{"version":1,"question":"Is the internet OK?","answer":"mostly","summary":"Mostly. The internet is up. Trust is under maintenance. 1 watched service of 18 with problems (Twilio: degraded). 11 open incidents, 7 already exploited by attackers.","up":"up","safe":"critical","tone":"major","checkedAt":"2026-10-24T14:59:58.525Z","services":[{"id":"cloudflare","name":"Cloudflare","site":"cloudflare.com","group":"backbone","pillar":true,"state":"operational","note":null,"url":"https://www.cloudflarestatus.com"},{"id":"aws","name":"AWS","site":"aws.amazon.com","group":"backbone","pillar":true,"state":"operational","note":null,"url":"https://health.aws.amazon.com/health/status"},{"id":"gcp","name":"Google Cloud","site":"cloud.google.com","group":"backbone","pillar":true,"state":"operational","note":null,"url":"https://status.cloud.google.com"},{"id":"azure","name":"Microsoft Azure","site":"azure.microsoft.com","group":"backbone","pillar":true,"state":"operational","note":null,"url":"https://azure.status.microsoft/en-us/status"},{"id":"akamai","name":"Akamai","site":"akamai.com","group":"backbone","pillar":true,"state":"operational","note":"Customer Security Advisory: Node.js Brotli Remote Code Execution Vulnerabilities","url":"https://www.akamaistatus.com"},{"id":"github","name":"GitHub","site":"github.com","group":"dev","pillar":false,"state":"operational","note":null,"url":"https://www.githubstatus.com"},{"id":"npm","name":"npm","site":"npmjs.com","group":"dev","pillar":false,"state":"operational","note":null,"url":"https://status.npmjs.org"},{"id":"vercel","name":"Vercel","site":"vercel.com","group":"cloud","pillar":false,"state":"operational","note":null,"url":"https://www.vercel-status.com"},{"id":"netlify","name":"Netlify","site":"netlify.com","group":"cloud","pillar":false,"state":"operational","note":null,"url":"https://www.netlifystatus.com"},{"id":"digitalocean","name":"DigitalOcean","site":"digitalocean.com","group":"cloud","pillar":false,"state":"operational","note":null,"url":"https://status.digitalocean.com"},{"id":"atlassian","name":"Atlassian","site":"atlassian.com","group":"dev","pillar":false,"state":"operational","note":null,"url":"https://status.atlassian.com"},{"id":"stripe","name":"Stripe","site":"stripe.com","group":"apps","pillar":false,"state":"operational","note":null,"url":"https://status.stripe.com"},{"id":"discord","name":"Discord","site":"discord.com","group":"apps","pillar":false,"state":"operational","note":null,"url":"https://discordstatus.com"},{"id":"reddit","name":"Reddit","site":"reddit.com","group":"apps","pillar":false,"state":"operational","note":null,"url":"https://www.redditstatus.com"},{"id":"dropbox","name":"Dropbox","site":"dropbox.com","group":"apps","pillar":false,"state":"operational","note":null,"url":"https://status.dropbox.com"},{"id":"twilio","name":"Twilio","site":"twilio.com","group":"apps","pillar":false,"state":"degraded","note":"Voice Call Failures from a Subset of Twilio Phone Numbers to United States","url":"https://status.twilio.com"},{"id":"openai","name":"OpenAI","site":"openai.com","group":"ai","pillar":false,"state":"operational","note":null,"url":"https://status.openai.com"},{"id":"claude","name":"Claude","site":"claude.ai","group":"ai","pillar":false,"state":"operational","note":null,"url":"https://status.claude.com"}],"incidents":[{"id":"2026-10-21-litellm-supply-chain","title":"LiteLLM 1.107.0 shipped credential-stealing malware","summary":"Attackers published a booby-trapped version 1.107.0 of LiteLLM, a popular tool for connecting apps to AI models, that stole passwords and cloud keys. It was live for a few hours; it only matters to developers who installed it.","impact":"Nothing visible for you; developers who installed it must act.","kind":"supply-chain","severity":"critical","status":"mitigated","exploited":true,"affects":[{"name":"LiteLLM (PyPI and Docker