Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
Original title: ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
The Hacker News recap centers on critical remote-code-execution bugs. PHP patched PHP2Shell, CVE-2026-109618 and CVE-2026-109619; Cloudflare reported millions of attempts and the recap says no successful exploitation had been observed. Plex Media Server flaws CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, chained as Plex2Shell, are delivering miners and proxy software and were added to CISA's KEV catalog. Separately, weak eMudhra CA keys were blocked by browsers, Brotli CVE-2026-111497 was fixed across dependent libraries, and a leaked LiteLLM master key was used to publish malicious version 1.107.0.
Unconfirmed: Railway's distillation motive rests on early investigation, and the recap says PHP2Shell had no observed successful exploitation.
- Apple began blocking affected eMudhra certificates on October 19 and October 23, 2026.
- Linux KSMBD flaws ZDI-CAN-33774, ZDI-CAN-33549 and ZDI-CAN-33367 have no CVE IDs and no reported exploitation.
- Railway urged revocation of sensitive environment variables stored before October 21, 2026.
- GitLab patched CVE-2026-110264, scored CVSS 10.0, involving a crafted regular expression.
- LiteLLM 1.107.0 harvests credentials and runs an hourly Unix backdoor.
Impact: Remote code execution, miner delivery, and stolen credentials
| Product | Affected |
|---|---|
| PHP | — |
| Plex Media Server | — |
| Google Brotli | — |
| LiteLLM | 1.107.0 |
| GitLab | — |
- 1.Treat the four Plex CVEs as actively exploited and patch Plex Media Server
- 2.Revoke Railway environment variables stored before October 21, 2026
- 3.Remove or avoid LiteLLM 1.107.0 and rotate exposed developer and cloud credentials
- CVEs
- CVE-2026-109618CVE-2026-109619CVE-2026-111497CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1496 Resource Hijacking
- Products
- PHPPlex Media ServerBrotliKSMBD
- Victims
- Railway
- Organizations
- CISACloudflareApple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
CVE-2026-89078+1 related CVE | Authenticated RCE in GitLab CE/EE via Double Free in CI/CD Regex Parsing | 9.9 | — | ||
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
13 min read at thehackernews.com
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.