Threat reportVulnerabilityTL-2026-4251
October 21 Roundup: PHP2Shell (CVE-2026-109618/109619), LiteLLM 1.107.0 Supply-Chain Backdoor, Palo Alto GlobalProtect CVE-2026-0257 Exploitation
October 21 Roundup (TL-2026-4251), also tracked as PHP2Shell, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-23. It has no confirmed attribution, affects PHP Group PHP (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed), references 5 CVEs (CVE-2026-109618, CVE-2026-109619, CVE-2026-111497), maps to 14 MITRE ATT&CK techniques (T1003.003, T1005, T1036.005), and is covered by 9 detection rules and 27 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4251
- Threat ID
- TL-2026-4251
- Also known as
- PHP2Shell, LiteLLM 1.107.0 compromise
- Severity
- CRITICAL
- CVSS
- 9.2
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud, health, education, government administration, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in October 21 Roundup
Malware and tooling: PHP, Cobalt Strike
How October 21 Roundup works
Three concurrent defender-relevant events: PHP2Shell (CVE-2026-109618/109619, CVSS v4.0 9.2 each) unauthenticated RCE in PHP with attack attempts reported before and after disclosure; the LiteLLM 1.107.0 PyPI/Docker supply-chain compromise that stole cloud, SSH and AI-tool credentials via Python startup hooks; and ransomware-affiliate exploitation of Palo Alto GlobalProtect CVE-2026-0257 (authentication/MFA bypass) leading to vCenter/ESXi abuse and offline domain controller credential extraction.
PHP2Shell: Two PHP memory-safety flaws allow unauthenticated remote code execution as the web worker account with a crafted request. CVE-2026-109618 is an out-of-memory handling flaw: PHP can be interrupted while internal request data is only partially initialized and request cleanup then treats the invalid data as valid. CVE-2026-109619 is stale request state: request-owned internal state survives after its backing memory is freed and a later request handled by the same worker uses it before initialization resets it (use-after-free / memory disclosure). Researchers demonstrated code execution against Apache mod_php before application code runs. All web-serving SAPIs are in scope (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed), with mod_php at greatest risk. Fixes shipped 2026-10-21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier get no official patch (Huntress suggests session.upload_progress.enabled=Off as a mitigation for EOL builds). Details leaked on 2026-10-20 before the embargo; Amazon Threat Intelligence recorded an attempt on 2026-10-17 and Cloudflare reported early attack attempts without confirmed compromise. No public PoC was confirmed and no confirmed IOCs exist yet.
LiteLLM 1.107.0: Stolen GitHub CLI OAuth tokens from three engineers were used to run the project-releaser workflow (one account triggered, another approved) against a lookalike repository, Berri-AI/litellm (hyphenated; legitimate is BerriAI/litellm). Malicious commits at 09:48 and 10:46 UTC on 2026-10-21 added a Maturin data directive and Dockerfile COPY for a 'cook' payload. All seven wheels of litellm 1.107.0 (PyPI live 11:39-13:23 UTC) and container tags v1.107.0, latest, main-latest and main-stable (GHCR/Docker Hub, live roughly 11:46-14:20 UTC) shipped site-packages/cook.pth (a single 'import cook' line), cook.py and sitecustomize.py. The .pth hook runs on every Python start regardless of whether litellm is imported, so removing the package does not remove the malware. The collector gathers system data, browser credentials and cookies, SSH/GPG/TLS keys, AWS/Azure/GCP credentials and metadata, Kubernetes/Docker, Git/npm/PyPI/CI secrets, sessions of AI coding tools (Claude, Codex, Gemini, Cursor, Copilot, Windsurf, Kiro, Zed, Amazon Q) and, when DATABASE_URL is set, the LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable. Data is gzip-tarred, encrypted AES-256-CBC with an RSA-4096 wrapped key and POSTed to www.litellm.dev/healthcheck with an X-Token header. A second stage in sitecustomize.py polls a GitHub raw pointer (letters9813/pythonclient-test domain.txt) hourly, fetches Python from http://<domain>/codepy and exec()s it without signature verification; the pointer only held test values so the RAT stage reportedly never executed in the wild. Stolen AWS credentials were used about four and a half hours after theft. Last safe version is 1.106.2; clean rebuilds and credential rotation are required. This is the second 2026 LiteLLM compromise; no link to the earlier TeamPCP-linked incident is established.
