Wednesday, October 21, 2026 delivered four separate security stories inside a single UTC day: emergency PHP fixes for the flaws nicknamed PHP2Shell, a Node.js security release, a booby-trapped release of the LiteLLM AI proxy, and a breach disclosure from the cloud platform Railway. TechCrunch summed it up in one line: “The internet is having a bad day, from a cybersecurity perspective.” This page puts the October 21 2026 cyberattacks, patches and alerts on one clock so you can see what happened when, and what each one asks you to do.
Where it stands: When Data Breach Radar re-checked CISA’s Known Exploited Vulnerabilities (KEV) feed early on Oct. 22, the newest catalog was still 2026.10.21 (published Oct. 21, 14:04 UTC), and it listed neither PHP2Shell CVE nor any of the Node.js fixes. KEV is CISA’s public list of flaws it knows attackers have used. LiteLLM 1.107.0 had been pulled from PyPI, and Railway’s own notice said all deployments were paused while it investigated.
What were the October 21 2026 cyberattacks and patches?
Only two of the four were attacks in the plain sense. LiteLLM was a supply-chain compromise (a malicious build pushed to a package registry), and Railway reported unauthorized access involving the systems that hold customer secrets. PHP2Shell and Node.js were patch releases for vulnerabilities, which are weaknesses that have not necessarily been used by anyone.
Treating them as a single “attack” would be a mistake. The fix for each one is different, and so is the urgency.
The day by the clock (UTC and ET)
Times below are as the cited source gives them, in UTC. The Eastern Time conversions (EDT, four hours behind UTC) are ours.
| Time UTC (ET) | What happened | Source |
|---|---|---|
| 07:24 (3:24 a.m.) | Railway opens a “Railway Platform Outage” incident | Railway status page |
| 07:41 (3:41 a.m.) | Chainguard publishes images with the PHP fix before the embargo ends | PHP Foundation |
| 11:39-11:40 (7:39-7:40 a.m.) | PyPI receives the malicious LiteLLM 1.107.0 upload | GitHub issue #47826 |
| 13:23 (9:23 a.m.) | LiteLLM 1.107.0 is gone from PyPI | GitHub issue #47826 |
| 13:30 or 14:00 (9:30 or 10:00 a.m.) | PHP ships 8.5.12 and 8.4.27, plus 8.3.36 and 8.2.35 | CERT-EU says 13:30; PHP scheduled 14:00 |
| 14:04 (10:04 a.m.) | KEV catalog 2026.10.21 published, no PHP or Node entries | CISA KEV feed |
| 15:20 (11:20 a.m.) | CERT-EU Security Advisory 2026-018 | CERT-EU |
| 21:59 (5:59 p.m.) | Railway tells users to revoke all stored environment variables | Railway status page |
| Date only | Node.js releases v22.23.4, v24.22.1, v26.12.1 | Node.js Project |
| Date only | CISA alert; government sites taken offline in Europe | CISA; ABC/Reuters |
PHP2Shell: patches, warnings and sites switched off
PHP2Shell is the nickname for a pair of PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. CVE numbers are the standard public IDs for known vulnerabilities. The PHP project says the four new releases “fix two critical vulnerabilities that can allow unauthenticated remote code execution”, meaning an outsider with no login could run code on the server.
The release itself had been pulled forward. PHP’s own advance notice set it for “Wednesday, 21 October 2026 at 14:00 UTC”, after the two CVE IDs started circulating online the previous afternoon. Hours before the release, at 07:41 UTC, Chainguard put out fixed images, which the PHP Foundation describes as breaking the embargo. Our PHP2Shell patch guide covers the versions in detail.
Official warnings followed the patch. CISA said it “has not observed exploitation of these vulnerabilities as of the time of publication”, while CERT-EU published its advisory at 15:20 UTC. Several European governments did not wait: per ABC, citing Reuters, agencies in the Netherlands and Finland “took sites offline ahead of the fix as a precaution”, and France did the same for local government sites. We explain those choices in why governments took websites offline.
PHP’s advisory adds one sentence every site owner should read twice: “There are no complete mitigations, updating is the only safe choice.”
Node.js: a scheduled security release, not a breach
On the JavaScript side, all three supported Node.js release lines got patched releases that Wednesday. The project says the most serious issue it fixed is rated HIGH. TechCrunch called it “a security surprise”, reporting that four high-severity vulnerabilities were patched. The fixed versions are v22.23.4, v24.22.1 and v26.12.1.
Nothing in the Node.js advisory describes a leak, a breach or attacks in the wild. Our Node.js security release explainer goes through the individual CVEs.
LiteLLM: a poisoned Python release on PyPI and Docker
LiteLLM is a Python tool, not a Node.js one. Aikido Security reported that its 1.107.0 release was “found to be compromised by an attacker who injected malicious code into its published Python wheels on PyPI”, and that the matching official Docker image was affected as well.
According to a public GitHub issue filed by an outside reporter, PyPI took the upload between 11:39:51 and 11:40:13 UTC, and a status note on that issue logged its removal from PyPI at 13:23 UTC. Anyone who installed or pulled that version should treat the machine as compromised; our LiteLLM checklist lists what to look for.
