Cloudflare observed attempts before the patched PHP releases were published. PHP released 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Changing an application or a single setting does not mean all paths are fixed.
What to check Check running versions in every worker and container. Consider migrating EOL series to supported series; do not treat partial mitigation as a completed fix.
Distribution compromise and vendor disclosure · Original dated 10/21, time unspecified.
LiteLLM and Railway: code installed, keys entrusted.
The malicious LiteLLM 1.107.0 distribution and unauthorized access to environment variables stored in Railway are separate incidents. Since API keys are affected, replacing packages or restoring services alone is insufficient.
What to check Isolate affected environments and preserve evidence. In affected LiteLLM environments, do not first launch Python or pip to investigate; revoke keys and rebuild from a clean environment.
Vendor and Microsoft reports · Microsoft original dated 10/21, no time specified
Investigation must extend to ConnectWise / M365
Reports describe ConnectWise Cloud Backup application credentials as an entry point into M365. The earlier “primary source unconfirmed” record is updated after later primary-source confirmation.
What to check Do not stop at disabling connections; inspect evidence of added credentials, privileges, consents, and mail operations in customer tenants.