Palo Alto GlobalProtect CVE-2026-0257: PAN-OS GlobalProtect portal/gateway (and Prisma Access) accept forged authentication override cookies when GlobalProtect is enabled, authentication override cookies are enabled and the cookie certificate is reused or its public key is exposed (for example the portal HTTPS certificate). An unauthenticated attacker can forge a cookie, skip credentials and MFA and establish a VPN session. Disclosed 2026-05-13 with CVSS 4.7, exploit attempts seen from 2026-05-17, CVSS raised to 7.8 and CISA KEV listing on 2026-05-29 after Rapid7 published analysis and a PoC. Qilin, Inc and Settra ransomware operators and initial access brokers exploit it against healthcare, education, government and energy. Observed post-exploitation: rapid config retrieval, IPsec tunnel establishment, Impacket and NTLM relay lateral movement, Cobalt Strike, BloodHound/SharpHound, abuse of Veeam (CVE-2023-27532), pivot to VMware vCenter, weakening ESXi controls and offline extraction of credentials from domain controller virtual disks, which bypasses in-guest EDR. A VPN client hostname of 'kali' is a hunting indicator.
Also in the roundup: CVE-2026-111497 (Node.js Brotli out-of-bounds memory write enabling code execution) and CVE-2026-101296 (Apache Tomcat JNDIRealm authentication bypass with non-GSSAPI SASL mechanisms). Other items (Next.js RCE fixes, eMudhra CA key compromise, Plex2Shell, State Bank of India data) are only secondarily sourced and not modelled in depth.
MITRE ATT&CK techniques used in TL-2026-4251
Credential Access
T1003.003 OS Credential Dumping: NTDS; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Collection
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location
Execution
T1059.006 Command and Scripting Interpreter: Python
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
lateral-movement
T1550.004 Use Alternate Authentication Material: Web Session Cookie
Command and Control
T1573.002 Encrypted Channel: Asymmetric Cryptography
defense-impairment
Affected products and versions in October 21 Roundup
- PHP Group — PHP (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed)
Vulnerable versions: 8.5.11 and earlier; 8.1 and earlier (unpatched, EOL)
Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35 - BerriAI — LiteLLM (PyPI wheels and ghcr.io/docker.io container images)
Vulnerable versions: 1.107.0; container tags v1.107.0, latest, main-latest, main-stable (during compromise window)
Fixed in: 1.106.2 (last safe) - Palo Alto Networks — PAN-OS GlobalProtect portal/gateway and Prisma Access
Vulnerable versions: PAN-OS 12.1 < 12.1.4-h6 / 12.1.7; PAN-OS 11.2 < 11.2.12 and earlier hotfix trains; PAN-OS 11.1 < 11.1.15 and earlier hotfix trains; PAN-OS 10.2 < 10.2.18-h6 and earlier hotfix trains; Prisma Access 11.2.0 < 11.2.7-h13; Prisma Access 10.2.0 < 10.2.10-h36
Fixed in: 12.1.4-h6; 12.1.7; 11.2.12; 11.1.15; 10.2.18-h6; Prisma Access 11.2.7-h13; Prisma Access 10.2.10-h36 - OpenJS Foundation — Node.js (Brotli, CVE-2026-111497)
Vulnerable versions: see Node.js security release
Fixed in: see Node.js security release - Apache Software Foundation — Tomcat (JNDIRealm with non-GSSAPI SASL, CVE-2026-101296)
Vulnerable versions: see Tomcat security bulletin
Fixed in: see Tomcat security bulletin
Remediation for October 21 Roundup
Patches
- PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
- litellm 1.106.2 (last known safe version)
- PAN-OS 12.1.4-h6/12.1.7, 11.2.4-h17/11.2.7-h14/11.2.10-h7/11.2.12, 11.1.15 and later, 10.2.18-h6 and later (see Palo Alto advisory for full list)
Immediate actions
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; apply WAF rules for PHP2Shell where available
- Identify any host or container that installed litellm 1.107.0 or pulled the latest/main-latest/main-stable/v1.107.0 images on 2026-10-21; isolate and rebuild clean