images)","category":"library","site":"litellm.ai","packages":[{"ecosystem":"PyPI","name":"litellm","vulnerable":["=1.107.0"]},{"ecosystem":"Docker","name":"ghcr.io/berriai/litellm","vulnerable":["=1.107.0"]},{"ecosystem":"Docker","name":"ghcr.io/berriai/litellm-database","vulnerable":["=1.107.0"]},{"ecosystem":"Docker","name":"ghcr.io/berriai/litellm-non_root","vulnerable":["=1.107.0"]}]}],"audience":"developers","action":{"everyone":"Nothing to do.","owners":"If any machine installed litellm 1.107.0 or ran its Docker or GHCR images on October 21, treat it as compromised: remove cook.pth, cook.py and sitecustomize.py, kill the detached Python daemon, reinstall pinned to 1.106.2 or rebuild from scratch, and rotate every credential the host could reach."},"startedAt":"2026-10-21","updatedAt":"2026-10-23","timeline":[{"at":"2026-10-21","status":"identified","text":"Malicious litellm 1.107.0 is live on PyPI from 11:39 to 13:23 UTC and on Docker Hub tags (v1.107.0, latest, main-latest, main-stable) from 11:46 to 14:20 UTC. It steals credentials and loads remote code.","source":0},{"at":"2026-10-21","status":"mitigated","text":"The malicious PyPI release and image tags are removed or repointed to clean artifacts. LiteLLM recommends pinning 1.106.2.","source":0},{"at":"2026-10-23","status":"mitigated","text":"LiteLLM notes that some earlier statements were inaccurate or incomplete and points to a canonical record.","source":0}],"sources":[{"url":"https://docs.litellm.ai/blog/security-incident-oct-21-2026","title":"Security incident Oct 21 2026","publisher":"LiteLLM","kind":"official"},{"url":"https://socket.dev/blog/litellm-compromise","title":"LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials","publisher":"Socket","kind":"advisory"},{"url":"https://osv.dev/vulnerability/MAL-2026-2144","title":"Malicious code in litellm (PyPI) (MAL-2026-2144)","publisher":"OSV","kind":"advisory"}],"url":"https://istheinternetok.com/i/2026-10-21-litellm-supply-chain/"},{"id":"2026-10-21-php2shell","title":"PHP2Shell: two critical flaws in PHP","summary":"PHP, the language behind a large share of websites, fixed two flaws that let an attacker take over a web server with a single request. Several governments took websites offline as a precaution; visitors have nothing to do, site owners must update PHP now.","impact":"Some government websites went offline as a precaution.","kind":"vulnerability","severity":"critical","status":"fix-available","exploited":true,"affects":[{"name":"PHP","category":"language","site":"php.net","fixedIn":["8.5.12","8.4.27","8.3.36","8.2.35"],"product":"php"}],"audience":"site-owners","action":{"everyone":"Nothing to do. Some government websites may be offline for a while.","owners":"Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package; check its changelog for the CVE ids) and restart every worker. PHP 8.1 and older get no official fix. Mitigations such as session.upload_progress.enabled=0 only reduce exposure; updating is the only complete fix."},"cves":["CVE-2026-109618","CVE-2026-109619"],"cvss":9.2,"startedAt":"2026-10-20","updatedAt":"2026-10-23","timeline":[{"at":"2026-10-20","status":"identified","text":"PHP announces a critical security release for October 21 fixing two vulnerabilities rated CVSS v4.0 9.2.","source":0},{"at":"2026-10-21","status":"mitigated","text":"Cloudflare enables WAF rules against the flaws on all plans, including Free, from 03:02 UTC, and reports attack traffic targeting its customers after details leaked.","source":1},{"at":"2026-10-21","status":"fix-available","text":"PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing CVE-2026-109618 and CVE-2026-109619. All PHP installs serving web requests are affected; risk is highest with Apache mod_php.","source":0},{"at":"2026-10-21","status":"fix-available","text":"Government websites in several countries, including Germany, Finland, Belgium, the Netherlands and France, are taken offline as a precaution.","source":2},{"at":"2026-10-23","status":"fix-available","text":"Cloudflare extends its rules