Between 22 and 24 October, CERT-In, India's national cyber security agency, published five new alerts. Two are rated critical. One describes hackers taking over websites at large scale right now. Another describes a popular AI tool that was quietly turned into a password thief.
You do not need to be a security expert to follow this. Here is each alert in plain language, and what to do about it.
1. Fortinet's warning: AI is helping attackers move faster
CERT-In Advisory CIAD 2026 0054, 24 October 2026
Fortinet makes firewalls and network security products widely used by Indian businesses. It has released an urgent update fixing many serious weaknesses in FortiOS, FortiManager, FortiMail, FortiAuthenticator and FortiAnalyzer.
What makes this one stand out is how the flaws were found: through advanced AI assisted security testing. Fortinet also warns that attackers can use AI too. They can study a security update, work out what was fixed, and build an attack against anyone who has not installed it yet. In simple words, the gap between "a fix is released" and "hackers are using the flaw" is getting shorter.
CERT-In says to treat this as an emergency change, not routine maintenance. Fortinet will publish full technical details on 10 November 2026, so now is the time to update.
What to do: List every Fortinet device you own, starting with those facing the internet. Back up their settings and install the fixed versions. If you cannot update straight away, allow admin access only from trusted IP addresses, keep FortiManager off the public internet, turn on multifactor authentication (MFA) for every admin, and put management screens behind a VPN.
2. FortiSIEM: when the security camera itself can be broken into
CERT-In Vulnerability Note CIVN 2026 0521, 23 October 2026, Severity: Critical
FortiSIEM is the system many companies use to watch for attacks across their network. Think of it as the CCTV control room for your IT.
Versions before 7.5.1 have a critical flaw in how they handle file paths. An attacker needs no username or password. By sending specially crafted traffic, they can run their own commands on the system. If someone controls the tool meant to spot intruders, they can see what you see and possibly hide what they are doing.
What to do: Upgrade FortiSIEM to version 7.5.1 or later.
3. LiteLLM supply chain attack: an AI tool turned password stealer
CERT-In Advisory CIAD 2026 0053, 23 October 2026
LiteLLM is a popular Python tool that helps apps talk to many AI models through one interface. According to CERT-In, version 1.107.0 on PyPI (the main download store for Python packages) was compromised, along with Docker images on GitHub Container Registry and Docker Hub.
Attackers used a lookalike GitHub repository to trigger the release and slipped in three malicious files. These files run automatically every time Python starts, so even other Python programs on the same machine could be affected.
The malware does two things. First, it steals secrets: browser passwords and sessions, SSH and GPG keys, AWS, Azure and Google Cloud keys, CI/CD secrets, code repository tokens, and tokens for AI coding tools like Cursor and GitHub Copilot. On LiteLLM proxy servers it may also reach the database holding your AI provider API keys. Second, it opens a back door that keeps checking an attacker controlled GitHub repository for new code to run.
This is a textbook software supply chain attack. You did nothing wrong except trust a popular tool.
What to do: Search your projects, servers and pipelines for LiteLLM 1.107.0 and the affected Docker images. Isolate those systems and keep their logs. Rebuild containers from clean images instead of cleaning them in place. Version 1.106.2 has been identified as clean, but verify it before pinning it. Most importantly, change every password, key and token those machines could reach, from a clean computer.
4. PHP2Shell: small business websites under active attack
CERT-In Advisory CIAD 2026 0052, 22 October 2026, Severity: Critical
If your website, content management system or online shop runs on PHP, read this carefully. PHP often comes bundled with ordinary hosting plans, so many owners do not even know they use it.
CERT-In has warned MSMEs about two serious PHP flaws nicknamed "PHP2Shell". With one specially crafted request and no login, an attacker can run their own code on your server, then change your website, steal customer data or reach your databases. CERT-In says multiple reports confirm large scale exploitation in the wild. This is happening now.
What to do: Ask your developer or hosting provider which PHP version you use. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's fixed package) and confirm the new version is running. PHP 8.1 and older no longer get official fixes, so plan an upgrade. Check your logs for strange requests, unexpected file changes or new admin accounts, and report anything suspicious to CERT-In at incident@cert-in.org.in. Keep offline backups and use MFA.
5. MongoDB: crashes and data leaks in a popular database
CERT-In Vulnerability Note CIVN 2026 0520, 23 October 2026, Severity: Medium
MongoDB powers many modern apps. CERT-In reports several flaws in MongoDB Server (8.0, 8.3 and 9.0 branches), the PHP Driver, the Go Driver and libmongocrypt. Specially shaped data or queries could crash the database, corrupt its memory or expose sensitive information.
What to do: Apply MongoDB's latest security updates, and update the drivers inside your apps too, not just the server.
The bigger picture: trust is the new attack surface
Put these five alerts together and a pattern appears. Attackers are going after what we trust most: a security monitoring system, a firewall, a popular AI library, and the language behind countless small business websites. At the same time, AI can help them turn a published fix into a working attack faster than ever.
"We will patch next month" no longer works. Here is a simple checklist for this week:
- Know what you run, including versions and anything facing the internet.
- Patch internet facing systems first: firewalls, websites and admin panels.
- Use MFA everywhere and never leave admin screens open to the whole internet.
- Pin trusted versions of open source packages and watch what your pipelines download.
- If a machine might be compromised, assume its keys are too, and rotate them.
- Follow CERT-In alerts. They are free, timely and written for Indian organisations.
Cyber security is no longer only the IT team's job. Share this post with whoever looks after your systems and ask one simple question: "Are we affected?"
Source: CERT-In Vulnerability Notes and Advisories published 22 to 24 October 2026, available at cert-in.org.in.
