ESET reviews a week of PHP, kernel, and LiteLLM incidents
Original title: Lessons from Cybersecurity Black Week
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
ESET recounts the week before October 25, 2026, covering PHP2Shell, public Linux kernel reports, a malicious LiteLLM 1.107.0 release, a GitLab flaw, a Node.js Brotli bug, and a certificate-authority incident. PHP 5.4 through 8.5.11 has two CVSS 9.2 memory-safety bugs that can allow unauthenticated remote code execution. Fixes are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. More than 200 proof-of-concept exploits circulated, but the firms reported no successful attacks as of October 22.
Unconfirmed: No successful PHP2Shell attacks were reported by the nine firms; GitLab, Brotli, and certificate details are incomplete because the article is cut off.
- CVE-2026-109618 and CVE-2026-109619 affect PHP 5.4 through 8.5.11.
- Source-only backports cover end-of-life PHP 7.4, 8.0, and 8.1.
- ZDI-CAN-33549 and ZDI-CAN-33774 are KSMBD issues rated CVSS 9.0 by ZDI.
- Malicious LiteLLM 1.107.0 stayed on PyPI for roughly two hours.
- Attackers used GitHub CLI credentials from three developers, ESET reports.
Impact: Unauthenticated remote code execution on vulnerable PHP servers
| Product | Affected | Fixed in |
|---|---|---|
| PHP | 5.4 through 8.5.11 | 8.5.12, 8.4.27, 8.3.36, and 8.2.35 |
| Linux kernel KSMBD | — | — |
| LiteLLM | 1.107.0 | — |
- 1.Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- 2.Remove or avoid LiteLLM 1.107.0 from PyPI and official container images.
- 3.Restrict exposed KSMBD services while awaiting verified kernel fixes.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195.001 Compromise Software Dependencies and Development Tools
- Products
- Linux kernelGitLabNode.js
- Organizations
- ESETTrend MicroZero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
8 min read at welivesecurity.com
A critical PHP flaw, leaked Linux kernel reports, a poisoned LiteLLM release, and more, all in seven days. Which threats called for immediate action, and which generated more noise than real danger?
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.