to a related PHP session upload progress issue, CVE-2026-115560.","source":1}],"sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","title":"Security advisory: Critical remote code execution vulnerabilities, update now","publisher":"php.net","kind":"official"},{"url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","title":"Cloudflare deploys protections against php2shell vulnerability","publisher":"Cloudflare","kind":"advisory"},{"url":"https://www.canberratimes.com.au/story/9373041/government-websites-go-dark-in-software-flaw-scramble/","title":"Government websites go dark in software flaw scramble","publisher":"Australian Associated Press","kind":"press"},{"url":"https://www.thestar.com.my/news/world/2026/10/21/explainer-what-is-php-and-why-did-it-take-government-websites-offline","title":"Explainer-What is PHP and why did it take government websites offline?","publisher":"Reuters","kind":"press"}],"related":["2026-10-23-php-session-upload-progress"],"url":"https://istheinternetok.com/i/2026-10-21-php2shell/"},{"id":"2026-10-13-ivanti-connect-secure-zero-day","title":"Ivanti Connect Secure VPN: zero-day under attack","summary":"Hackers were breaking into Ivanti Connect Secure, a VPN that companies use for remote access, before a fix existed. Employees have nothing to do; IT teams must update.","impact":"Nothing visible for you; company IT teams must update their VPN.","kind":"vulnerability","severity":"critical","status":"fix-available","exploited":true,"affects":[{"name":"Ivanti Connect Secure","category":"device","site":"ivanti.com","product":"ivanti-connect-secure"}],"audience":"site-owners","action":{"everyone":"Nothing to do.","owners":"Upgrade Ivanti Connect Secure to the fixed version from Ivanti's advisory (versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, 25.1.1.1 and earlier are affected) and check appliances for signs of compromise."},"cves":["CVE-2026-104935"],"startedAt":"2026-10-13","updatedAt":"2026-10-13","timeline":[{"at":"2026-10-13","status":"fix-available","text":"Ivanti discloses CVE-2026-104935, an authentication bypass in Connect Secure, and says it is aware of limited exploitation in the wild. Volexity reports exploitation since at least October 3.","source":1},{"at":"2026-10-13","status":"fix-available","text":"CISA adds CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.","source":2}],"sources":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US","title":"Security Advisory: Ivanti Connect Secure (CVE-2026-104935)","publisher":"Ivanti","kind":"official"},{"url":"https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/","title":"Ivanti warns of Connect Secure zero-day exploited in attacks","publisher":"BleepingComputer","kind":"press"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","title":"Known Exploited Vulnerabilities Catalog","publisher":"CISA","kind":"advisory"}],"url":"https://istheinternetok.com/i/2026-10-13-ivanti-connect-secure-zero-day/"},{"id":"2026-10-14-nextjs-rce","title":"Next.js: two critical remote code execution flaws","summary":"Next.js, a popular framework used to build websites, fixed two critical flaws that could let an attacker take over a server, plus one that can make sites stop responding. Visitors have nothing to do; site owners using Next.js should update.","impact":"Nothing visible for you; site owners must update.","kind":"vulnerability","severity":"critical","status":"fix-available","exploited":false,"affects":[{"name":"Next.js","category":"framework","site":"nextjs.org","fixedIn":["15.5.28","16.4.1"],"packages":[{"ecosystem":"npm","name":"next","vulnerable":[">=10.0.0 <15.5.28",">=16.0.0 <16.4.1"],"fixed":["15.5.28","16.4.1"]}]},{"name":"sharp","category":"library","site":"sharp.pixelplumbing.com","fixedIn":["0.35.5"],"packages":[{"ecosystem":"npm","name":"sharp","vulnerable":["<0.35.5"],"fixed":["0.35.5"]}]}],"audience":"site-owners","action":{"everyone":"Nothing to do.","owners":"Upgrade next to 16.4.1 (16.x) or 15.5.28 (15.x) and redeploy. The use cache flaw has no workaround. If you cannot upgrade right away, make sure the sharp version used by Next.js is 0.35.5 or later."