THREAT INTELLIGENCE BRIEF·Thursday, October 22, 2026·Generated summary

Executive brief

The most urgent threat is a pair of critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell. While not yet on the CISA KEV list, public exploit code is available, and intelligence reports indicate active exploitation attempts against the nearly 70% of websites using PHP. Separately, CISA has confirmed active exploitation of a Palo Alto GlobalProtect VPN flaw (CVE-2026-0257) by ransomware groups; this vulnerability has a 96.9% exploitation probability (EPSS). CISA also added the Plex Media Server Plex2Shell vulnerability (CVE-2026-96652) to its KEV list, mandating federal patching. Other significant threats include a software supply chain attack on the popular LiteLLM Python package and the re-emergence of a UEFI bootkit.

69 articles analysed5 CVEs mentioned

Threat Categories

Vulnerabilities3

Ransomware1

Malware1

Article Analyses (5)

[CRITICAL] "Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)"

critical

CVE-2026-109618 CVE-2026-109619

PoC

Details

Two critical remote code execution (RCE) vulnerabilities, tracked as PHP2Shell (CVE-2026-109618, CVE-2026-109619), allow an unauthenticated attacker to execute arbitrary code on a target web server. The flaws reside in the core PHP runtime, making servers vulnerable regardless of the specific web application code. Multiple sources report active exploitation attempts are already occurring in the wild, and public exploit code is available.

Affected Systems

PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This impacts a wide range of web applications and frameworks including WordPress, Drupal, Magento, and Laravel.

Potential Impact

Complete server compromise, leading to data theft, credential harvesting, website defacement, or use of the server for further attacks. Given that nearly 70% of websites use PHP, the potential for widespread impact is exceptionally high.

Mitigations

Immediately apply the emergency security updates. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. All PHP users are strongly urged to update immediately.

Secure List Draft Post

[CRITICAL] "Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June"

critical

CVE-2026-0257

KEVEPSS 96.9%

Details

An authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect feature is being actively exploited by ransomware groups. The flaw allows a remote, unauthenticated attacker to bypass security restrictions and establish an unauthorized VPN connection by leveraging firewall cookies without proper validation.

Affected Systems

Palo Alto Networks PAN-OS with the GlobalProtect feature enabled. The patch was released in May.

Potential Impact

Initial access for ransomware deployment, leading to widespread network encryption, data exfiltration, and significant operational disruption. Affected sectors already include healthcare, education, government, and energy.

Mitigations

Apply the vendor-supplied patch for CVE-2026-0257 immediately.

Help Net Security Draft Post

[HIGH] "CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws"

high

CVE-2026-96652

KEVEPSS 0.4%

Details

CISA has added CVE-2026-96652, a Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server, to its Known Exploited Vulnerabilities (KEV) catalog, confirming it is being actively exploited. This vulnerability is part of a collection of flaws referred to as Plex2Shell.

Affected Systems

Plex Media Server versions impacted by CVE-2026-96652.

Potential Impact

An attacker can force the server to make requests to other services, potentially exposing sensitive information or interacting with internal network resources that are not directly accessible from the outside. This can serve as a foothold for lateral movement within the network.

Mitigations

Follow vendor guidance and apply the necessary patches for Plex Media Server. CISA has ordered federal agencies to remediate this vulnerability.

The Hacker News Draft Post

[CRITICAL] "LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor"

critical

Details

The popular LiteLLM Python package was compromised in a software supply chain attack. Malicious code was injected into a specific version of the package, designed to steal credentials and install a backdoor on systems where the compromised package was installed.

Affected Systems

Systems and applications using LiteLLM Python package version 1.107.0, distributed via PyPI wheels and Docker images.

Potential Impact

Compromise of developer workstations, CI/CD pipelines, and production environments. The attack could lead to the theft of sensitive credentials, source code, and proprietary data, as well as providing a persistent backdoor for attackers.

Mitigations

Immediately identify any systems running the compromised LiteLLM version 1.107.0. Upgrade to a safe version and conduct a thorough security audit for signs of compromise, including credential rotation and checking for unauthorized access.

The Hacker News Draft Post

[HIGH] "How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia"

high

CVE-2022-21894

EPSS 6.6%

Details

A new UEFI bootkit, named BlackX, has been discovered. It is similar to the BlackLotus bootkit and exploits the Baton Drop vulnerability (CVE-2022-21894) to achieve persistence and evade security software. This allows the malware to load before the operating system, making it extremely difficult to detect and remove.

Affected Systems

Systems vulnerable to CVE-2022-21894, which allows for Secure Boot bypass. The attack was observed targeting diplomatic organizations.

Potential Impact

Persistent, stealthy compromise of high-value systems. A bootkit can disable OS-level security controls, allowing an attacker (such as APT41) to maintain long-term access for espionage or data theft while remaining undetected.

Mitigations

Ensure systems are patched against CVE-2022-21894. Monitor for signs of UEFI firmware modification and consider advanced threat hunting techniques for detecting boot-level malware.

Secure List Draft Post

Generated by gemini-2.5-pro