The October 2026 security meltdown, for app builders
The October 2026 incidents sorted by what an app builder owns: keys held on platforms, runtimes, packages and the website. Checked 24 October 2026.
Founder, Newly
Published Last updated
Most of the October 2026 incidents do not run on the phone. They hit the places behind your app: platforms that store your keys, packages you install, the runtime on your server and the website beside the app. As of 24 October 2026, an app builder's work is to rotate keys held on affected platforms, update runtimes, and check what the project exposes.
What happened in October 2026, and which parts touch my app?
This page is the app builder's companion to the October 2026 security meltdown tracker on red.run.cloud, which follows each incident for site and server owners. Here the incidents are sorted by what you own. Every fact comes from the vendor or government notice linked beside it, checked on 24 October 2026. Where a vendor describes its own breach, the table says so.
| Incident | Date | What the source says | What you do |
|---|---|---|---|
| PHP2Shell | 21 Oct | Two flaws in PHP itself (CVE-2026-109618, CVE-2026-109619), CVSS v4 9.2, remote code execution without logging in. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 per the PHP advisory. | Ask your host which PHP serves your website. |
| Node.js | 21 Oct | Security releases with four CVEs rated high, one of them a Brotli decoder flaw that permits remote code execution (CVE-2026-111497). Fixed in 22.23.4, 24.22.1 and 26.12.1. The Node.js notice does not mention active exploitation. | Run node --version everywhere Node runs. |
| LiteLLM 1.107.0 | 21 Oct | The maintainer says malicious PyPI packages were live for about two hours and Docker tags for longer, and that releases before 21 October were unaffected, per its incident report. | If a host ran it, rotate every key that host could reach. |
| Railway | 21 Oct | The vendor says an unauthorized party may have accessed encrypted environment variables and decrypted some, per its disclosure. | Roll every variable stored there, then redeploy. |
| Zeabur | 14-15 Oct, report 19 Oct | The vendor says the attacker read its platform database, including about 3.2 million environment variable records, per its report. | Replace every credential stored there, database passwords included. |
| TiDB Cloud | 9 Sep to 7 Oct, report 19 Oct | PingCAP reports an intrusion into its own systems and asks customers to rotate API keys, per its update. | Replace management API keys as a precaution. |
| GitLab | 21 Oct | CVE-2026-110264, CVSS 10.0, fixed in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 per the GitLab patch notice. | Only if you run GitLab yourself: upgrade to the fixed release of your line. |
Other October incidents, such as a media server, Tor relays and a certificate authority, concern other readers and are covered on the red.run.cloud tracker.
Where does each incident sit around an app built with AI?
Newly builds a real iPhone and Android app with React Native and Expo, and you can download the code or connect your own repository. That makes the backend, the hosting and the keys decisions you can inspect. The phone app is the least exposed place on the map and also the least private one. Expo's documentation says the values behind EXPO_PUBLIC_ names are visible in plain text in the compiled app, so only public values belong there.
The platform column is where October hurt most. A hosting platform stores your environment variables so your server can read them, which means a breach of the platform is a breach of every key you stored there. Nothing in your app code caused it, and nothing in your app code fixes it. The fix is to replace the keys.
Which keys do I rotate, and in what order?
If your project's variables sat on Railway or Zeabur, or a LiteLLM 1.107.0 host could read them, treat each one as exposed. Railway, Zeabur and LiteLLM all tell customers to rotate, and the red.run.cloud guide to rotating secrets after a breach covers the general method.
| Key | Where it may have been read | What to do |
|---|---|---|
| AI provider key | Platform variables, a LiteLLM proxy database, or the bundle if it sits behind EXPO_PUBLIC_ | Create a new key in the provider console, switch the server, revoke the old one. Railway says it asked inference providers to revoke keys; do not wait for that. |
| Database password | Platform variables | Change it inside the database. Zeabur states that changing an environment variable does not change the password in the database. |
| Supabase secret key | Platform variables, or the bundle by mistake | Supabase says a secret key bypasses every Row Level Security policy and never belongs in a shipped app. Replace it as in the Supabase key guide. |
| Platform tokens | The platform itself | Railway invalidated all its API tokens on 22 October at 04:39 UTC, per its status page. Create new ones. Zeabur and TiDB Cloud ask for the same. |
| Registry and GitHub tokens | Railway | Revoke at GitHub, create a replacement, reconnect and redeploy. |
The order that avoids an outage
- List every key stored on the platform or reachable by the host.
- Create a replacement for each one before touching the old one.
- Put the replacements into the app or server and redeploy.
- Test sign-in, payments and any AI feature.
- Revoke the old keys. Supabase warns that deleting a secret key cannot be undone.
- Read provider logs and bills from the incident dates: Railway from 21 October, Zeabur from 14 October.
Removing is not rotating
Deleting a key from your code or your settings leaves it working at the provider. Only revoking it there ends its use. If you cannot tell whether a key was read, mark it unknown and rotate it anyway.
Do the Node.js and PHP fixes matter if my app runs on a phone?
The app on the phone runs neither. Your build machine, CI runners, container images and server code may run Node.js, so check node --version in each place. The fixed releases are 22.23.4, 24.22.1 and 26.12.1.