},"cves":["CVE-2026-96889"],"startedAt":"2026-10-14","updatedAt":"2026-10-14","timeline":[{"at":"2026-10-08","status":"identified","text":"Next.js announces an out-of-band security update for October 14, covering two critical and one high severity issues in upstream dependencies.","source":1},{"at":"2026-10-14","status":"fix-available","text":"Next.js 16.4.1 and 15.5.28 released: fixes an unauthenticated RCE in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr), an RCE in the Image Optimization API with SVG on glibc Linux (CVE-2026-96889), and a Server Actions denial of service (GHSA-p3m5-59mp-jv5r).","source":0}],"sources":[{"url":"https://nextjs.org/blog/nextjs-security-update-october-14-2026","title":"Next.js Security Update for Upstream Vulnerabilities","publisher":"nextjs.org","kind":"official"},{"url":"https://nextjs.org/blog/upcoming-nextjs-security-update-october-2026","title":"Upcoming Next.js Security Update for Upstream Vulnerabilities","publisher":"nextjs.org","kind":"official"},{"url":"https://netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities","title":"Security Update: Next.js and React vulnerabilities (October 2026)","publisher":"Netlify","kind":"advisory"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw","title":"Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw)","publisher":"Vercel","kind":"advisory"},{"url":"https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w","title":"sharp: Vulnerability in librsvg dependency CVE-2026-96889 (GHSA-wq5f-xc86-pv6w)","publisher":"sharp","kind":"advisory"}],"url":"https://istheinternetok.com/i/2026-10-14-nextjs-rce/"},{"id":"2026-10-17-plex2shell","title":"Plex2Shell: hackers hijack unpatched Plex servers","summary":"Attackers are chaining four flaws in Plex Media Server, the home movie server many people run, to take over machines and install crypto miners. If you run a Plex server, update it.","impact":"Home Plex servers that are not updated can be taken over.","kind":"vulnerability","severity":"major","status":"fix-available","exploited":true,"affects":[{"name":"Plex Media Server","category":"service","site":"plex.tv","fixedIn":["1.43.3.10861"],"product":"plex"}],"audience":"everyone","action":{"everyone":"If you run a Plex Media Server, update it to version 1.43.3.10861 or later. Watching Plex as a viewer needs no action.","owners":"Update Plex Media Server to 1.43.3.10861 or later and check internet-facing servers for unknown processes such as crypto miners or proxy software."},"cves":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656"],"startedAt":"2026-10-16","updatedAt":"2026-10-21","timeline":[{"at":"2026-10-16","status":"fix-available","text":"Technical details of the four-flaw chain are published; builds from 1.43.3.10861 (released August 4) are not affected.","source":0},{"at":"2026-10-17","status":"fix-available","text":"First exploitation reports: attackers drop a crypto miner on exposed servers.","source":0},{"at":"2026-10-20","status":"fix-available","text":"CISA adds the four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog.","source":1}],"sources":[{"url":"https://bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers","title":"CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers","publisher":"BleepingComputer","kind":"press"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","title":"Known Exploited Vulnerabilities Catalog","publisher":"CISA","kind":"advisory"}],"url":"https://istheinternetok.com/i/2026-10-17-plex2shell/"},{"id":"2026-10-19-pingcap-tidb-cloud-breach","title":"PingCAP / TiDB Cloud: internal systems breached","summary":"An intruder used stolen credentials to get into PingCAP's internal systems for about a month and copied account data, billing records and source code. It matters only if your company uses the TiDB Cloud database service.","impact":"Nothing visible for you; only TiDB Cloud customers are concerned.","kind":"breach","severity":"major","status":"mitigated","exploited":true,"affects":[{"name":"TiDB Cloud","category":"service","site":"pingcap.com","product":"tidb-cloud"}],"audience":"developers","action":{"everyone":"Nothing to do.","owners":"If you use TiDB Cloud, watch for PingCAP's direct notice about your account, review and rotate TiDB Cloud API keys, and check for unexpected activity. Questions go to security@pingcap.com."