From our professionals

Client Advisory: The Keys Are the Target

In a single day, a hosting platform told its users to rotate every secret, a popular AI library shipped a credential stealer, and PHP rushed out fixes for flaws attackers were already probing.

One-page Founder Advisory (PDF, 61 KB)

Client advisory, October 22, 2026, updated October 26. Based on public reports as of October 26. Details are still moving, so check each vendor's own advisory before you act.

On Wednesday, October 21, three things broke within hours of each other. Railway, a cloud platform developers use to deploy apps, said an intruder may have read customers' stored secrets, and it told every user to rotate them. LiteLLM, a widely used open-source gateway for calling AI models, found that a poisoned release had gone out through its own engineers' GitHub accounts, carrying a credential stealer and a backdoor. And the PHP project, whose language runs WordPress and much of the web, shipped emergency fixes for two critical flaws that attackers had begun probing before the patches were out.

These are separate attacks, but they point the same way. Attackers are going after the places where many companies' keys sit together: deployment platforms, developer tools, code hosts and the cloud apps a company has already let in. Railway says it believes its breach is part of a series of attacks on platform companies "with the aim of compromising AI inference providers." Break one platform and you collect thousands of keys at once.

What follows is what to do, in order.

Do this today

If you deploy on Railway, rotate every secret stored there. That includes API keys and database and registry passwords. Then read the logs of the services those secrets unlock and look for access you don't recognize. Railway paused deployments while it investigated; builds resumed on October 22. It has posted guidance on checking AWS and Google Cloud accounts for strange activity. On October 24, OpenAI and Anthropic revoked some keys as a precaution, including replacements customers had only just rotated. If one of yours stopped working, issue a new one and redeploy.
Find out whether anything installed LiteLLM 1.107.0 or tensorlake 0.5.144. Check laptops, servers, containers and CI jobs, whether LiteLLM came from PyPI or Docker. The bad LiteLLM code runs as soon as Python starts, before LiteLLM is even imported. It gathers cloud tokens, private keys, AI tool credentials, browser data and environment variables, and it leaves a backdoor that checks in every hour for new orders. If you find it, treat every credential that machine could reach as stolen, rotate them from a clean machine, and pin version 1.106.2 by digest. The npm package tensorlake 0.5.144, poisoned on October 8, steals keys too, and it watches the GitHub token it took: if that token is revoked, it deletes the home folder. On a machine that ran it, back up what you need and stop its gh-token-monitor service before you revoke anything, then pin 0.5.143.
Patch PHP. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Every PHP install that serves web pages is exposed, and Amazon says PHP2Shell "is now seeing broad exploitation attempts in the wild." If your marketing site runs WordPress or another PHP app on a managed host, ask the host in writing whether it has patched. For PHP 7.4 to 8.1 the PHP project has published source-code fixes but no new releases, so get a patched build from your vendor or upgrade; anything older must be upgraded.
Upgrade self-managed GitLab. A flaw rated 10.0 (CVE-2026-110264) can let someone with no account run code on the server, under conditions GitLab has not spelled out, in every version back to 7.0. GitLab has seen no attacks yet and offers no workaround. GitLab.com is already fixed.

Do this week

Fence in your AI keys. Railway's statement, and a breach at OpenCode days earlier that may have exposed AI provider keys for 1.4% of its Console users, suggest that AI provider keys have become a prize in their own right. Give each service its own key, so you can revoke one without breaking the rest. Set hard spending limits and usage alerts with every AI provider you pay. Look over the last month of usage for spikes you can't explain.

Clean up GitHub. LiteLLM says its poisoned release went out through three engineers' accounts, apparently using stolen GitHub CLI tokens: one account started the release and another approved it. Separately, a campaign called GhostAction took over about 1,900 GitHub accounts and pushed secret-stealing workflows at more than 30,000 repositories, with a spike on October 8 and 9. Look for workflow files nobody on your team wrote; they tend to carry harmless names such as security-audit.yml. Once you have checked for tensorlake, revoke old personal access tokens and CLI sessions, move to fine-grained tokens with expiry dates, and turn on secret scanning with push protection. Rotate any secret that ever sat in a repository or a build log. Some GhostAction victims were hit more than once because they hadn't.

