Unlisted • Noindex • Daily

The Security AI Briefing

What broke, how bad it is, and what to do about it today.
Vol. III — Security AI Friday, October 23, 2026

Critical Disclosures

Critical • CVSS 10.0 • No exploitation reported

GitLab's second maximum-severity RCE this month: patch again, even if you patched Oct 12

GitLab released critical patches on October 21 for CVE-2026-110264, an integer overflow in its regular-expression compiler that GitLab says could allow an unauthenticated user to execute arbitrary code on a self-managed server under certain conditions. GitLab rates it CVSS 10.0, the maximum. Every self-managed release back to GitLab 7.0, from 2014, is in range. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The trap: the October 12 patch for the earlier regex flaw CVE-2026-97229 shipped as 19.4.2, 19.3.5 and 19.2.8, one patch below the new fixes, so a server patched nine days ago is still exposed. GitLab.com already runs the fix, and GitLab Dedicated tenants on the stated internal releases are covered, so the exposure is self-managed instances. GitLab reports no sign the flaw has been used in attacks, and it is not in CISA's Known Exploited Vulnerabilities catalog as of October 22. Reporting points to GitLab's Org-mode file renderer as the likely path, with a crafted file in a public project as the trigger, but GitLab has held back the precise conditions while operators patch.

Severity: Critical, 10.0. Exploit status: no exploitation reported by GitLab as of Oct 22; no public proof of concept in the reports reviewed. Do today: upgrade self-managed GitLab to the fixed version for its branch and confirm the running version on every host.
Primary-adjacent: The Hacker News, Oct 22, 2026; Rescana, Oct 22, 2026
Critical and high • CVEs withheld until Nov 10 • No exploitation reported

Fortinet ships critical FortiOS patches now and withholds the details for three weeks

Fortinet shipped security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer fixing critical and high-severity flaws found through AI-assisted testing, and told customers to install them before it reveals the flaws. FortiOS fixed versions are 8.0.2, 7.6.8, 7.4.13 and 7.2.14; FortiManager and FortiAnalyzer are fixed in 8.0.2, 7.6.8, 7.4.12 and 7.2.13; FortiMail fixes arrived a day earlier in 8.0.2, 7.6.7 and 7.4.9, and FortiAuthenticator in 8.0.4 and 6.6.11. No CVE identifiers or CVSS scores have been published for the October 22 flaws, and full advisories are due on Fortinet's PSIRT portal on November 10. Fortinet CISO Carl Windsor said the window between disclosure and exploitation keeps shrinking, and that patch diffing lets attackers build exploits in hours or days, which is why the company chose early patching over full disclosure. Critics, including watchTowr, warn the three-week gap gives attackers a playground to reverse-engineer the fixes. As of October 23, neither Fortinet nor the national CERTs checked in the reporting reviewed here reports exploitation of these flaws.

Severity: Critical and high, scores withheld. Exploit status: no exploitation reported as of Oct 23. Do today: patch internet-facing FortiGate, FortiManager and FortiAnalyzer first, and do not wait for the November 10 advisories.
Source (secondary, reporting Fortinet announcement): Cybernews, Oct 23, 2026; Cybersecurity News, Oct 22, 2026
Follow-up • CVSS 9.2 • Exploitation attempts continue

PHP2Shell, day three: Luxembourg's regulator joins the patch call as sites stay offline

Luxembourg's data protection commission, the CNPD, warned on October 23 that the PHP flaws CVE-2026-109618 and CVE-2026-109619 still put internet-facing systems at risk, urging controllers and processors to check exposure and apply the October 21 patches, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, without delay. The warning matters because it reframes patching as a data-protection duty, not just an IT task: unpatched PHP risks the confidentiality, integrity and availability of personal data processed on those systems. If your PHP fleet is not fully patched and restarted by now, treat it as overdue, not in progress, and re-check that restarts actually happened, since a patched binary that was never restarted is still a vulnerable process.

Severity: Critical, 9.2 (unchanged). Exploit status: exploitation attempts observed before and on disclosure day. Do today: verify patch plus restart on every PHP host, and treat any host you cannot verify as unpatched.
Primary source: CNPD Luxembourg, Oct 23, 2026

Supply Chain Watch

npm • Worm in testing • No confirmed victims

A Miasma-family npm worm is being tested in public, with a wiper for token revocation

Between October 19 and 22, npm received 15 packages with names ending in testmetest, from test accounts, carrying a Miasma-family worm that steals credentials, spreads to other packages and repositories, and installs a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. SafeDep reports that four packages were live as of October 22, with event-bus-lite-testmetest version 0.0.1 carrying the worm, and the other eleven having left the registry on October 21. Crucially, SafeDep found no compromised third-party packages or victims as of October 22: all observed activity belongs to the operator's own test accounts. That is good news with a sharp edge, because the worm's infrastructure, loader layout and strings differ from published Miasma signatures, defeating existing detections. For Node shops, the action is detection readiness, not incident response: make sure your registry monitoring catches testmetest-style names and credential-stealing install hooks before the operator graduates from testing to real targets.

Severity: High if it reaches real packages. Exploit status: testing only, no confirmed victims or third-party compromises as of Oct 22. Do today: block and alert on testmetest packages, and audit install hooks in any new dependency.
Source: SafeDep, Oct 22, 2026
Python • Agent SDK • Session leak

Strands Agents SDK flaw let one caller read another caller's conversation history

A flaw in the Strands Agents SDK, tracked as CVE-2026-115419 and disclosed October 23, failed to isolate conversation states between separate callers in multi-tenant environments. The A2A server component, which exposes agents over HTTP, allowed an authenticated remote user to access the private conversation history of other callers and influence model behavior. Fixes are available in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. If you run a multi-tenant agent service on Strands, this is a data-leakage incident in waiting: upgrade, then review whether any tenant's history was accessible across sessions, and treat cross-tenant exposure as a breach-notification question, not just a patch ticket.