},"startedAt":"2026-09-09","updatedAt":"2026-10-19","timeline":[{"at":"2026-10-07","status":"identified","text":"PingCAP learns that stolen service account credentials were used to access internal systems since September 9, and starts disabling them.","source":0},{"at":"2026-10-14","status":"mitigated","text":"PingCAP fixes four vulnerabilities reported by an external firm and blocks all identified unauthorized access paths.","source":0},{"at":"2026-10-19","status":"mitigated","text":"PingCAP publishes its report: account and usage data, business and billing data, an export containing encrypted API-key values, and source code were obtained. No evidence that data stored in TiDB was impacted; investigation ongoing.","source":0}],"sources":[{"url":"https://www.pingcap.com/trust-hub/security/security-update-october-2026/","title":"Security Update October 2026","publisher":"PingCAP","kind":"official"}],"url":"https://istheinternetok.com/i/2026-10-19-pingcap-tidb-cloud-breach/"},{"id":"2026-10-14-pan-os-cve-2026-0322","title":"Palo Alto firewalls: exploited flaw gives root access","summary":"A flaw in Palo Alto Networks firewalls lets someone with access to the admin interface take full control, and it has been used in limited attacks. It matters to companies running these firewalls, not to individuals.","impact":"Nothing visible for you; companies must update their firewalls.","kind":"vulnerability","severity":"major","status":"fix-available","exploited":true,"affects":[{"name":"PAN-OS (PA-Series, VM-Series, Panorama)","category":"device","site":"paloaltonetworks.com","fixedIn":["12.2.4","12.1.4-h12","12.1.7-h8","12.1.10-h2","11.2.4-h22","11.2.7-h21","11.2.10-h15","11.2.13-h3","11.2.16","11.1.4-h37","11.1.6-h39","11.1.7-h11","11.1.10-h35","11.1.13-h15","11.1.16-h3","10.2.7-h38","10.2.10-h41","10.2.13-h26","10.2.16-h11","10.2.18-h12"],"product":"pan-os"}],"audience":"site-owners","action":{"everyone":"Nothing to do.","owners":"Upgrade PAN-OS to the fixed release for your branch and restrict the management interface to trusted internal IP addresses. There is no full workaround. Cloud NGFW and Prisma Access are not affected."},"cves":["CVE-2026-0322"],"cvss":8.6,"startedAt":"2026-10-14","updatedAt":"2026-10-15","timeline":[{"at":"2026-10-14","status":"fix-available","text":"Palo Alto Networks publishes CVE-2026-0322, an authenticated code injection in the PAN-OS management interface, and reports very limited exploitation.","source":0},{"at":"2026-10-14","status":"fix-available","text":"CISA adds CVE-2026-0322 to its Known Exploited Vulnerabilities catalog.","source":1},{"at":"2026-10-15","status":"fix-available","text":"Advisory updated.","source":0}],"sources":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0322","title":"CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution in the Management Interface","publisher":"Palo Alto Networks","kind":"official"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","title":"Known Exploited Vulnerabilities Catalog","publisher":"CISA","kind":"advisory"}],"url":"https://istheinternetok.com/i/2026-10-14-pan-os-cve-2026-0322/"},{"id":"2026-10-13-windows-motw-zero-day","title":"Windows: zero-day used to skip download warnings","summary":"Attackers were using a Windows flaw to get around the warning Windows shows for files downloaded from the internet. Microsoft fixed it in the October updates; install them.","impact":"A harmful download could open without Windows warning you.","kind":"vulnerability","severity":"major","status":"fix-available","exploited":true,"affects":[{"name":"Windows","category":"os","site":"microsoft.com","product":"windows"}],"audience":"everyone","action":{"everyone":"Install the October 2026 Windows updates (Settings, Windows Update).","owners":"Deploy the October 13, 2026 Patch Tuesday updates; CVE-2026-96951 is in CISA's Known Exploited Vulnerabilities catalog."