PHP2Shell RCE Exploited Hours Before Patch as LiteLLM Wheel Ships Stealer

PHP2Shell RCE Exploited Five Hours Before Patches Went Public

PHP released fixes on 21 October 2026 for two unauthenticated remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and nicknamed PHP2Shell after a leaked exploit tool. The first PHP2Shell request reached ELLIO sensors at 08:36 UTC, five and a half hours before the fix was public. One bug corrupts memory when PHP runs out of memory mid-request; the other leaves stale global state a later request on the same worker can read. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; 8.1 and earlier get no fix. By 23:00 UTC, 33 addresses had sent 743 probing requests, and tooling was assembling a working chain in the open.

PHP2Shell: critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | ELLIO | ELLIO Blog →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates

LiteLLM 1.107.0 on PyPI Planted Credential Stealer and Backdoor

The LiteLLM 1.107.0 release on PyPI carried a credential stealer and a remote code execution backdoor in all seven wheels, installed as three files in site-packages that run whenever any Python process starts, even one that never imports litellm. The upstream GitHub source does not contain them, and PyPI has since removed the release. cook.pth imports a stealer harvesting SSH keys, cloud credentials, CI/CD secrets, browser passwords and LLM provider keys, encrypting them and posting to www.litellm[.]dev. sitecustomize.py runs an hourly daemon fetching a server address from a GitHub file. SafeDep assesses with moderate to high confidence that BerriAI’s private release pipeline built the wheels from attacker-modified source.

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor - Real-time Open Source Software Supply Chain Security →

Topics: AI supply chain attacksSupply chain attacks

APT28 Breached NATO Naval Shipbuilder With Invisible Edge Backdoor

Russia’s GRU Unit 26165, tracked as APT28/Swallowtail, breached three NATO defense organizations between July 24 and at least September 24, 2026, including a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency, per Symantec’s Threat Hunter Team. Initial access came via a macro-enabled Word document opened from the Outlook attachment cache at the shipbuilder on July 24. A batch-script backdoor called HOOKEDGE relaunched Microsoft Edge with a 1-pixel-by-1-pixel off-screen window, passing a base64 JavaScript payload that fetched instructions from webhook.site. Operators later pushed an SSH key, opened a reverse tunnel over port 80 and captured NTLM handshakes. Beaconing continued through September 24.

Russia Weaponized Microsoft Edge to Breach NATO Naval Shipbuilder in Two-Month Espionage Campaign →

Topics: State-sponsored hacking

FBI and CISA Warn SafePay Ransomware Hit at Least 600 Organizations

Federal agencies warn that the SafePay ransomware operation has affected at least 600 organizations worldwide, including critical infrastructure companies. In an October 20 announcement, CISA joined the FBI, U.S. Secret Service and law enforcement partners in Germany and the United Kingdom to warn about the group, active since August 2024 and among the most active ransomware operations in 2026. SafePay uses double extortion, stealing data before encryption, and gains access via stolen credentials, password guessing, VPN flaws and phishing. It moves through networks with PowerShell, Remote Desktop Protocol and Windows Remote Management, sometimes targeting backups. Authorities stress that paying a ransom guarantees nothing.

FBI Warns SafePay Ransomware Has Hit 600 Organizations — Here’s How Businesses Can Protect Themselves →

Topics: Ransomware

Court Records Show DHS Misled GrapheneOS Activist Over Airport Phone Search

Newly submitted federal court records show the Department of Homeland Security misrepresented why agents stopped Samuel Tunick at an Atlanta airport, demanded his phone passcode and then charged him with a federal felony when a security feature wiped the device. An internal HSI email filed in the Northern District of Georgia shows agents were investigating Tunick for suspected terrorism linked to his Stop Cop City activism; the child-exploitation accusation made to his face had no factual basis. Tunick faces one felony count under 18 U.S.C. § 2232(a) after providing his GrapheneOS duress password, triggering an irreversible wipe. A magistrate judge is expected to rule no earlier than late October 2026.

Court Records Reveal DHS Lied About Motive in GrapheneOS Activist Border Case →