THREAT INTELLIGENCE BRIEF·Friday, October 23, 2026·Generated summary

Executive brief

The most urgent threat this week is the emergence of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619), a pair of critical remote code execution flaws in PHP. Threat actors began exploiting these vulnerabilities four days before patches were released, and public exploit code is now widely available. We also face a critical supply chain attack against the popular LiteLLM AI gateway, which resulted in malicious packages stealing cloud and developer credentials. Additionally, two unpatched CVSS 9.0 remote code execution flaws in the Linux kernel's SMB server have been publicly disclosed, and an actively exploited zero-day vulnerability is affecting Arista's VeloCloud Orchestrator.

55 articles analysed2 CVEs mentioned

Threat Categories

Vulnerabilities3

Malware1

Data Breach1

Article Analyses (5)

[CRITICAL] "New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619"

critical

CVE-2026-109618 CVE-2026-109619

EPSS 5.8%PoC

Details

Two critical vulnerabilities, collectively named PHP2Shell, allow for unauthenticated remote code execution (RCE) in widely used PHP applications. Attackers began exploiting these flaws as a zero-day four days before patches were available. The vulnerabilities exist in PHP applications running on Apache with mod_php or PHP-FPM under default configurations. Publicly available exploit tooling and scanners have been discovered, lowering the bar for attackers.

Affected Systems

All PHP installations serving web requests, including those using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Potential Impact

A successful exploit allows an unauthenticated attacker to achieve full remote code execution on the web server, leading to complete system compromise, data theft, or deployment of further malware.

Mitigations

All PHP users are strongly encouraged to update to a patched version immediately. Use the open-source php2shell-scanner tool to test if hosts are exposed.

Help Net Security Draft Post

[CRITICAL] "New LiteLLM Supply Chain Attack Hits PyPI and Docker"

critical

Details

A malicious version of the popular open-source LLM gateway, LiteLLM, was published to the PyPI repository and Docker Hub. Attackers used stolen maintainer tokens to compromise the release pipeline and inject credential-stealing malware into version 1.107.0. The malware is designed to harvest cloud logins, developer secrets, and API keys for AI services.

Affected Systems

Any host that installed or updated to LiteLLM version 1.107.0 from PyPI or Docker Hub on or after October 21, 2026.

Potential Impact

Exposure and theft of sensitive credentials, including cloud keys (AWS), AI provider secrets, and LiteLLM proxy databases. This could lead to unauthorized access to cloud infrastructure, data breaches, and significant financial loss.

Mitigations

Immediately check for installations of the malicious LiteLLM version 1.107.0. If found, isolate the affected host, revoke all credentials, secrets, and API keys, and investigate for signs of compromise. Update to a clean, verified version of the package.

SOC Radar Draft Post

[CRITICAL] "Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes"

critical

Details

Two remote code execution vulnerabilities rated CVSS 9.0 were publicly disclosed before patches were available in the mainline Linux kernel. One flaw (ZDI-CAN-33774) can be triggered before authentication, while the other (ZDI-CAN-33549) requires the SMB Direct transport. The public disclosure without a readily available fix creates a zero-day risk.

Affected Systems

Linux servers running the in-kernel KSMBD SMB server. The mainline kernel does not yet have a fix.

Potential Impact

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected Linux server, potentially leading to a full system compromise. The pre-authentication nature of one flaw makes it particularly dangerous for exposed servers.

Mitigations

Monitor mainline kernel development for the release of patches. In the interim, consider disabling KSMBD if not essential or restricting access to trusted networks only.

The Hacker News Draft Post

[HIGH] "Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks"

high

Details

Arista Networks has disclosed that a zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO) is being actively exploited in attacks. The flaw allows an attacker who is logged into the orchestrator, even with a low-privileged read-only account, to gain the highest level of control (operator privileges).

Affected Systems

Arista VeloCloud Orchestrator (VCO) On-Prem deployments.

Potential Impact

Exploitation grants an attacker full administrative control over the VeloCloud SD-WAN network, allowing them to reconfigure the network, intercept traffic, and access connected systems.

Mitigations

Arista has released security updates to patch the vulnerability. Organizations with VeloCloud Orchestrator On-Prem deployments should apply the patches immediately.

The Hacker News Draft Post

[CRITICAL] "Capcom confirms data breach affecting 11.7 million accounts"

critical

Details

The Japanese gaming company Capcom confirmed a data breach of its CAPCOM ID membership service. The breach exposed the email addresses and associated information of over 11.7 million customer accounts. Some users have reported unauthorized changes to their accounts.

Affected Systems

The CAPCOM ID membership service and its 11.7 million registered users.

Potential Impact

The exposed personally identifiable information (PII) can be sold and used for sophisticated phishing campaigns, credential stuffing attacks against other services, and identity theft. The incident also carries significant brand and reputational damage for Capcom.

Mitigations

This is a third-party breach. Advise employees to be vigilant about phishing emails related to Capcom. If any employees use their corporate email for a CAPCOM ID, they should be instructed to monitor their accounts for suspicious activity.

BleepingComputer Draft Post

Generated by gemini-2.5-pro