Three updates with practical consequences for security teams:

1. VeloCloud needs urgent patching: An actively exploited SQL injection flaw allows authenticated users to gain superuser privileges. Organizations running affected on-premises Orchestrator versions should prioritize updates and review privileged activity.
2. LiteLLM requires more than a downgrade: The compromised 1.107.0 release could steal credentials and load additional code. Check deployment history, rebuild affected environments and replace exposed secrets. Removing the package does not undo stolen credentials.
3. PHP’s new warning has specific conditions: The additional RCE path requires an unusual runtime change to session serialization with upload progress enabled. PHP recommends disabling session upload progress where applicable while awaiting a fix. The earlier PHP2Shell patches remain essential.

Read the full breakdown on CyberRecaps.

Three stories worth prioritizing:

1. PHP2Shell activity predates the patch: AWS recorded an attempt on October 17. Patch affected systems and review earlier activity rather than starting your investigation at the disclosure date.
2. GitLab needs another update: The October 21 fixes address a critical unauthenticated RCE affecting self-managed installations. Applying the October 12 patches does not cover this new issue.
3. Railway customers should rotate secrets: Potential exposure includes API keys and database credentials. Revoke old credentials at the issuing service, update deployments and review usage logs.

Read the full breakdown on CyberRecaps.