Here are today’s top cybersecurity stories for Thursday, October 22, 2026.
Critical GitLab Flaw CVE-2026-110264 Scores CVSS 10.0 and Affects Releases Back to 7.0
GitLab patched an integer overflow in the Onigmo regex engine. Under undisclosed conditions, an unauthenticated user runs arbitrary code on a self-managed server. GitLab.com and GitLab Dedicated already carry the fix. GitLab reports no exploitation, and the flaw is not in the CISA KEV catalog. The Hacker News
LiteLLM Pipeline Compromised to Push Malicious Version 1.107.0
Attackers used stolen developer credentials to publish LiteLLM 1.107.0 to PyPI, Docker Hub, and GHCR. The package carried a credential stealer and a Linux and macOS backdoor. The exposure window ran about two hours for pip installs and about three hours for Docker pulls. LiteLLM traces the root cause to GitHub CLI OAuth tokens leaked into gateway logs. The Hacker News
Railway Reports Intruder Access to Customer Environment Variables
The platform-as-a-service provider disclosed anomalous activity on systems holding customer secrets. An intruder accessed encrypted variables and, in some cases, decrypted contents for a subset of users. Researcher Taylor Monahan reports wallet thefts tied to private keys stored on Railway. Railway urges customers to rotate all credentials. The Hacker News
Microsoft Attributes ConnectWise Supply Chain Attack to China-Linked Storm-0940
Microsoft says Storm-0940 used the ARTEX agentic AI framework for scanning, password spraying, and OAuth abuse against hundreds of organizations since September. The group attempted sign-ins to more than 2,250 tenants. In some cases it reached privileged access in under three hours. The Hacker News
CISA and FBI: SafePay Ransomware Has Hit More Than 600 Critical Infrastructure Organizations
A joint advisory covers activity from November 2024 to August 2026. Victims span North America, South America, Europe, and Australia. SafePay gains access through exposed credentials, brute-force attacks, VPN exploitation, and edge device flaws, then deletes shadow copies and resets NAS backups. BleepingComputer
INTERPOL Operation Serengeti III Yields 1,462 Arrests Across 21 Countries
Law enforcement disrupted 10,909 malicious networks between June 29 and August 31. Authorities recovered more than $105 million and identified 65,929 victims. Cases covered investment fraud, business email compromise, phishing, and illegal crypto mining. The Hacker News
Node.js Fixes 10 Flaws, Including Brotli Decoder Bug CVE-2026-111497
The out-of-bounds write in the bundled Brotli decoder allows remote code execution in all supported lines. Fixed versions are 22.23.4, 24.22.1, and 26.12.1. Node.js 20.x and earlier are end-of-life and receive no fix. No in-the-wild exploitation is reported. The Hacker News
Oracle Ships 1,295 Fixes in October 2026 Critical Patch Update
Tenable counts 1,209 unique CVEs, with 95 rated critical. Fusion Middleware received 206 fixes, and 134 of them are remotely exploitable without authentication. Oracle has not flagged any of the flaws as exploited. SecurityWeek
Kaspersky Links Lazarus FlashHole Campaign to Post-Quantum Encryption
The North Korean group protects payload delivery with ML-KEM-1024 in attacks on South Korean software, construction, and equipment makers. The chain abuses INISAFE CrossWeb EX and ends with the Cubridge backdoor. Attacks began in July 2025. BleepingComputer
Japan’s Onamae Desktop Cloud Hacked, Up to 26,739 Servers Affected
GMO Internet’s VPS service confirmed an intrusion on October 20 and shut down customer servers on October 21. An unauthorized party installed malicious programs in some environments. Payment data sits on separate infrastructure and is reported unaffected. BleepingComputer
Stay tuned for today’s in-depth analysis posts.
