OhShit! Security incidentsEvery security incident on the internet, graded by stench, each with a clean-up guide. Open data, MCP, JSON API and RSS.https://ohshit.app/[L5 Shitstorm] PHP2Shell: two critical PHP core RCEs leak a day before the patch, and nearly every PHP back to 5.4 is in the bowlhttps://ohshit.app/incidents/php2shell/https://ohshit.app/incidents/php2shell/CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2) give remote code execution in PHP itself. A proof-of-concept video leaked the evening before release, so the patch and the exploit arrived together. How to wipe: Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress only blunts one of the two bugsWed, 21 Oct 2026 00:00:00 GMTPHPRCEleaked early[L4 Septic Tank Blew] GitLab patches its second CVSS 10.0 regex-compiler RCE in nine days, and this one reaches back to GitLab 7.0https://ohshit.app/incidents/gitlab-regex-rce/https://ohshit.app/incidents/gitlab-regex-rce/CVE-2026-110264 (CVSS 10.0) is an integer overflow in the Onigmo regex compiler that lets an unauthenticated user run code on self-managed GitLab, from 7.0 onwards. It lands nine days after CVE-2026-97229, a sibling bug that already has a public PoC. Servers patched on Oct 12 are still exposed. How to wipe: Upgrade to 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13. There is no workaroundWed, 21 Oct 2026 00:00:00 GMTGitLabRCEself-managed[L4 Septic Tank Blew] Node.js October security releases for 22, 24 and 26: ten CVEs, including a Brotli RCE and TLS hostname bypasseshttps://ohshit.app/incidents/nodejs-oct-2026/https://ohshit.app/incidents/nodejs-oct-2026/Four HIGH, three MEDIUM and three LOW. An out-of-bounds write in the Brotli decoder, dns.resolve truncating names at a NUL byte, and IP spellings that sneak past certificate hostname checks. The release also rejects the compromised eMudhra keys. How to wipe: Upgrade to 22.23.4 / 24.22.1 / 26.12.1, rebuild containers, then restart so old TLS sessions dropWed, 21 Oct 2026 00:00:00 GMTNode.jsTLSRCE[L4 Septic Tank Blew] PingCAP confirms TiDB Cloud intrusion: a stolen service account roamed internal systems for a monthhttps://ohshit.app/incidents/tidb-cloud/https://ohshit.app/incidents/tidb-cloud/From Sep 9 to Oct 7 an intruder used stolen service-account credentials to copy account metadata, billing info, SQL editor text, encrypted API-key values and source code. Extortion group FulcrumSec claims 10.6 TB; PingCAP has not confirmed that. How to wipe: Rotate TiDB Cloud API keys and DB passwords, scrub secrets from SQL editor history, review access logsMon, 19 Oct 2026 00:00:00 GMTcloud databasecredentialsextortion[L4 Septic Tank Blew] eMudhra CA intermediate private keys were so weak that every one was a number below 256https://ohshit.app/incidents/emudhra-ca/https://ohshit.app/incidents/emudhra-ca/Eight intermediate certificates (six TLS, two code signing) under emSign ECC Root CA - G3, cross-signed by Sectigo, had P-384 private keys that were integers below 256. Anyone could recover them instantly and mint certificates for any domain. How to wipe: Update browsers and OSes, certifi 2026.10.19, Go 1.27.3 / 1.26.10, Node 22.23.4+; block the 8 intermediates in custom trust storesSat, 17 Oct 2026 00:00:00 GMTPKICATLS[L4 Septic Tank Blew] ConnectWise Cloud Backup's app secret got stolen, and attackers walked into Microsoft 365 tenants through the front doorhttps://ohshit.app/incidents/connectwise-cloud-backup/https://ohshit.app/incidents/connectwise-cloud-backup/An API secret for ConnectWise's multi-tenant backup app (formerly SkyKick) was stolen. Every Microsoft 365 tenant that had consented to the app was suddenly reachable with the permissions customers had granted it. ConnectWise suspended several cloud services. How to wipe: Remove or re-consent the ConnectWise apps, review Entra sign-ins from 144.172.64.x, check for new Global Admins and app secretsFri, 16 Oct 2026 00:00:00 GMTSaaSOAuthMicrosoft 365[L4 Septic Tank Blew] Ivanti Connect Secure zero-day chain: unauthenticated root on fully patched VPN boxes, againhttps://ohshit.app/incidents/ivanti-connect-secure-chain/https://ohshit.app/incidents/ivanti-connect-secure-chain/Attacker UTA0576 chained an auth bypass, a file write and a privilege escalation to take over VPN appliances running the latest release, then went after AD credentials, LAPS passwords and BitLocker keys. CISA added it to KEV the same day. How to wipe: Patch to 22.8R2.5 / 25.1.1.2 / 25.1.3.x, run Ivanti's external Integrity Checker, rotate every credential that touched the boxTue, 13 Oct 2026 00:00:00 GMTzero-dayVPNedge device[L4 Septic Tank Blew] GhostAction is back: hijacked maintainer accounts plant “security-audit.yml” workflows that ship your CI secrets outhttps://ohshit.app/incidents/ghostaction-returns/https://ohshit.app/incidents/ghostaction-returns/Compromised GitHub accounts pushed workflows dressed up as security jobs that exfiltrate Actions secrets. A new variant scans full git history, so the key you deleted three years ago still counts. GitHub started blocking the workflow on Oct 9. How to wipe: Search .github/workflows for security-audit.yml and friends, rotate every CI secret and any key ever committed, revoke old PATsFri, 09 Oct 2026 00:00:00 GMTsupply chainGitHub Actionssecrets[L4 Septic Tank Blew] The Oracle Health breach tally quietly climbs to nearly 20 million patientshttps://ohshit.app/incidents/oracle-health-20m/https://ohshit.app/incidents/oracle-health-20m/Stolen logins on two legacy Cerner servers in early 2025. The true size only surfaced through a Texas attorney-general filing: 19.9 million people, with SSNs, diagnoses, medications and medical images. Oracle still hasn't published a total. How to wipe: Freeze your credit, watch for fake “Oracle Health” notices; providers: enforce MFA and retire legacy serversMon, 05 Oct 2026 00:00:00 GMThealthcaredata leak