Severity: High for multi-tenant deployments. Exploit status: not stated in the report reviewed. Do today: upgrade to strands-agents 1.43.0 or @strands-agents/sdk 1.5.0, and review cross-tenant access logs.
Source (secondary): WiseVoter, Oct 23, 2026
PyPI • Follow-up

LiteLLM, one more detail: the malicious release lived for about two hours

Datadog Security Labs reports the malicious LiteLLM 1.107.0 release was available on PyPI and in official Docker images for approximately two hours before removal, and that this is LiteLLM's second supply-chain compromise in 2026, after versions 1.82.7 and 1.82.8 earlier in the year, with no connection established between the two incidents. The two-hour window is the lesson: a short-lived malicious release still reaches automated installs, CI pipelines and Docker pulls that happen to run in that window, and a version check after removal will show a clean registry while compromised hosts keep running. If your fleet could have installed in that window, the response from yesterday's edition stands: rebuild and rotate, do not just upgrade.

Severity: Critical for exposed hosts (unchanged). Exploit status: credential theft confirmed in reporting. Do today: if you have not already, rebuild any host that could have pulled 1.107.0 and rotate its credentials.
Source: Datadog Security Labs, Oct 2026

AI Offense and Defense

AI offense • Disclosure window

The disclosure-to-exploit window fell from two weeks to four hours, and Fortinet just bet on it

WatchTowr declared in September that the window between vulnerability disclosure and exploitation had fallen from two weeks to four hours, a figure Fortinet cited in its October 22 decision to ship patches before publishing CVE details. The PHP2Shell timeline is the same story in miniature: AI-assisted discovery in August, a leak a day before embargo, exploitation attempts before the patch, and a global patch race within 48 hours. The implication for defenders is that disclosure strategy is now a security control in itself: whether a vendor discloses fully, partially, or late changes how fast attackers can weaponize, and your patching SLA must assume the shortest window, not the vendor's stated one.

Source (secondary): Cybernews, Oct 23, 2026
AI defense • Agent identity

Agent sign-in without passwords, and agent VMs that pause, are the new perimeter

Two October 22 moves, covered in the technical edition, are defense stories first. 1Password's agent sign-in means an agent never holds a password: it presents a digital key, the user approves on their own device, and the manager fills the login. Google's Agent Compute Engine means each agent runs in its own microVM, paused when idle, with memory shared only under the platform's control. Together they describe the perimeter for the agent era: credentials that are borrowed per action, not handed over permanently, and compute that is isolated per agent, not shared by default. If your agents still run on standing credentials in shared environments, both of these are the gap to close.

Source (secondary): Silicon Noon, Oct 22, 2026

Action Checklist

  1. Patch self-managed GitLab today: upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13 for your branch, and confirm the running version on every host. An October 12 patch does not cover CVE-2026-110264.
  2. Patch Fortinet first, details later: upgrade internet-facing FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14, and FortiManager and FortiAnalyzer to 8.0.2, 7.6.8, 7.4.12 or 7.2.13. Do not wait for the November 10 advisories. Until patched, restrict admin access to trusted IPs, keep FortiManager off the internet, and enforce MFA.
  3. Verify PHP patch plus restart: confirm every PHP host runs 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and was actually restarted after patching. Treat any host you cannot verify as unpatched, and check PHP 8.1 and older separately for a distribution or LTS backport.
  4. Upgrade Strands Agents SDK: move multi-tenant agent services to strands-agents 1.43.0 or @strands-agents/sdk 1.5.0, and review whether any tenant's conversation history was accessible across sessions.
  5. Alert on testmetest and install hooks: block and alert on testmetest-suffixed npm packages, and audit install hooks in any new Node dependency before it reaches CI. No victims are confirmed yet, so this is the cheapest time to set the alert.
  6. Finish the LiteLLM rebuild if you have not: any host that could have pulled litellm 1.107.0 during its roughly two-hour window gets rebuilt from a clean image, with every credential it could read rotated.
  7. Replace standing agent credentials: move agents to per-action approval sign-in, as 1Password's model does, and isolate agents in per-agent VMs or sandboxes. An agent with a permanent password in a shared environment is the next credential-theft headline.

The Security AI Briefing — Friday, October 23, 2026. Unlisted edition; not for redistribution.
Researched this morning from public sources. Figures attributed to a company are that company's own claims unless noted. Secondary sources are marked where the primary announcement could not be located.

  1. The Hacker News, “Critical GitLab flaw CVSS 10.0,” Oct 22, 2026
  2. Rescana, “GitLab CVE-2026-110264,” Oct 22, 2026
  3. Cybernews, “Fortinet patch now, CVEs later,” Oct 23, 2026
  4. Cybersecurity News, “Fortinet urges patching,” Oct 22, 2026
  5. CNPD Luxembourg, “Critical PHP vulnerabilities,” Oct 23, 2026
  6. SafeDep, “testmetest npm worm,” Oct 22, 2026
  7. WiseVoter, “Strands Agents SDK vulnerability,” Oct 23, 2026
  8. Datadog Security Labs, “LiteLLM compromise,” Oct 2026
  9. Silicon Noon, “Today in AI, Oct 22, 2026”