The stories below range from compromised package releases to urgent updates, but the operational question stays the same: if attackers get access, what can they reach next?
5.1 million PHP hosts potentially exposed, according to a cited estimate. 1 hour 43 minutes for malicious LiteLLM packages to remain available. Up to 400,000 WordPress sites potentially exposed, based on an estimate. 321,810 Zeabur accounts involved in a reported incident. CVSS 10.0, the maximum severity rating, for a GitLab flaw.
Weekly cybersecurity news for SMBs: when attackers get the keys
Railway tells users to rotate stored secrets
Cloud platform Railway warned that an unauthorized party may have accessed some encrypted environment variables and obtained the decrypted contents of some of them. Those variables can hold API keys, database passwords, and other credentials. Railway urged users to rotate secrets and check logs for suspicious activity. The number of affected users has not been confirmed.
If your team uses Railway, follow the vendor’s advice: rotate credentials stored on the platform, then check the services those credentials can reach. A key is only “just a key” until someone uses it to walk through a door.
Stolen UpdraftCentral keys used against WordPress sites
Attackers reportedly used stolen UpdraftCentral connection keys to install malicious plugins and create administrator accounts on connected WordPress sites. TeamUpdraft said an attacker accessed its website and may have reached customer data that included those keys.
BleepingComputer estimated that up to 400,000 websites could be exposed, based on an estimate about sites using UpdraftPlus and having a relevant connection or Migrator key. That is a potential exposure estimate, not a confirmed victim count. WordPress site owners using UpdraftCentral should check the vendor guidance, update, review their keys, and look for unexpected admin accounts or plugins.
A remote-management key can turn a supplier’s security problem into your website’s security problem. Check the connection, not just the plugin.
LiteLLM’s compromised release carried credential-stealing malware
A compromised release pipeline pushed malicious LiteLLM version 1.107.0 to PyPI, alongside compromised Docker images. The package targeted credentials, secrets, and environment variables across Windows, Linux, and macOS. The affected PyPI packages were available for about 1 hour and 43 minutes.
If your team installed that version or used an affected image, treat the system as potentially compromised. The project’s recovery guidance, relayed by BleepingComputer, calls for isolating affected systems, rebuilding them from clean sources, and rotating exposed secrets. Don’t casually launch Python on a suspect machine to “take a quick look.” In this case, even routine startup could trigger the malware.
Zeabur reports exposure of account and environment-variable data
Hosting provider Zeabur said attackers used leaked internal credentials to access its infrastructure and production database. The company reported that information for 321,810 accounts and about 3.2 million environment-variable records were involved. It also announced plans to wind down the service by the end of 2026.
Customers should treat stored credentials as potentially exposed, rotate them, revoke active sessions, and make a migration plan. The company’s reported figures describe the data involved, not necessarily the number of people whose secrets were successfully used. See the incident report for the latest details.
Patch notices worth moving up the queue
Emergency PHP patches address two critical flaws
The PHP security team released fixes for two unauthenticated remote-code-execution vulnerabilities, tracked together as PHP2Shell. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. BleepingComputer cited an estimate of more than 5.1 million PHP hosts potentially exposed online. That’s an estimate of reachable hosts, not confirmed victims.
If your website or application runs PHP, check the version on the server and apply the appropriate fix. The PHP advisory coverage says older, unsupported releases need particular attention. A web application firewall may buy time, but it is not a substitute for patching.
GitLab fixes a maximum-severity flaw in self-managed servers
GitLab patched CVE-2026-110264, an unauthenticated code-execution vulnerability rated CVSS 10.0. It affects self-managed installations, including releases dating back to version 7.0. GitLab said it had no evidence of exploitation at the time of reporting.
If you host GitLab yourself, check the exact release and upgrade to a fixed version. GitLab.com already runs the fix, according to The Hacker News. A source-code server can hold valuable credentials and deployment access, so this is one to put near the top of the patch list.
CISA adds exploited Plex flaws to its KEV catalog
CISA added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws were reportedly chainable to achieve unauthenticated remote code execution, and Plex addressed them in version 1.43.3.10861.
Running Plex for a business? Check the version and whether the server is reachable from the internet. The federal patch deadlines mentioned in the report apply to U.S. federal agencies, not most private businesses. The KEV listing still makes this a timely check for anyone running the software.
Quest Diagnostics investigates access to its Quanum LSM system
Quest Diagnostics said it learned of unauthorized access to Quanum LSM on October 21. Some patient records may have been exposed, but the company had not confirmed the affected data types or number of people at the time of reporting. Quest said customer-facing operations had not been disrupted and gave some users alternate ordering instructions while the system was paused.
Healthcare organizations that use Quanum LSM should monitor Quest’s updates and follow its temporary operating guidance. The report does not establish the scope of the potential data exposure, so there’s no value in guessing. Keep a record of the steps your team takes while the investigation continues.
Oracle’s quarterly update covers more than 1,200 vulnerabilities
Oracle’s October Critical Patch Update included fixes across dozens of products. SecurityWeek’s analysis counted 1,209 CVEs and 95 critical-severity flaws. Oracle had not identified any of the vulnerabilities in that update as exploited in the wild.
This is a broad maintenance story, not a claim that every Oracle customer is under active attack. If your business uses Oracle products, including MySQL or Java, identify which updates apply to your environment and prioritize systems exposed to the internet or holding sensitive data. SecurityWeek’s breakdown has the figures and product details.
The practical takeaway: know what can reach what
Credential rotation, patching, and vendor updates can sound like separate chores. They’re really one question: if this account, package, or service is compromised, what can it reach next? Keep an inventory of your critical services, know where their secrets are stored, and make sure someone owns the job of applying urgent fixes.
If you’re not sure which vendor alerts matter most to your business, start with the systems that hold customer data, run your website, or connect to cloud and payment services.
Book a 15-minute security check
We’ll help you identify the first systems and credentials to review, with no obligation.