Review the apps you have already trusted. Microsoft disclosed on October 21 that a China state-aligned group it calls Storm-0940 used the identities of ConnectWise cloud applications to sign in to customer environments. It worked, Microsoft says, by "taking advantage of the already established trust by these apps within a tenant." In Microsoft Entra or the Google Workspace admin console, list every third-party app that can reach your company's data. Remove the ones nobody uses and trim the permissions on the rest.

Patch the network edge. Several products that sit at the edge of company networks are under active attack, and some have been for weeks:

Palo Alto Networks firewalls: CVE-2026-0322, in the management interface, fixed October 15. Palo Alto's Unit 42 also reports that ransomware groups are now using an older GlobalProtect flaw, CVE-2026-0257.
Cisco Secure Email Gateway: CVE-2026-76519, rated 9.8 and under attack. On gateways with File Reputation turned on, a crafted attachment can lead to root access.
Fortinet FortiMail: CVE-2026-104286, rated 9.8 and exploited before a fix shipped. FortiMail Cloud is already fixed.
Fortinet FortiOS, FortiManager and FortiAnalyzer: Fortinet released security updates on October 22 and will publish the details on November 10. Install them before then, when attackers can study what changed.
Ivanti Connect Secure: CVE-2026-104935, exploited since early October. CISA warns that Ivanti's own integrity checker may miss signs of a break-in, and its recovery steps start with a factory reset.
BeyondTrust Remote Support: CVE-2026-102764, exploited since late August by a suspected China-nexus espionage group. Cloud customers were patched on October 8. Self-hosted appliances need the patch applied by hand unless automatic updates are on.

Wherever you can, keep management interfaces off the open internet.

Let every device update. Eight certificate-authority keys belonging to eMudhra, an Indian certificate authority, could be guessed, so a fake site or signed program could pass as genuine. Browsers and operating systems now block them through normal updates, so turn updates on wherever they are off; servers and apps need fresh certificate stores too. Chrome removes the emSign ECC Root CA - G3 on October 27, so any site with a certificate from it needs a new one.

Catch up on application and desktop patches. Next.js shipped an out-of-band fix on October 14 for two critical code-execution flaws; upgrade to at least 16.4.1 or 15.5.28. Two of that day's three advisories did not reach the feed that npm audit reads, so a clean audit report does not mean you are covered. Node.js shipped fixes on October 21 for a flaw in its Brotli decompression (CVE-2026-111497) that can let crafted data crash a service or run code; update to 22.23.4, 24.22.1 or 26.12.1. Microsoft's October update fixed more than 1,400 flaws, including a Windows Shell bug (CVE-2026-96951) that attackers are using to slip past Mark of the Web warnings.

The pattern

Each of these breaches ran through something a company had chosen to trust: a hosting platform, a library, a code host, a vendor's cloud app. For a startup that is a sound trade. Nobody wants to run their own build servers. But the trade has a cost, and it comes due on days like October 21. A company that can rotate every secret it holds in an afternoon has a bad day when its platform is breached. A company that doesn't know where its secrets live has a bad month.

The habits that make the difference are plain. Write down where every secret lives and how to rotate it, before you need to. Prefer credentials that expire, so a stolen copy goes stale on its own. Give each key only what it needs: a key that can read one storage bucket is a nuisance when it leaks, while an admin key is an incident.

If you want help

Our security practice helps companies work through lists like this one without breaking production: finding where secrets live and rotating them without taking anything down. Clients can reach their Nonlinear team directly. Anyone else can write to info@nonlinearadvisors.com.

This advisory is general information drawn from public reports as of October 26, 2026. It is not advice about any particular system.

Sources

All insights