Notes on coding agents and the pages they leave behind, on moving between notes apps, and on the plain mechanics of keeping what you think. Written and published from a Sumibako vault.
The week the internet had a bad day: October 2026's security incidents, in order
PHP2Shell, Railway, Next.js, LiteLLM, eMudhra, Plex, GitLab, Cairn: 13 to 24 October 2026 in order, what the numbers mean, and what the week had in common.
Prashant Shaw
Founder, Sumibako
10 min read
On 21 October, TechCrunch's Sarah Perez opened a story with a sentence that did not need a second one: "The internet is having a bad day, from a cybersecurity perspective." She was writing about PHP, Node.js, LiteLLM, eMudhra, TiDB Cloud, Plex and BeyondTrust, all in one article, and she had not yet heard about Railway or GitLab. It was a Wednesday. The week still had two working days in it, and both of them used the time.
I spent the week reading the primary sources behind each of those, and writing a post on each of the big ones. This is the post that puts them in order, says which numbers mean what, and tries to name what the week had in common. It has links to the deeper posts and to every source. It does not have a solution; that is the next post.
🗓️ The fortnight, in order
13 October. Microsoft's Patch Tuesday fixed, in BleepingComputer's count, "a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities." The exploited one let attackers bypass the Mark of the Web, the flag that makes Windows wary of downloaded files. The same day the United States' catalogue of exploited vulnerabilities, which I will call KEV, gained an Ivanti VPN bug.
14 October. Next.js shipped two critical remote code execution fixes, one of which I was late for. Somewhere in Taiwan, an attacker was already inside Zeabur with admin tokens from January 2024.
15 October. BeyondTrust disclosed a zero-day in its Remote Support appliance. Rapid7's
dates the known compromises: "Its October 16 report dates the two known Remote Support compromises to August 29, 2026: one BeyondTrust-hosted instance and one self-hosted appliance." Seven weeks of quiet.
16 October. A researcher published the write-up and exploit for Plex2Shell, four Plex Media Server bugs that Plex had fixed on 3 August.
17 October. A researcher found that eight of eMudhra's certificate authority keys were small integers, one of them 4. Chrome blocked them within four hours. The same day, Amazon's honeypots recorded the first attempt to exploit PHP2Shell, four days before anyone outside the embargo was supposed to know it existed.
19 October. Reuters reported that one operator with an AI agent platform had broken into more than a hundred company websites. The Hacker News reported Plex2Shell being used to install miners. PingCAP disclosed that a stolen service account had been inside TiDB Cloud's internal systems since 9 September. And five OVHcloud CLI releases on GitHub had their files swapped for malware for 94 minutes.
20 October. The PHP2Shell CVE numbers leaked a day early, with the wrong score. CISA added all four Plex bugs to KEV on one day. Zeabur announced it would shut down.
21 October. PHP released the fixes for PHP2Shell. Node.js fixed ten bugs, one of them remote code execution. GitLab shipped a CVSS 10.0. Railway disclosed that its customers' environment variables had been read. LiteLLM 1.107.0 sat on PyPI for two hours with a credential stealer in it. CISA told everyone to patch PHP, and the NSA told those who could not to go offline. That was the bad day.
22 October. Zeabur published its report: 3.2 million environment variables read, the result of credentials its August rotation had missed. eMudhra announced it was leaving the certificate business, five days after the report.
23 October. PHP warned of a third flaw, not fixed by the 21 October releases. Cult of Mac counted nine disasters for the month. Next.js shipped 16.4.3, which is where Sumibako now is.
24 October. Railway's status page: "Railway is not currently under attack." I started writing.
🔢 The numbers, and what they are not
Every one of these stories came with a number, and most of the numbers are not what they sound like.
The number
What it counts
Who counted
1,411
Flaws fixed in Microsoft's October Patch Tuesday; others say 1,413 or 1,403
BleepingComputer
22.6 million
PHP instances exposed to the internet, not confirmed vulnerable
Palo Alto Networks
about 100,000
Railway workspaces with possibly compromised variables, at most 1.85%
Railway
3,218,965
Environment variable records read from Zeabur's database
Zeabur
30,800
Certificates chaining to the eMudhra root being removed, 99.9% via InCommon
Chrome Root Program
26
Entries added to CISA's exploited vulnerabilities catalogue in October, to the 23rd
My count of CISA's feed
about $50
Tokens spent per successful break-in by the Cairn operator, one researcher's estimate
NorForge, via Reuters
Microsoft's 1,411 is BleepingComputer's count; Check Point says 1,413 and SonicWall 1,403, depending on what you count as a flaw. BleepingComputer's explanation for the record is the interesting part: "This is a record-breaking Microsoft Patch Tuesday as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products." A record is not a worse month. It is a month in which more was found.
PHP's 22.6 million is Palo Alto's count of exposed instances; VirusTotal's is 5.1 million IP addresses and VulnCheck's 2.6 million hosts. They measure different things, and none of them is a count of servers actually broken into, which nobody has published.
Railway's 1.85% is its ceiling on workspaces with possibly compromised variables, about 100,000; the number of people whose keys were revoked was larger, because Railway could not be selective.
eMudhra's 30,800 is the number of certificates that chain to the root the browsers are removing on 27 October, 99.9% of them issued through InCommon to universities, none of them issued by the eight compromised intermediates, which issued nothing at all.