PHP matters if the website in front of your app runs WordPress, WooCommerce, Drupal or Laravel. The flaws are in PHP, so updating the CMS or its plugins does not fix them. The UK NCSC alert tells organisations to find every PHP installation, update, use the temporary mitigations if they cannot, and consider taking systems offline as a last resort. At our check on 24 October 2026, CISA's Known Exploited Vulnerabilities catalog did not list the two PHP CVEs or the GitLab and Node.js ones. That absence is not evidence in either direction.
On shared hosting you usually cannot patch PHP yourself. Send your host the questions in what to ask your provider, and read the PHP2Shell page. Kinsta and WP Engine customers can see Kinsta and WP Engine. A version number read from outside is a hint, because a vendor can backport a fix under an older number.
Which accounts hold the keys to everything else?
The joint advisory AA26-293A, released 20 October 2026 by CISA, the FBI and partners, describes the SafePay ransomware group and says it has affected at least 600 separate victims across critical infrastructure sectors. It lists stolen credentials, VPN weaknesses and phishing as ways in, and multifactor authentication among its mitigations. The same routes apply to a small team: one stolen login to your hosting, database or GitHub account reaches every key behind it. If something did hit you, see the red.run.cloud incident response playbook; agencies can use the client triage page.
What changes if my app has an AI feature?
An AI gateway such as LiteLLM concentrates provider keys in one place, which is why a poisoned release there matters beyond one app. The maintainer's report says the compromised packages ran code when Python started, so the fix was to rebuild the environment from scratch and pin 1.106.2 or another earlier release, then rotate everything the host could read. To check, look at pip show litellm, your lockfile and the image digests you deployed.
Three entries on the OWASP Top 10 for LLM Applications are the closest fit: LLM03 Supply Chain, LLM06 Excessive Agency and LLM10 Unbounded Consumption. In practice that means pinning versions of AI packages, giving an agent no more access than its user, and limiting requests per user. AI inside a Newly app uses credits, so an endpoint anyone can call lets a stranger spend them.
If your app talks to MCP servers, the specification's security best practices say a server must not accept tokens that were not issued for it, and recommend starting with minimal scopes. For a step-by-step review of a chat feature, use the chatbot self-test. For the wider checklist, use the 15-minute check; the security hub lists the rest. For package risk, red.run.cloud has an npm worm check.
Where do you stand?
Mark each item. Everything starts as unknown, because that is what an unchecked item is. Move an item to confirmed only when you hold the evidence listed under it.
Your October 2026 check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Was my app affected by these incidents?
Each incident is tied to a named service or version. An app is in scope only if its project, its servers or its build machines used one of them, for example variables stored on Railway or Zeabur, a LiteLLM 1.107.0 host, or a Node.js version below the fixed release. List the services you connected, compare them with the table near the top, and mark anything you cannot check as unknown.
I rotated my keys after a vendor email. Is that enough?
It is the main step. Two follow-ups remain. A database password lives inside the database, so changing an environment variable does not change it (Zeabur says this in its report). Then read your provider logs and bills from the incident dates, because a quiet bill proves little and an old key that was never revoked still works.
If my provider bill looks normal, were my keys left alone?
Treat it as unknown. A normal bill shows that nothing large happened so far. It does not show that nobody read the key. Rotation is cheap and logs may not record who read a variable, so rotate first and read the logs second.
Do I need to update Node.js if I only build a mobile app?
Update it anywhere Node runs for you: your laptop, CI runners, container images and any server code. The phone app does not run Node.js. Check node --version in each place and move to 22.23.4, 24.22.1, 26.12.1 or later in your line.
Should I move off Railway or Zeabur?
This page makes no recommendation about vendors. Zeabur has announced that it is winding down between 1 and 31 December 2026, so anything hosted there needs a migration plan and a backup. Railway's status page shows all tiers operating normally on 23 October 2026 and notifications to affected workspaces completed that day, with its investigation still ongoing.
Can the free scan on red.run.cloud tell me if I am affected?
Only in part. The free scan reads the stack your public site serves and matches versions to known vulnerabilities. It cannot see keys stored on a platform, a LiteLLM install on a build machine, or a fix your host backported. Those stay unknown until you hold owner evidence.
Sources
- PHP security advisory, October 21, 2026, php.net
- Critical security issue affecting PHP, UK National Cyber Security Centre
- October 21, 2026 security releases, nodejs.org
- Security incident, October 21, 2026, LiteLLM
- Security disclosure, Wednesday October 21st, Railway
- Railway incident status page, Railway
- October 2026 security incident report, Zeabur
- Zeabur is shutting down, Zeabur
- Security update, October 2026, PingCAP
- Patch release GitLab 19.5.1 (CVE-2026-110264), GitLab docs
- Joint advisory AA26-293A, SafePay ransomware, CISA, FBI and partners
- Known Exploited Vulnerabilities catalog, CISA
- Environment variables in Expo, Expo docs
- Row Level Security, Supabase docs
- Understanding API keys, Supabase docs
- OWASP Top 10 for LLM Applications 2025, OWASP GenAI Security Project
- Security best practices, Model Context Protocol specification (draft)