed the compromised versions should assume their secrets have been compromised. Wiz says threat actors began abusing stolen credentials approximately 4.5 hours after the incident occurred.

Where cyber leaders come together to turn challenges into action.

The Aspen Cyber Summit brings together leading voices from government, industry, and civil society to address the cybersecurity challenges shaping our future. Join senior leaders and experts in Washington, DC, for consequential conversations focused on moving beyond identifying risks to advancing actionable, cross-sector solutions.

Amazon detected PHP2Shell exploitation days before disclosure.

Amazon Threat Intelligence detected attempts to exploit two PHP vulnerabilities four days before their public disclosure on October 21st. The activity, observed through Amazon’s MadPot honeypot network, originated from anonymized infrastructure, suggesting threat actor involvement. How the attackers obtained exploit information remains unknown.

Separately, PHP’s maintainers have called out Chainguard for breaking the embargo and publishing built images containing the fix more than six hours before the coordinated disclosure. This activity is unrelated to the exploitation observed by Amazon, but it may have given attackers a head start to begin developing exploits before patches were broadly available. PHP stated, “Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.”

Attacks, Threats, and Vulnerabilities

CrowdStrike Uncovers New Agentic AI Campaigns (CrowdStrike) CrowdStrike details research into four previously unreported threat actors conducting campaigns in which AI agents make decisions and execute commands.

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (BleepingComputer) Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers.

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk (The Register) 'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg

Litigation, Investigation, and Law Enforcement

Authorities disrupt nearly 11,000 cybercrime networks in Africa (BleepingComputer) Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

AI Security Summit 2026: Runtime Trust (Virtual, Oct 21 - 22, 2026) AI agents no longer just request access. They take action. They plan, negotiate, and execute across your cloud and enterprise systems, often without a human in the loop. Traditional security answers one question: should this user have access? It has no answer for the one that matters now: should this agent be allowed to take this action, right now, in this context? That's the question AARM (Autonomous Action Runtime Management) was built to answer. Originally developed by Vanta and donated to the Cloud Security Alliance as an open, vendor-neutral specification, AARM defines how to intercept an agent's actions before they execute, evaluate them against context and policy, and stop the ones that shouldn't happen. Nearly 100 companies are already building on it, and CSA is now the permanent home stewarding where it goes next. Join CSA, Vanta, and Insecure Agents for the AI Security Summit 2026: Runtime Trust, a free, two-day virtual event on October 21–22, 2026, going deep on AARM alongside STAR for AI Level 2 and the fastest-moving, time-sensitive frontier of AI security shaping the year ahead.

Cyber Innovation Conference (Washington, DC, USA, Oct 26 - 27, 2026) The Cyber Innovation Conference brings together 600+ cybersecurity leaders, founders, investors, and operators shaping what comes next in cyber for two days of high-signal programming, executive roundtables, an Innovation Expo, and curated networking.

[un]prompted II (Virtual and San Francisco, California, USA, Oct 27 - 29, 2026) [un]prompted is back for the second time, this October, in SF. Whether you’re a CISO Excel jockey or a researcher sniffing for the scent of bits, we see you as part of our wider AI security practitioner community. [un]prompted is an intimate, raw, and fun gathering for the professionals actually doing the work, from offense to threat hunting to program building to national policy. No fluff. No filler. Just sharp talks, real demos, and conversations that matter.

CyberSat 2026 Unclassified Program (Reston, Virginia, USA, Nov 2 - 3, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

CyberSat 2026 Classified Program (Chantilly, Virginia, USA, Nov 4 - 5, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 10.22.26

Top stories.

GitLab patches a maximum-severity vulnerability.

Threat actors compromise LiteLLM.

Amazon detected PHP2Shell exploitation days before disclosure.

Attacks, Threats, and Vulnerabilities

Litigation, Investigation, and Law Enforcement

Events