- Delete site-packages/cook.pth, cook.py and sitecustomize.py from every affected Python environment and rotate all cloud, SSH, GitHub, PyPI/npm, LLM provider and AI-tool credentials reachable from those hosts
- Patch PAN-OS GlobalProtect to a fixed release and disable authentication override cookies if not required
- Hunt GlobalProtect logs for sessions from the listed IPs or with hostname 'kali'; review vCenter/ESXi admin activity and DC virtual disk access
Workarounds
- EOL PHP: set session.upload_progress.enabled = Off and monitor PHP workers spawning shells or download utilities
- GlobalProtect: do not reuse the portal HTTPS certificate for authentication override cookies; restrict portal/gateway to trusted source ranges
- Block egress to www.litellm.dev and alert on raw.githubusercontent.com/letters9813 requests
Longer-term hardening
- Pin Python dependencies by hash and enforce a package cooldown before adopting new releases
- Harden release pipelines: protect GitHub CLI OAuth tokens, require independent approvers, verify release repository provenance
- Restrict VPN portal exposure and use dedicated certificates for cookie encryption
- Isolate vCenter/ESXi management planes and monitor datastore/VMDK access
CVEs associated with October 21 Roundup
CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-101296, CVE-2026-0257
Weaknesses (CWE) in October 21 Roundup
Timeline of October 21 Roundup
- Palo Alto Networks discloses PAN-OS GlobalProtect CVE-2026-0257 (initial CVSS 4.7).
- First exploitation attempts against CVE-2026-0257 confirmed.
- Rapid7 publishes analysis and PoC; CVSS raised to 7.8 and CISA adds CVE-2026-0257 to the KEV catalog.
- Amazon Threat Intelligence records a PHP2Shell exploitation attempt from an anonymized IP, four days before public disclosure.
- PHP2Shell details leak before the embargo; the PHP project publishes an out-of-cycle notice.
- Reporting on ransomware groups (Qilin, Inc, Settra) exploiting CVE-2026-0257 with vCenter/ESXi and domain controller disk credential extraction.
- PHP releases fixes 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Cloudflare deploys WAF rules and reports early attack attempts.
- 11:39 UTC: litellm 1.107.0 published to PyPI; Socket's scanner flags it about 7 minutes later; wheels live until about 13:23 UTC and Docker tags until about 14:20 UTC.
- 09:48 and 10:46 UTC: malicious commits in the lookalike Berri-AI/litellm repository add the cook payload; release workflow builds run 10:51-11:06 UTC.
- Cybersecurity News roundup consolidates PHP2Shell, LiteLLM and GlobalProtect activity; stolen AWS credentials from LiteLLM victims were used about 4.5 hours after theft.
Sources cited for October 21 Roundup
- October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks
- LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI and Proxy Credentials (Endor Labs)
- LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials (Socket)
- LiteLLM compromised on PyPI and Docker (Datadog Security Labs)
- litellm compromised in supply chain (The Hacker News)
- Arctic Wolf Security Bulletin: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass
- Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June (Help Net Security)
- Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks (BleepingComputer)
- Rapid Response: PHP2Shell, Leaked Critical PHP Vulnerabilities (Huntress)
- PHP2Shell: PHP vulnerabilities patched, CVE-2026-109618 and CVE-2026-109619 (Help Net Security)
- PHP2Shell: Critical Vulnerabilities in PHP (Endor Labs)
Detection coverage for TL-2026-4251
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4251 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4251
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.