},"cves":["CVE-2026-96951"],"startedAt":"2026-10-13","updatedAt":"2026-10-13","timeline":[{"at":"2026-10-13","status":"fix-available","text":"Microsoft's October Patch Tuesday fixes CVE-2026-96951, a Windows Shell security feature bypass of Mark of the Web, exploited in attacks.","source":0},{"at":"2026-10-13","status":"fix-available","text":"CISA adds CVE-2026-96951 to its Known Exploited Vulnerabilities catalog.","source":2}],"sources":[{"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/","title":"Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days","publisher":"BleepingComputer","kind":"press"},{"url":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96951","title":"CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability","publisher":"Microsoft","kind":"official"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","title":"Known Exploited Vulnerabilities Catalog","publisher":"CISA","kind":"advisory"}],"url":"https://istheinternetok.com/i/2026-10-13-windows-motw-zero-day/"},{"id":"2026-10-21-nodejs-security-release","title":"Node.js: four high severity flaws fixed","summary":"Node.js, which runs the server side of many websites and apps, fixed 10 flaws, including one in its Brotli decompression that could let attacker data run code. Visitors have nothing to do; developers should update Node.js.","impact":"Nothing visible for you; developers must update Node.js.","kind":"vulnerability","severity":"major","status":"fix-available","exploited":false,"affects":[{"name":"Node.js","category":"runtime","site":"nodejs.org","fixedIn":["22.23.4","24.22.1","26.12.1"],"product":"nodejs"}],"audience":"developers","action":{"everyone":"Nothing to do.","owners":"Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4, and rebuild Docker images and single executable apps on the fixed version. End-of-life versions get no fix."},"cves":["CVE-2026-111497","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069"],"startedAt":"2026-10-21","updatedAt":"2026-10-21","timeline":[{"at":"2026-10-21","status":"fix-available","text":"Node.js releases 26.12.1, 24.22.1 and 22.23.4 fixing 10 vulnerabilities (4 high, 3 medium, 3 low), including a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497) and TLS hostname check bypasses.","source":0}],"sources":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","title":"Wednesday, October 21, 2026 Security Releases","publisher":"nodejs.org","kind":"official"}],"related":["2026-10-17-emudhra-ca-keys"],"url":"https://istheinternetok.com/i/2026-10-21-nodejs-security-release/"},{"id":"2026-10-17-emudhra-ca-keys","title":"eMudhra: 8 certificate authority keys leaked","summary":"Secret keys behind eight eMudhra intermediate certificates leaked, which could have let someone fake the padlock of any website. Chrome, Android and Firefox blocked them within hours, so normal users are protected automatically.","impact":"Nothing to do; your browser already blocks the leaked certificates.","kind":"certificate","severity":"major","status":"mitigated","exploited":false,"affects":[{"name":"eMudhra (emSign ECC Root CA - G3)","category":"ca","site":"emudhra.com"},{"name":"Chrome","category":"browser","site":"google.com","product":"chrome"},{"name":"Firefox","category":"browser","site":"mozilla.org","fixedIn":["158.0.1","ESR 115.43.1","ESR 153.5.1"],"product":"firefox"},{"name":"Node.js","category":"runtime","site":"nodejs.org","fixedIn":["22.23.4","24.22.1","26.12.1"],"product":"nodejs"}],"audience":"site-owners","action":{"everyone":"Nothing to do. Chrome and Firefox were protected automatically; Android users can restart their device to get the update right away.","owners":"If your site's certificate chains to emSign ECC Root CA - G3, get a new TLS certificate from another trusted CA before October 27, 2026, when Chrome stops trusting that root. Update software that ships its own CA bundle."