Today is what “trust collapse” looks like in practice: the official package repo, the official container tags, and even the hang-up button are all part of your attack surface now.

Today's Top 5

1. 6.38M Bookoff members exposed: Japan’s Bookoff says an intruder obtained membership data at scale, and the second report puts a hard number on it. The interesting question is what the attacker can do with password hashes next. Source
2. 375,000 rows in SBI leak probe: State Bank of India disclosed an incident tied to dark web chatter and is still validating authenticity and origin. If the samples are real, expect loan-document phishing that looks uncomfortably legitimate. Source
3. LiteLLM shipped a credential stealer: A compromised LiteLLM 1.107.0 hit PyPI and official images, turning AI gateway nodes into key-exfil boxes for a few hours. The part to watch is how many teams pulled “latest” in CI without noticing. Source
4. Signal bug keeps calls alive: CVE-2026-113380 can let a malicious caller prevent a hang-up from tearing down audio, potentially leaving a mic live. This is the kind of “it’s just a DoS” bug that becomes a privacy nightmare. Source
5. Snort 3 command execution bug: Cisco published a Snort 3 advisory for a control-channel issue, with no workarounds listed. If Snort is in your detection stack, a vulnerability here is extra painful because it erodes the thing you trust to see everything. Source

Why today matters: Three different “trusted interfaces” failed in three different ways. A retail membership system became a long-lived identity dataset, a banking disclosure started from dark web claims, and a popular AI gateway got poisoned through official distribution. The pattern is attackers going where your org relaxes: integrations, defaults, and routine updates.

XERJ Corpus Hub: If the LiteLLM 1.107.0 compromise is in your blast radius, an AI agent loading splunk-security-content can draft a focused hunt for Python startup-hook execution and suspicious outbound key exfil patterns, then turn it into a deployable detection in minutes. Build your own corpus at hub.xerj.org.

Now, the rest of the damage map.

Data Breaches

1. Bookoff Group Holdings: member data leak (second report): Bookoff says unauthorized access led to external acquisition of member information, and its second report quantifies the impact at 6,383,279 affected individuals. If you have Japanese consumer exposure, plan for credential-stuffing and highly targeted re-engagement scams using real profile data. Source: Japan IR
2. State Bank of India: suspected dark web leak under investigation: SBI filed that it was alerted to data appearing on the dark web and kicked off forensic work, while noting it cannot yet confirm the leak’s authenticity or origin. Reported content includes PII plus loan and customer identifiers, which is prime material for “your application is missing one document” fraud. Source: TechRadar
3. Studio.Design (no-code website builder): potential exposure of user data and form submissions: Studio’s notice says attackers exploited a service vulnerability to make data in its environment accessible externally for a period, with customer accounts and form submissions potentially affected. If your org used Studio for marketing or intake forms, assume form content can be phished back at you with perfect context. Source: Studio.Design
4. Dorsata: Metabase-related patient data incident: Dorsata says a data security incident tied to third-party Metabase software may have involved patients’ protected health information, and notifications began on October 21, 2026. The operational lesson is to treat embedded analytics as production data paths, not “just reporting.” Source: PR Newswire

Security Research

1. LiteLLM 1.107.0 supply chain compromise: attack chain details: LiteLLM’s maintainers published a timeline of how a compromised release made it to PyPI and container registries, plus guidance on remediation. Treat any build agent that installed or pulled the malicious tags as potentially credential-burned. Source: LiteLLM
2. Microsoft: deep dive on LiteLLM compromise mechanics: Microsoft’s write-up explains how the payload used Python startup behavior and what defenders should look for. Useful for building detections when your environment has a lot of “Python everywhere” automation. Source: Microsoft Security Blog
3. Signal RingRTC hang-up bypass: Reporting on CVE-2026-113380 highlights how queue saturation can block teardown, leaving audio and possibly video active until fixed. This is the rare bug that reads like an academic race condition but lands like a real-world wiretap risk. Source: The Register
4. PHP: new code-execution advisory after PHP2Shell: A new issue, CVE-2026-115560, is tied to session upload progress and a specific runtime config pattern; PHP advised disabling session upload progress until a fix lands. This is the kind of “rare config” bug that shows up in odd legacy corners and then surprises you. Source: Security Affairs
5. SANS Stormcast: Snort 3 vulns, Signal flaw, and leaked kernel reports: The October 23, 2026 episode rounds up the week’s active exploitation themes and points defenders to what’s getting attention right now. It is a fast way to sanity-check your patch triage list. Source: Apple Podcasts

Top CVEs

1. CVE-2026-113380: Affects Signal’s RingRTC calling library before 2.72.0, where an attacker can saturate a call’s event queue so hang-up does not tear down audio and potentially video. If you run Signal forks or embed RingRTC, verify the fixed version is in your build pipeline. Source
2. CVE-2026-76524: Cisco advisory for an Open Source Snort 3 control channel socket issue described as arbitrary command execution. If Snort 3 is deployed in sensitive monitoring segments, treat patching as an integrity task, not just availability. Source
3. CVE-2026-109618: One of the two critical “PHP2Shell” bugs, described by PHP as RCE via out-of-memory handling leaving partially initialized request data. Patch to fixed PHP releases or confirm backports from your distro vendor. Source
4. CVE-2026-109619: The second “PHP2Shell” critical RCE, described as stale global state surviving after memory is freed. The practical risk is exploitability across huge swaths of web infrastructure, especially on shared hosting and long-lived PHP-FPM pools. Source
5. CVE-2026-115560: PHP warned of an “unlikely in practice” code-execution issue tied to session upload progress and switching session.serialize_handler at runtime. Until a full fix is released, consider disabling session upload progress if you cannot quickly prove the risky pattern is absent. Source

Podcasts & Talks

1. SANS Stormcast (Oct 23, 2026): PHP2Shell exploitation update, Signal CVE, Snort 3 issues: Five minutes, zero fluff, and it mirrors what defenders are actively chasing right now. Good for CISOs who want to pressure-test whether their patch and monitoring priorities match the real internet. Listen: Apple Podcasts

Final Words

The uncomfortable pattern today is that “security ownership” is getting fuzzier. Your org might not run Bookoff’s membership database, SBI’s systems, or LiteLLM’s release pipeline, but you still inherit the consequences through identity data reuse, vendor trust, and automated dependency pulls. The threat model shift is simple: the attacker doesn’t need your perimeter when they can ride your updates, your defaults, and your users’ habits.

This week, do three things:

• Inventory and block LiteLLM 1.107.0 across PyPI installs and container tags, then rotate every API key and cloud credential that ever lived on a host that pulled it.
• Patch or verify backported fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619) and add WAF and IDS tuning for anomalous PHP request patterns while you burn down backlog.
• Require mobile and desktop app owners to confirm mitigation for CVE-2026-113380 in Signal/RingRTC dependencies, especially if you ship internal secure-comm forks.

Your turn: If a compromised dependency landed in your prod images for two hours, do you have a way to prove it never ran, or do you end up rotating secrets “just in case”? Hit reply with your answer, or drop a comment on the web version. I read every reply.

Know a team that still pulls AI tooling images by latest in CI? Forward them this issue, it costs 30 seconds and the alternative costs a full credential reset week. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!