BREAKING: PHP, Node.js, GitLab and LiteLLM all had critical security incidents on the same day. If you run production software, here's what to do this week: 1. Patch what faces the internet first. > PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 > Node.js: the 21 October security releases for 22, 24 and 26 > Self-managed GitLab: the 21 October critical patch release Attackers start with whatever answers on a public port. 2. Find anything on PHP 8.1 or older. The PHP project won't fix it. Get a vendor backport or upgrade, and keep it off the public internet until you do. "We'll upgrade next quarter" is now an open door. 3. Search every environment for LiteLLM 1.107.0. That release shipped a credential stealer. If it ran anywhere, rotate every cloud and model API key that machine could reach, then rebuild it. Removing the package isn't enough once the keys are gone. 4. Stop pulling "latest" this week. Pin versions, commit your lock files and make CI install exactly what you reviewed. Supply-chain attacks count on the auto-update. 5. Update runtimes and package managers. Node.js has already pulled the compromised eMudhra certificate from its trust store. Old versions still trust it. 6. Check the systems nobody owns. The app nobody has touched in years and the server only one person knows about are where this week's bugs will still be live next month. If nobody owns it, nobody patches it. If you own a portfolio of software companies, forward this to every CTO today.