},"startedAt":"2026-10-17","updatedAt":"2026-10-21","timeline":[{"at":"2026-10-17","status":"identified","text":"A researcher reports that private keys for eight eMudhra intermediate CA certificates are compromised. Chrome confirms and pushes a CRLSet block the same day.","source":0},{"at":"2026-10-17","status":"mitigated","text":"Firefox blocks the certificates through OneCRL for all users with standard settings.","source":1},{"at":"2026-10-20","status":"mitigated","text":"Google and Mozilla publish details. Google removes emSign ECC Root CA - G3 from the Chrome Root Store, rolling out to all devices on October 27, 2026. No certificate chaining to the affected CAs had been logged to Certificate Transparency before the block.","source":0},{"at":"2026-10-21","status":"mitigated","text":"Node.js security releases update the bundled CA store for the eMudhra compromise.","source":3}],"sources":[{"url":"https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/","title":"Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates","publisher":"Google","kind":"official"},{"url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","title":"Protecting Firefox users following the compromise of eMudhra intermediate certificates","publisher":"Mozilla","kind":"official"},{"url":"https://blog.cloudflare.com/emudhra-certificate-compromise/","title":"8 eMudhra certificates are compromised. Here's what you need to know","publisher":"Cloudflare","kind":"advisory"},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","title":"Wednesday, October 21, 2026 Security Releases","publisher":"nodejs.org","kind":"official"},{"url":"https://www.csoonline.com/article/4238338/google-mozilla-revoke-emudhra-intermediates-after-private-key-compromise.html","title":"Google, Mozilla revoke eMudhra intermediates after private key compromise","publisher":"CSO Online","kind":"press"}],"related":["2026-10-21-nodejs-security-release"],"url":"https://istheinternetok.com/i/2026-10-17-emudhra-ca-keys/"},{"id":"2026-10-23-php-session-upload-progress","title":"PHP: lower-risk session upload progress flaw","summary":"PHP disclosed one more flaw, affecting only sites with an unusual session setup. No fix yet, but a simple setting turns it off; visitors have nothing to do.","impact":"Nothing visible for you; a few site owners must change a setting.","kind":"vulnerability","severity":"minor","status":"identified","exploited":false,"affects":[{"name":"PHP","category":"language","site":"php.net","product":"php"}],"audience":"site-owners","action":{"everyone":"Nothing to do.","owners":"Set session.upload_progress.enabled=0 until the next PHP bugfix release. Only apps that switch session.serialize_handler from php_binary or php_serialize to php at runtime are affected. If you already applied this setting for PHP2Shell, nothing more to do."},"cves":["CVE-2026-115560"],"startedAt":"2026-10-23","updatedAt":"2026-10-23","timeline":[{"at":"2026-10-23","status":"identified","text":"PHP publishes an informational advisory for CVE-2026-115560; the fix comes in the next regular bugfix release.","source":0},{"at":"2026-10-23","status":"identified","text":"Cloudflare says the issue affects fully patched releases including 8.5.12 and adds WAF coverage.","source":1}],"sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-23-1","title":"Informational advisory: Session upload progress","publisher":"php.net","kind":"official"},{"url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","title":"Cloudflare deploys protections against php2shell