Global – October 27, 2026 -- A malicious version of the tensorlake npm package (0.5.144), which draws about 12,000 weekly downloads, was published carrying Shai-Hulud malware, according to OX Security.

Malware wipes the host if a stolen GitHub token is revoked

The payload contains a kill-switch string, IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner, identical to the one used in the TanStack attack in May. Revoking the stolen GitHub token triggers rm -rf ~/ on Unix systems or Remove-Item on the Windows user profile.

Global – October 27, 2026 -- Apache Airflow's SSH and SFTP providers ship with host key verification disabled by default. Two High-severity vulnerabilities, CVE-2026-94134 and CVE-2026-94135, both rated CVSS 8.1, leave connections open to man-in-the-middle attacks, according to OX Security Research.

Both apache-airflow-providers-ssh and apache-airflow-providers-sftp are affected through version 6.0.1. Version 7.0.0 of each package fixes the flaw. The weakness is classified as CWE-322, key exchange without entity authentication.

Global – October 27, 2026 -- Roughly 2,000,000 internet-facing PHP servers run versions affected by two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and 99.99% of identifiable servers remain unpatched, according to Shodan data cited by OX Security.

The PHP core team issued an out-of-band security release fixing both flaws in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Shodan counts only servers that expose their PHP version, so the real total is likely higher.

Global -- A malicious version of LiteLLM, version 1.107.0, was published to PyPI on October 21, 2026. It bundles a credential-stealing infostealer with a remote access trojan (RAT), according to OX Security. It is the second hijacking of the AI gateway this year, and PyPI has since quarantined the release.

GLOBAL – October 27, 2026 -- Only 14,151 of 1,974,890 measurable PHP instances in the affected version range showed a patched release 24 hours after PHP shipped emergency fixes for the PHP2Shell flaws, leaving 99.3% exposed, according to OX Security.

PHP released the fixes on October 21 for CVE-2026-109618 and CVE-2026-109619. Both are critical vulnerabilities that allow unauthenticated remote code execution in the PHP engine itself. Governments and security agencies urged organizations to patch immediately, and some organizations took systems offline.

Global – October 27, 2026 -- Five days after the PHP project shipped emergency fixes for the PHP2Shell flaws, 93.6% of measurable PHP instances remain exposed, according to OX Security scans run through October 26, 2026. That is roughly 15 of every 16 hosts the firm can measure.

New York – September 18, 2026 -- OX Security launched OX Cloud, a cloud security platform built to monitor AI agents that now operate autonomously in production environments, access sensitive data and call tools without human oversight.