0:incident-room* 1:php 2:gitlab 3:supply-chain 4:finale WED 21 OCT 2026 · load: ∞
INCIDENT REPORT // severity: yes

WEDNESDAY.log — a totally normal day on the internet

"So basically, today…" — an 11-panel recap of the day everyone took their system offline.

00000000 53 6f 20 62 61 73 69 63 61 6c 6c 79 2c 20 74 6f 64 61 79 |So basically, today| 50 48 50 20 67 6f 74 20 74 77 6f
0x01POST // power-on self test
█   █ █████ ████
█   █ █     █   █
█ █ █ ████  █   █
██ ██ █     █   █
█   █ █████ ████ 
WEDNESDAY BIOS v21.10.26  (c) The Internet
CPU: 1x sysadmin @ 0.3 coffees/hr
Memory test: 640K OK (ought to be enough)
Detecting threats ... [██████████] too many
PHP ............. CRITICAL ×2
GitLab .......... CVSS 10.0
LiteLLM ......... PWNED
Secrets ......... ON FIRE
eMudhra key ..... 4
Keyboard not found. Press F1 to continue.
Press DEL to enter setup,
CTRL+ALT+DEL to pretend this didn't happen.
THREAT METER
(DEFCON-ish, not official)
5chill
4meh
3hmm
2uh oh
1WED
Current level: WEDNESDAY
Recommended action: see panel 0x03.
0x02a wild boss appeared
#1#2
BOSS: PHP2SHELL
Lv. CRITICAL · 2 bugs, 2 heads
Move: run code on your server
Requires: no login at all
PHASE 1Two critical bugs. Anyone can run code, no login. Bad.
→
PHASE 2 · TWISTDetails leaked before the patch was even out. Worse.
YOUR PARTY · status: it works on all of them
WordPressEXPOSED
MediaWikiEXPOSED
MagentoEXPOSED
JoomlaEXPOSED
LaravelEXPOSED
1.5M*
servers running a version with no fix.
*"like 1.5 million", per Censys
FIGHTPATCH ITEM: coffeeRUN (offline)
0x03#global-incident · 7 members
NSA
NSAtake your system offline
FBI
FBItake your system offline
CISA
CISAtake your system offline
UK
UKtake your system offline
CERT
-EU
CERT-EUTAKE YOUR SYSTEM OFFLINE
Prime Minister of Japan · the actual Prime Minister[official]
Take your system offline.
05:55AM
sent to48.8Mpeople
Seen by everyone · so everyone took their system offline
IT support, foreverHave you tried turning it off and on again?
Everyone, todayHave you tried turning it off and on again?
0x04status page · all systems not operational

Everyone took their system offline

Like, everyone.

404
Dutch cybersecurity agency
took its own website offline
404
Dutch parliament
offline
404
Port of Rotterdam
offline
404
Finland gov sites
being pulled
404
France gov sites
being pulled
404
Denmark gov sites
being pulled
404
Wikipedia
down
404
Archive.org
down
404
Asana
down
404
GOG
down
404
Something Awful
down
404
Univ. of Vienna webmail
down (for some reason)
418
I'm a teapot
not in the recap. just a teapot. still brewing.

It's not DNS.
There's no way it's DNS.
It was DNS. It was PHP.

WEDNESDAY
:(
A fatal exception 0E has occurred at 0028:PHP in VxD INTERNET(01).
The current application will be terminated.

* Press any key to take your system offline.
* Press CTRL+ALT+DEL again and you will lose
  nothing, because it is already offline.
Press any key to continue _
0x05 // plot twist
…and that's just PHP.
Loading the rest of Wednesday… 9%
THINGS ON FIRE MONTUEWED PHP WE AREHERE "everything else"(loading…)
(xkcd-style. not to scale. nothing is to scale today.)
0x06$ git blame — GitLab

GitLab: CVSS 10.0 MAX

The highest score they give out. For a bug that's been there since 2014.

^1a2b3c 2014# looks fine, ship it
^1a2b3c 2014def the_bug # ← still here
^1a2b3c 2014 # TODO: revisit later
9f8e7d 2026"later"
0246810 10.0 CRITICAL · MAXIMUM
CVSS · there is no 11
bug present in every self-hosted GitLab:
201420202026
12 years of every self-hosted GitLab.
0x07supply chain // pip install regret

LiteLLM 1.107.0 HIJACKED

Shipped a credential stealer and a remote access trojan.

pip install litellm==1.107.0
Collecting litellm==1.107.0 Installing collected packages: litellm + credential stealer [included] + remote access trojan [included] Successfully installed. Successfully pwned.
python -c "import litellm"
# don't bother. you didn't even have to import it. # just installing it was enough.
docker pull litellm:latest
latest: also included
everywheel
theDocker images
including:latest
import needed?no
WORKS ON MY MACHINE
…and now theirs
import litellm
not required
TIMES THIS YEAR
02 second time
0x08secrets.env · this is fine
▸ ~/prod/secrets.env — modified by: someone else
DATABASE_URL=••••••••••••••••
STRIPE_SECRET=••••••••••••
AWS_SECRET_ACCESS_KEY=••••••••••
PASSWORD=hunter2
TODO=rotate everything
Railway

Paused every deployment on the entire platform

Someone got into the environment variables. Now everyone has to rotate every secret they've ever stored there.

sudo rotate --every-secret --ever
TiDB Cloud

An intruder walking around inside

With stolen credentials, for basically a month.

10.6 TB claimed taken

…says an extortion group.

Zeabur

Breached for the 2nd time in two months

And is just shutting down. Like, the whole company.

sudo shutdown -h now
0x09CHANGELOG.md · also today
## [Wednesday] — 2026-10-21
### Also on fire
  • PATCHNode.js patched remote code execution + a TLS bypass
  • EXPLOITPlex is being actively exploited (says CISA)
  • TORSomeone took over 300+ Tor exit relays to steal SSH passwords
  • RANSOMSafePay ransomware has hit 600+ critical infrastructure orgs
  • BANKIndia's biggest bank filed a data loss incident
  • JAPANJapan has been in an official state of emergency in cyberspace since Oct 9 — which honestly explains the 5:55 AM post
0x0Aoh, and one more thing
CERTIFICATE AUTHORITY

eMudhra

60M+ certificates issued

Entire job: proving websites are who they say they are.

Private keys were supposed to be random numbers over a hundred digits long, like:
985992565463516618566405917325979438189901690033143795095693808439288820797087858944120251378408265906420756135943327696
(illustrative placeholder digits)
One of them was:
4
chosen by fair
dice roll.*
Just 4.
the others were like660x42 · so close to the answer
and2370xED · ed25519 it is not
expected100+ random digitsactual1 digit. It was 4.
0x0B // EOF
Anyway,it's Wednesday.
sysadmin@wednesday:~$ rm -rf ~/wednesday
rm: cannot remove 'wednesday': it's still Wednesday
zZ
SYSADMIN.EXE
HP ██░░ COFFEE: 0
STATUS: OFFLINE