vulnerability","publisher":"Cloudflare","kind":"advisory"}],"related":["2026-10-21-php2shell"],"url":"https://istheinternetok.com/i/2026-10-23-php-session-upload-progress/"}],"recent":[{"id":"2026-10-20-google-cloud-london-outage","title":"Google Cloud London outage hits UK banks","status":"resolved","resolvedAt":"2026-10-20","url":"https://istheinternetok.com/i/2026-10-20-google-cloud-london-outage/"}],"signals":[{"id":"CVE-2026-110447","feed":"kev","title":"Collabora Online - Built-in CODE Server OS Command Injection Vulnerability","vendor":"Collabora","product":"Collabora Online - Built-in CODE Server","date":"2026-10-23","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","exploited":true,"cve":"CVE-2026-110447"},{"id":"CVE-2026-114625","feed":"kev","title":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","vendor":"Arista","product":"VeloCloud Orchestrator","date":"2026-10-23","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625","exploited":true,"cve":"CVE-2026-114625"},{"id":"GHSA-5x8w-8jj5-q52h","feed":"ghsa","title":"Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","vendor":"pip","product":"pillow","date":"2026-10-23","url":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","exploited":false,"severity":"critical","cve":"CVE-2026-112398"},{"id":"GHSA-84c9-qqpq-2pq5","feed":"ghsa","title":"obsidian-tc tokens can access arbitrary configured vaults","vendor":"npm","product":"obsidian-tc","date":"2026-10-23","url":"https://github.com/advisories/GHSA-84c9-qqpq-2pq5","exploited":false,"severity":"critical","cve":"CVE-2026-77366"},{"id":"GHSA-897f-g5gm-fmxm","feed":"ghsa","title":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","vendor":"rust","product":"wasmtime","date":"2026-10-23","url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","exploited":false,"severity":"critical","cve":"CVE-2026-115889"},{"id":"GHSA-cxf3-9h37-7rr8","feed":"ghsa","title":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","vendor":"go","product":"github.com/labstack/echo/v4","date":"2026-10-23","url":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","exploited":false,"severity":"critical"},{"id":"GHSA-f9x3-7vq9-cph6","feed":"ghsa","title":"Laravel TokenGuard authentication bypass through non-string API credentials","vendor":"composer","product":"laravel/framework","date":"2026-10-23","url":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","exploited":false,"severity":"critical","cve":"CVE-2026-114509"},{"id":"GHSA-pqh8-4pj7-32xx","feed":"ghsa","title":"obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback","vendor":"npm","product":"obsidian-tc","date":"2026-10-23","url":"https://github.com/advisories/GHSA-pqh8-4pj7-32xx","exploited":false,"severity":"critical","cve":"CVE-2026-77363"},{"id":"GHSA-2464-fhr4-w9xw","feed":"ghsa","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","vendor":"npm","product":"next","date":"2026-10-22","url":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","exploited":false,"severity":"critical"},{"id":"GHSA-673q-mjm6-r5xr","feed":"ghsa","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","vendor":"npm","product":"next","date":"2026-10-22","url":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","exploited":false,"severity":"critical"},{"id":"GHSA-7587-9684-52r6","feed":"ghsa","title":"mem0ai Databricks vector store vulnerable to SQL injection","vendor":"pip","product":"mem0ai","date":"2026-10-22","url":"https://github.com/advisories/GHSA-7587-9684-52r6","exploited":false,"severity":"critical","cve":"CVE-2026-115324"},{"id":"GHSA-9v8h-qqgm-4m35","feed":"ghsa","title":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","vendor":"pip","product":"brotli","date":"2026-10-22","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","exploited":false,"severity":"critical"}],"check":{"url":"https://istheinternetok.com/check.json","example":"https://istheinternetok.com/check.json?packages=npm:next@16.3.0,pypi:litellm@1.107.0&products=chrome,windows"},"docs":"https://istheinternetok.com/skill.md"}