KEV's 26 is the number of entries CISA added this month as of 23 October, against 43 in September, by my count of the catalogue's published feed. Five of the 26, added on 8 October, are CVEs from 2015, 2016, 2021 and 2023. A decade-old BIND bug is being exploited in October 2026 because somewhere a server from 2015 is still answering.
Entries added to CISA's catalogue of exploited vulnerabilities, by month. October is three weeks old.
And the Cairn figure, "roughly $5,000 worth of tokens, or about $50 per successful hack", is one researcher's estimate of one operator's bill. I will come back to it.
🧩 Three kinds of bad week
Read together, the fortnight sorts into three piles, and they call for different responses.
The first pile is new holes in things everyone runs: PHP, Next.js, Node.js, GitLab. GitLab's release notes are the plainest: a regular expression compiler bug that "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server", affecting every self-managed version back to 7.0, with the reassurance that "GitLab.com is already running the patched version." For this pile the answer is to be on a supported version and to take the patch the day it ships, because the exploit follows in hours.
The second pile is old holes finally exploited: Plex, BeyondTrust, the 2015 CVEs. Plex's fix was eleven weeks old when the exploit went public. BleepingComputer's report notes the odd arithmetic of chains: "The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8." For this pile the vendor did its job months ago. The answer is an inventory and a habit.
The third pile is other people's copies of your secrets: Railway, Zeabur and TiDB Cloud holding environment variables; LiteLLM and OVHcloud holding a maintainer's token; eMudhra holding a key that was supposed to be random. Nothing you ran was broken. Something you trusted was. The answer is scope, rotation and short-lived credentials, and knowing who vouches for you.
🤖 AI on both ends
The thread the week kept pulling at is that machines are now on both sides of the patch.
On the finding side: Microsoft credits AI platforms for its record count. Two of the week's Linux kernel bugs were found by an AI scanner and posted to public lists before fixes existed, per the week's review. PHP2Shell's discoverer, Ryan Austin of Calif, pushes back on the headline that AI found it: "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery." But Wiz, which found further paths, told the BBC the exploits were another matter: "Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," And Unit 42 describes what happened after one PHP break-in: "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets."
On the attacking side, the Cairn campaign is the week's parable. Reuters, reprinted here, describes a researcher who found "about two dozen instances of Cairn being used for malicious activity, which allowed him to quietly peer over the cybercriminals' shoulders as they set their AI tools loose on the world." The operator's brief to the agents: "Their instructions were terse, sketching out their preferred intrusion tactics in fewer than 100 Chinese characters." The result: "As of late last week, their agents had attempted to break into more than 1,200 sites." The Next Web's account puts the success rate at over a hundred and the cost at about fifty dollars each. Whether that estimate is right matters less than its order of magnitude. Breaking into a website used to cost a skilled person's time. Now it costs lunch.
Amazon's CJ Moses said the quiet part in the PHP post-mortem: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit." And: "An embargo protects defenders only until someone else finds the same bug." Perez's version, for the general reader: "This is particularly important as AI could make it easier for attackers to exploit vulnerabilities once discovered."
Put the two sides together and the shape of the next few years is visible. More bugs will be found, because finding is cheaper. More of them will be exploited faster, because exploiting is cheaper. The one thing that has not got cheaper is a human being deciding to apply the patch on the day it ships.
🪞 The same fundamental flaw?
Cult of Mac's roundup of nine incidents claims that "The incidents vary in scale and in the extent of confirmed impact, but they all have the same fundamental flaw." Its nine include some I have not covered: a bank's customer records on the dark web, a diagnostics company's lab platform, an FBI employment site where, per Reuters, a contractor had not patched Oracle PeopleSoft, a backup service suspended after a stolen credential reached customers' Microsoft 365 tenants, a supermarket group's outages, a Taiwanese commerce platform, a contact centre vendor.
Is there one flaw? Reading the record, I think there are two, and they are old. Software with a known fix was left unpatched: PeopleSoft at a contractor, Plex on 36,000 servers, PHP 8.1 on 79% of the servers one scanner could see, Next.js 16.3.3 on my own site. And credentials were trusted for longer and wider than they should have been: Zeabur's admin tokens from January 2024, LiteLLM's master key from May, an owner's GitHub token that sat past two-factor authentication, a backup service's credential with access to every customer's mail. Cult of Mac's own conclusion is modest and correct: "patching software with known vulnerabilities, limiting the permissions granted to third parties, and investigating any suspicious activity remain sensible ways of reducing the risk of attacks that compromise systems and steal user information."
Perez again, and this is the sentence I would keep: "Though the issues were unrelated to each other, their back-to-back arrival highlights the challenges cybersecurity teams now face." The issues were unrelated. The week was not. A week like this is what it looks like when the cost of finding and exploiting falls faster than the cost of patching, and the only people who come through it quietly are the ones who had already done the boring things.
🧭 What I take from it
I run a small product. Nothing in this fortnight was aimed at me, and one of it hit me anyway, through a version number I had not looked at since summer. The dependency I did not update was the vulnerability. The environment variable I had not rotated in a year was the exposure. The certificate authority I could not name was the trust I had never examined.
So the next post is a checklist, written from this fortnight and from my own list of things I should have done before it. It is not clever. The week did not punish a lack of cleverness. It punished a month's delay, and it will again, and sooner.
The six deeper posts linked above carry their own source lists.
LiteLLM 1.107.0 and the OVHcloud CLI: two stolen tokens, two poisoned downloads, one pinned hash
A key committed in May became a credential stealer on PyPI in October; five OVHcloud CLI releases were swapped for 94 minutes. What to do if you got either.
