TL;DR
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) are [exploitation unverified] in the wild; GitLab's 12-year-old RCE flaw (CVSS 10.0) affects all self-managed versions; and LiteLLM supply-chain compromise delivers credential stealer and backdoor to thousands of Python environments.
Executive Summary
- PHP Foundation released emergency patches for two critical remote-code-execution vulnerabilities affecting nearly 70% of all websites; exploitation attempts detected before patches were released.
- GitLab disclosed a CVSS 10.0 unauthenticated RCE flaw affecting every version from 7.0 (2014) through current releases; October 12 patches do not protect against this flaw.
- LiteLLM Python package compromised in supply-chain attack delivering credential stealer and backdoor via PyPI wheels and Docker images.
- Google Chrome adds Gemini-powered defenses and ClickFix warnings to mitigate social-engineering attacks.
- Lazarus APT group adopts post-quantum cryptography for malware delivery in new campaigns.
Top Threats Today
1. PHP Critical RCE Vulnerabilities Under [exploitation unverified]
Severity: CRITICAL Affected: Technology
The PHP Foundation has released emergency patches for two critical remote-code-execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated attackers to execute arbitrary code on affected servers [1]. The vulnerabilities are collectively referred to as “PHP2Shell” [1]. Nearly 70 percent of websites running PHP require immediate updates [1]. Cybersecurity companies detected exploitation attempts targeting both CVEs before patches became available [2], indicating active in-the-wild exploitation risk. The fixes are deployed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . ⚠
Sources:[1] Krebs on Security[2] SecurityWeek
Recommended Action
- Immediately update PHP to patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) [4]
- Monitor web application logs for signs of exploitation attempts targeting PHP processes
- If patching is delayed, consider temporarily disabling affected PHP services or restricting network access
2. GitLab Unauthenticated RCE Affecting All Self-Managed Releases Since 2014
Severity: CRITICAL Affected: Technology
GitLab released fixes on October 21 for a critical vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute code on self-managed GitLab servers [1]. The flaw affects every version of GitLab from 7.0 (released in 2014) through current releases [1]. Organizations that applied the October 12 security update remain vulnerable to this specific flaw, as that earlier patch does not address it [1].
Sources:[1] The Hacker News
Recommended Action
- Apply the October 21 GitLab security patch immediately to all self-managed instances, regardless of prior patch status
- Review access logs for evidence of exploitation or unauthorized code execution
- Restrict network access to GitLab administrative interfaces pending patching
3. LiteLLM Supply-Chain Compromise Delivers Credential Stealer and Backdoor
Severity: CRITICAL Affected: Technology
The widely-used LiteLLM Python package was compromised in a supply-chain attack that delivered both a credential stealer and backdoor [1]. The compromise affects LiteLLM version 1.107.0 distributed through PyPI wheels and Docker images, according to reports from SafeDep, Socket, StepSecurity, and Upwind ⚠ [1]. This represents a critical threat to any Python environment that installed or pulled the affected package version.
Sources:[1] The Hacker News
Recommended Action
- Immediately audit Python environments and container registries for LiteLLM 1.107.0; remove and replace with a clean version
- Rotate all credentials and API keys used by systems running LiteLLM
- Review process execution logs and network connections from systems running the compromised package for signs of backdoor activity
- Monitor for credential usage from affected systems in unauthorized contexts
4. Lazarus APT Adopts Post-Quantum Cryptography for Malware Delivery
Severity: HIGH Affected: Defense
North Korean threat actor Lazarus is using post-quantum cryptographic mechanisms to secure malicious payload delivery in new operations that combine old and new malware [1]. This represents an escalation in operational security sophistication and suggests sustained capability to conduct advanced cryptographic evasion.
Sources:[1] BleepingComputer
Recommended Action
- Review threat intelligence for Lazarus campaign indicators and IOCs
- Monitor network traffic and endpoints for anomalous cryptographic patterns or unknown encryption schemes
- Coordinate with government and sector-specific information-sharing communities for updated Lazarus attribution data
5. Google Chrome Adds ClickFix and Scam Protections
Severity: HIGH Affected: Technology
Google announced that Chrome is rolling out improved safeguards against ClickFix social-engineering attacks when Enhanced Protection is enabled [1]. The browser now uses Gemini-powered analysis to detect deceptive websites and warns users when they copy suspicious commands from compromised or malicious web pages [2]. This addresses a common attack vector in which adversaries trick users into pasting malicious code into terminals or command-line interfaces.
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Ensure Chrome Enhanced Protection is enabled organization-wide via policy
- Educate users about ClickFix risks and the importance of understanding code before pasting into terminals
- Monitor for and block execution of suspicious commands from web-based sources
Today’s Action Checklist
- ☐ URGENT: Apply PHP emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) to all web servers and verify successful deployment
- ☐ URGENT: Apply GitLab October 21 security patch to all self-managed instances, including those already patched on October 12
- ☐ URGENT: Audit Python/PyPI environments for LiteLLM 1.107.0; remove and rotate all associated credentials
- ☐ Review web application logs and process execution logs for signs of PHP and GitLab exploitation
- ☐ Enable Chrome Enhanced Protection organization-wide and reinforce user training on ClickFix risks