If you run any sort of infrastructure, website, self-hosted service, cloud service etc etc etc

it might be a good idea to just have an agent run daily if not hourly scans for any security disclosures that affect those systems, and notify you immediately if any vulnerabilities relevant to you are discovered. The rate at which these critical vulnerabilities are being discovered is insane. You do not want to risk missing a relevant disclosure if you value your security and data.

In the past 24 hours:

GitLab – Critical unauthenticated remote code execution (CVE-2026-110264, CVSS 10.0)GitLab – Critical unauthenticated remote code execution (CVE-2026-110264, CVSS 10.0)

A 12-year-old integer overflow in the Onigmo/regex compiler allows unauthenticated attackers to execute code on self-managed GitLab CE/EE servers under certain conditions. Fixed in 19.5.1, 19.4.3, 19.3.6 and backports (including older branches) released October 21, 2026.
1 2

PHP – Two critical unauthenticated RCEs (“PHP2Shell,” CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) > (This one affected xmrbazaar)PHP – Two critical unauthenticated RCEs (“PHP2Shell,” CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) > (This one affected xmrbazaar)

Out-of-memory handling and stale global state bugs enable remote code execution before application code runs (highest risk on mod_php). Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released October 21, 2026.
1 2

LiteLLM – Malicious v1.107.0 supply-chain compromiseLiteLLM – Malicious v1.107.0 supply-chain compromise

Attackers used stolen release tokens to publish a trojanized package (PyPI wheels and Docker images) containing a credential stealer and remote-code loader that runs on Python startup. Live for roughly two hours on October 21; removed shortly after. Pin to 1.106.2 or earlier.
1 2

eMudhra – Weak intermediate certificate authority keys compromisedeMudhra – Weak intermediate certificate authority keys compromised

Eight intermediate CA private keys (generated with insufficient randomness) were exposed, enabling potential fraudulent certificate issuance and MITM attacks. Keys revoked October 18; browsers (Chrome, Firefox, etc.) blocked them. No certificates had been issued from the affected intermediates.
1 2

Node.js – Multiple high-severity fixes (including Brotli RCE and TLS hostname bypasses)> (This one affected Stasher News)Node.js – Multiple high-severity fixes (including Brotli RCE and TLS hostname bypasses)> (This one affected Stasher News)

October 21 security releases (22.23.4, 24.22.1, 26.12.1) address ~10 issues, including a Brotli decoder out-of-bounds write (CVE-2026-111497) that can permit RCE, plus TLS verification and DNS flaws. Also updates certificates related to the eMudhra issue.
1

WordPress / UpdraftPlus – Stolen UpdraftCentral remote-management keys used for backdoorsWordPress / UpdraftPlus – Stolen UpdraftCentral remote-management keys used for backdoors

Attackers with stolen UpdraftCentral signing keys (from a TeamUpdraft incident) issued authenticated remote commands to install disguised backdoor plugins and hidden admin access on connected sites. Updating the plugin does not stop it; keys must be deleted locally. Activity observed mid-to-late October 2026.
1 2

Plex Media Server – “Plex2Shell” unauthenticated RCE chain (four CVEs)Plex Media Server – “Plex2Shell” unauthenticated RCE chain (four CVEs)

Chain of SSRF, token leakage, and arbitrary file-write flaws (CVE-2026-96652, -96654, -96655, -96656) enables remote code execution as the Plex user. Fixed in 1.43.3.10861 (August); public PoC and in-the-wild exploitation (miners, proxies) reported in October. Added to CISA KEV.
1 2

Tor – Hundreds of exit relays compromised for SSH interceptionTor – Hundreds of exit relays compromised for SSH interception

Attackers (using Ebury backdoor on compromised Linux hosts) controlled 300+ exit relays (peaking at ~7–10% of exit capacity in early October), redirecting SSH traffic to interception servers for password theft and further infection. Relays flagged and removed by Tor Project around October 4–5.
1 2

AI-powered / autonomous attacksAI-powered / autonomous attacks

Multiple reports of AI agents (including combinations of commercial models) autonomously probing and compromising dozens-to-hundreds of sites or cloud environments at scale, reducing time and expertise required.
1 2