Device Security Checklist: October 2026 Advisories

• You use a laptop, desktop or phone

  Windows, macOS, iPhone, iPad, Android or Linux

  Update needed

  Install pending system, browser and app updates, then restart. Most devices are already protected once they are up to date. The 10-minute checklist

• Your Firefox has remote blocklist updates turned off

  Usually set by an IT policy on managed computers

  Update needed

  Update to Firefox 158.0.1, ESR 115.43.1 or ESR 153.5.1 or later. Standard Firefox has been protected since 17 October.

• You write or run code on your own machine

  Python, Node.js, Go, Rust, PHP, Docker or Homebrew

  Update needed

  Runtimes and tools keep their own trusted certificates, and system updates do not reach them. The developer checklist

• You installed Python packages on 21 October

  Especially anything AI-related: DSPy, CrewAI, smolagents and others

  Act now

  Check for the malicious LiteLLM 1.107.0 release first, without starting Python. How to check safely

1. 01

   Update your operating system and restart

   How to update each operating system

   Device	What to do
   Windows	Settings > Windows Update > Check for updates. Install everything and restart.
   macOS	System Settings > General > Software Update. Install and restart.
   iPhone and iPad	Settings > General > Software Update. Install and restart.
   Android	Restart your phone. The certificate block arrives through Google Play Services and a restart applies it immediately. Then install any pending system updates.
   Linux desktop	Install all updates, including the ca-certificates package, and restart.

2. 02

   Update your browser

   What each browser needs

   Browser	What to do
   Chrome, Edge, Safari	Nothing beyond normal updates. Chrome blocked the certificates on 17 October without needing a restart.
   Firefox	Protected on standard settings since 17 October. If you or your IT team have turned off remote blocklist updates, update to Firefox 158.0.1, ESR 115.43.1 or ESR 153.5.1 or later.

3. 03

   Update your desktop apps

   Many desktop apps, such as chat, note-taking and code editors, are built on Electron, which ships its own copy of Node.js and its own certificate checks. Fixed Electron versions are out, but each app only gets them when its maker releases an update. Open each app and install any available update, or let your app store update them all.
4. 04

   Update Cloudflare WARP or the 1.1.1.1 app, if you use them

   Upgrade the Cloudflare One Client (WARP) to 2026.8.2115.0 or later on desktop. Update the mobile apps from the App Store or Google Play.
5. 05

   Optional: check that your browser rejects the bad certificates

   Open the two test pages below. A certificate or security warning means you are protected. If either page loads normally, update your operating system and browser and try again. Do not click through the warning.

   • https://dv-g3b-emudhra.we-have-a-problem.com/
   • https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

1. Check for the malicious LiteLLM release (urgent)

litellm version 1.107.0 contained malware that steals credentials. It was available on PyPI and Docker on 21 October 2026 for about two hours. It may also have arrived as a dependency of DSPy, CrewAI, smolagents, langchain-litellm, llama-index-llms-litellm, Open Interpreter, Guardrails AI and others.

Run these from a terminal on macOS or Linux. Do not run python, pip, uv run or anything else that starts Python to check. Starting Python in an affected environment runs the malware again.

# Run from a shell. Do not start Python or pip to check.
find / -path '*-packages/litellm-1.107.0.dist-info' -type d 2>/dev/null
find / -path '*-packages/cook.pth' -type f 2>/dev/null
ls -la /tmp/.pc_once_72129118c59f5636c0bb /tmp/remote_code_loader.lock 2>/dev/null
docker images --digests | grep -E '1bbcb1443bc9|c00f9d92c427|7b00e91cd2fe'

Also search your projects’ lockfiles:

# Run from the folder that holds your projects
grep -rnE 'litellm(\[[^]]*\])? *(==|-) *1\.107\.0([^0-9a-z]|$)' .

If any of these return a result, stop and go to what to do if you find it. If nothing turns up and you use LiteLLM, pin it to litellm==1.106.2.

Full indicators, Kubernetes checks and how the malware works are in the LiteLLM advisory.

2. Update Node.js

node --version

You need 22.23.4, 24.22.1 or 26.12.1, or later in the same line. Node.js 20 and older receive no fix, so move to 22 or 24. If you use a version manager such as nvm, fnm, volta or mise, install the fixed version and make it your default. Pull fresh node Docker images and rebuild local images.

If a project depends on the undici package directly, upgrade that package too.

The ten vulnerabilities and fixed versions are covered in the Node.js advisory.

3. Update certificate bundles in your tools

These tools bring their own list of trusted certificates and need updating separately.

Check that a tool rejects the bad certificate. An error means you are protected.

curl -sS -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/ && echo "STILL TRUSTED"

On a Mac: the built-in curl and other command-line tools read /etc/ssl/cert.pem, which Apple’s update does not cover. If the check above prints STILL TRUSTED, this removes the two affected roots and keeps a backup. A later macOS update may restore the file.

sudo cp /etc/ssl/cert.pem /etc/ssl/cert.pem.bak &&
awk '/^(###|===) /{skip=0}
  /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1}
  !skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/null

Tests for Node.js and Python, and trust store fixes for Linux, are in the eMudhra advisory.

4. Update PHP, if you run it locally

PHP used only on the command line is low risk, so update it with your next routine patch. If you serve anything with a local PHP web server that others can reach, update now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On Homebrew, run brew upgrade php.

Patched packages for each distribution are in the PHP2Shell advisory.

1. 01

   Disconnect the machine and stop working on it

   Take it off the network. Do not start Python on it again.
2. 02

   Tell your IT or security team

   Do it before you try to clean anything up, so they can see the machine as the malware left it. If you have no security team, follow the clean-up steps in the LiteLLM advisory, and plan to rebuild the environment rather than repair it.
3. 03

   Change passwords and keys from a clean device

   Use a different device, then sign out of active sessions. The malware takes:

   • Passwords and cookies saved in your browser
   • Cloud credentials for AWS, Google Cloud and Azure
   • SSH and GPG keys
   • GitHub, npm and PyPI tokens
   • .env files
   • Logins for AI coding tools such as Claude Code, Codex, Gemini CLI, Cursor and Copilot

The full list of secrets to rotate, and how to remove the startup files, is in the LiteLLM advisory.

• eMudhra intermediate CA compromise: trust stores on servers, containers and AWS services, and TLS certificates that chain to the affected root.
• LiteLLM 1.107.0 supply chain compromise: CI runners, Kubernetes, the LiteLLM proxy and its stored keys.
• Node.js October 2026 security releases: services that are not on the internet, and who updates Node.js on each AWS service.
• PHP2Shell: PHP web servers, which were attacked from 17 October.
• GitLab critical patch 19.5.1: self-managed GitLab servers only. Nothing to do on your own device.

• Google: protecting Chrome and Android usersWhen Chrome and Android blocked the eMudhra intermediates, and that Android applies the block on restart.
• Mozilla: protecting Firefox usersFirefox’s 17 October blocklist update and the fixed Firefox and ESR versions.
• Cloudflare: eMudhra certificate compromiseFixed versions of the Cloudflare One Client (WARP), the 1.1.1.1 app and cloudflared.
• Electron #55126The Electron change that blocks the compromised intermediates.
• eMudhra incident trackerApple and Microsoft block dates, and the live test pages used on this page.
• LiteLLM incident reportThe malicious 1.107.0 release, the safe version to pin, and the maintainers’ guidance.
• Node.js October 2026 security releasesThe fixed Node.js versions for each supported release line.