//security advisories
Security Advisories
Third-party security incidents that affect compliance programs, with dated guidance on who is affected and what to update.
- Active
- Published:
- Last updated:
Tailworm: Unpatched Tailscale SSH Flaws
Unpatched Tailscale SSH flaws let anyone allowed to SSH in, even as an ordinary user, reach root. Who is exposed, what to change today, and what to watch.
- Active
- Published:
- Last updated:
Device Security Checklist: October 2026 Advisories
What to update on laptops, phones and developer machines after the October 2026 eMudhra, LiteLLM, Node.js and PHP disclosures, and how to check.
- Active
- Published:
- Last updated:
LiteLLM 1.107.0 Supply Chain Compromise
LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer on 21 October 2026. Who is affected, how to check, what to rotate, and indicators.
- Active
- Published:
- Last updated:
GitLab Critical Patch: Remote Code Execution Without Login
GitLab CVE-2026-110264 (CVSS 10) lets attackers run code on self-managed servers without logging in. Fixed versions, version checks and what to do now.
- Active
- Published:
- Last updated:
PHP2Shell: Remote Code Execution in PHP
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on PHP web servers without logging in. Fixed versions, checks and what to do now.
- Active
- Published:
- Last updated:
Node.js October 2026 Security Releases
Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 CVEs, including a Brotli remote code execution bug. Who is affected, what to upgrade, and what changed.
- Active
- Published:
- Last updated:
eMudhra Intermediate CA Private Key Compromise
Eight eMudhra intermediate CA keys were recoverable from their public certificates. What happened, who is affected, and what to update.