Railway: customer secrets possibly read
Railway’s status page opened an outage incident at 07:24 UTC. In its disclosure, Railway said a third party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” Environment variables are where apps commonly keep passwords and API keys.
At 21:59 UTC Railway told customers to revoke every environment variable stored on the platform, including API keys and private registry credentials, and said it would email affected accounts directly.
Were the four incidents connected?
No source we found ties them together. TechCrunch, which rounded up the day, wrote that “the issues were unrelated to each other”, while noting their back-to-back arrival stretched security teams. They involve different software, different vendors and different failure types, and nobody has attributed them to one actor.
Same week, different day
Several stories from the surrounding days often get folded into “October 21” coverage. They belong to other dates:
- eMudhra certificates: per The Register, Mozilla received a report on Oct. 17 at 20:06 UTC that private keys for eight eMudhra intermediate certificates were compromised. Node’s Oct. 21 release shipped a related certificate update.
- BeyondTrust: BleepingComputer reported on Oct. 16 that a Remote Support flaw had been exploited as a zero-day (a bug attacked before a fix existed) since late August.
- Plex2Shell: TechCrunch noted attackers had been exploiting four patched Plex Media Server flaws; CISA’s KEV entries for them are dated Oct. 20.
What to do today
- PHP sites: confirm your host is on a fixed release for your branch (for example 8.3.36 if you run 8.3), or a vendor build that carries the fix. Updating WordPress or plugins does not change the PHP runtime.
- Node.js apps: move to v22.23.4, v24.22.1 or v26.12.1. End-of-life lines get no fixes.
- LiteLLM users: check lockfiles, images and build logs for 1.107.0, then rotate any cloud and AI-provider keys that machine could reach.
- Railway customers: revoke and reissue the variables Railway held, then review service logs, as Railway advised.
The CISA KEV catalog that went live at 14:04 UTC on Oct. 21 was still the current version on Oct. 22, with its newest additions dated Oct. 20.
Frequently Asked Questions
What happened in cybersecurity on October 21, 2026?
Four separate stories landed on the same Wednesday: PHP released emergency fixes for the PHP2Shell flaws, Node.js published security releases for its 22.x, 24.x and 26.x lines, version 1.107.0 of the LiteLLM Python package was found compromised on PyPI and Docker, and Railway disclosed that environment variables may have been accessed.
Were the PHP2Shell, Node.js, LiteLLM and Railway incidents connected?
No source links them. TechCrunch, which grouped the day’s incidents, wrote that they were unrelated to each other. They involve different software, different companies and different kinds of problem: two patch releases, one poisoned package and one platform intrusion.
Was Node.js hacked or leaked on October 21?
No. Node.js shipped a scheduled security release that fixed vulnerabilities, with the highest severity rated HIGH. No source reports a Node.js breach, a leak of its bug details, or exploitation of the fixed flaws.
Is PHP2Shell on the CISA KEV list?
Not as of the catalog version released on October 21 at 14:04 UTC, which was still the current version when Data Breach Radar re-checked the feed early on October 22. CISA’s alert said it had not observed exploitation at the time it was published.
What should I update first?
Whatever you actually run that faces the internet. For PHP that means a fixed runtime, such as 8.5.12 on the newest branch or 8.2.35 on the oldest supported one; for Node.js, v22.23.4, v24.22.1 or v26.12.1; LiteLLM users should confirm they never installed 1.107.0; Railway customers should follow Railway’s advice to revoke stored environment variables.
Sources
- The internet is having a very bad cybersecurity day — TechCrunch (Sarah Perez), October 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update now — PHP.net (PHP security team), October 21, 2026
- Today’s PHP Security Release, and How We’re Strengthening PHP Security — The PHP Foundation, October 21, 2026
- Critical Vulnerabilities in PHP Require Immediate Patching — CISA, October 21, 2026
- Critical Vulnerabilities in PHP (Security Advisory 2026-018) — CERT-EU, October 21, 2026
- CISA Catalog of Known Exploited Vulnerabilities (JSON feed) — CISA, October 21, 2026 (catalog version 2026.10.21; re-checked October 22)
- Wednesday, October 21, 2026 Security Releases — The Node.js Project, October 21, 2026
- LiteLLM compromised again: infostealer and RAT found in version 1.107.0 — Aikido Security, October 21, 2026
- [SECURITY] litellm 1.107.0 compromised (GitHub issue #47826) — GitHub issue on BerriAI/litellm (opened by LidorMachluf), October 21, 2026
- Security Disclosure: Wednesday October 21st — Railway, October 21, 2026
- Railway Platform Outage — Railway status page, October 21, 2026
- Australian government sites among those exposed to ‘critical’ PHP software flaw — ABC News (Australia), with Reuters, October 22, 2026 (AEDT)
- Indian certification authority eMudhra’s private keys compromised — The Register (Simon Sharwood), October 20, 2026
- BeyondTrust patches zero-day exploited in attacks since August — BleepingComputer (Sergiu Gatlan), October 16, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.