PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
Original title: PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
Between October 16 and 23, 2026, PHP, Node.js, GitLab, LiteLLM, OpenCode and eMudhra each had serious security issues. PHP2Shell is two pre-authentication RCEs, CVE-2026-109618 and CVE-2026-109619, both rated 9.2; Amazon MadPot logged an attempt four days before disclosure. GitLab CVE-2026-110264 is unauthenticated RCE via an integer overflow, CVSS 10.0, back to GitLab 7.0. Malicious LiteLLM 1.107.0 on PyPI and in official images ran a credential stealer, and OpenCode Console keys may have been exposed.
Unconfirmed: A cited blog argues LLMs cut public-exploit lag to hours; this article does not measure that.
- PHP fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; config workarounds are incomplete.
- Node.js fixes are 22.23.4, 24.22.1 and 26.12.1; end-of-life lines get none.
- Deprecated Lambda nodejs20.x stopped receiving security patches in April 2026.
- Eight eMudhra intermediate CA private keys were integers below 256.
- Mandiant’s cited average time-to-exploit fell to five days in 2023.
Impact: Pre-authentication remote code execution or stolen cloud and AI credentials
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Node.js | end-of-life lines including 20.x get no fix | 22.23.4, 24.22.1, 26.12.1 |
| GitLab | back to GitLab 7.0 | October 21 patch releases |
| LiteLLM | 1.107.0 | — |
- 1.Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- 2.Patch self-managed GitLab; the article says there is no workaround.
- 3.Rebuild LiteLLM from a verified release and rotate reachable credentials.
- Products
- PHPNode.jsOpenCode Console
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
13 min read at cloudsleuth.io
Between October 16 and 23, 2026, PHP, Node. js, GitLab, LiteLLM, OpenCode and the eMudhra certificate authority all had serious security incidents. PHP, Node.
By bigfish2026 · cloudsleuth.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.