# October 21 Roundup: PHP2Shell (CVE-2026-109618/109619), LiteLLM 1.107.0 Supply-Chain Backdoor, Palo Alto GlobalProtect CVE-2026-0257 Exploitation

> Three concurrent defender-relevant events: PHP2Shell (CVE-2026-109618/109619, CVSS v4.0 9.2 each) unauthenticated RCE in PHP with attack attempts reported before and after disclosure; the LiteLLM 1.107.0 PyPI/Docker supply-chain compromise that stole cloud, SSH and AI-tool credentials via Python startup hooks; and ransomware-affiliate exploitation of Palo Alto GlobalProtect CVE-2026-0257 (authentication/MFA bypass) leading to vCenter/ESXi abuse and offline domain controller credential extraction.

- **Published:** 2026-10-23T09:33:00Z
- **Last reviewed:** 2026-10-23T09:33:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4251
- **ID:** TL-2026-4251
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-101296, CVE-2026-0257

## Description

PHP2Shell: Two PHP memory-safety flaws allow unauthenticated remote code execution as the web worker account with a crafted request. CVE-2026-109618 is an out-of-memory handling flaw: PHP can be interrupted while internal request data is only partially initialized and request cleanup then treats the invalid data as valid. CVE-2026-109619 is stale request state: request-owned internal state survives after its backing memory is freed and a later request handled by the same worker uses it before initialization resets it (use-after-free / memory disclosure). Researchers demonstrated code execution against Apache mod_php before application code runs. All web-serving SAPIs are in scope (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed), with mod_php at greatest risk. Fixes shipped 2026-10-21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier get no official patch (Huntress suggests session.upload_progress.enabled=Off as a mitigation for EOL builds). Details leaked on 2026-10-20 before the embargo; Amazon Threat Intelligence recorded an attempt on 2026-10-17 and Cloudflare reported early attack attempts without confirmed compromise. No public PoC was confirmed and no confirmed IOCs exist yet.

LiteLLM 1.107.0: Stolen GitHub CLI OAuth tokens from three engineers were used to run the project-releaser workflow (one account triggered, another approved) against a lookalike repository, Berri-AI/litellm (hyphenated; legitimate is BerriAI/litellm). Malicious commits at 09:48 and 10:46 UTC on 2026-10-21 added a Maturin data directive and Dockerfile COPY for a 'cook' payload. All seven wheels of litellm 1.107.0 (PyPI live 11:39-13:23 UTC) and container tags v1.107.0, latest, main-latest and main-stable (GHCR/Docker Hub, live roughly 11:46-14:20 UTC) shipped site-packages/cook.pth (a single 'import cook' line), cook.py and sitecustomize.py. The .pth hook runs on every Python start regardless of whether litellm is imported, so removing the package does not remove the malware. The collector gathers system data, browser credentials and cookies, SSH/GPG/TLS keys, AWS/Azure/GCP credentials and metadata, Kubernetes/Docker, Git/npm/PyPI/CI secrets, sessions of AI coding tools (Claude, Codex, Gemini, Cursor, Copilot, Windsurf, Kiro, Zed, Amazon Q) and, when DATABASE_URL is set, the LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable. Data is gzip-tarred, encrypted AES-256-CBC with an RSA-4096 wrapped key and POSTed to www.litellm.dev/healthcheck with an X-Token header. A second stage in sitecustomize.py polls a GitHub raw pointer (letters9813/pythonclient-test domain.txt) hourly, fetches Python from http://<domain>/codepy and exec()s it without signature verification; the pointer only held test values so the RAT stage reportedly never executed in the wild. Stolen AWS credentials were used about four and a half hours after theft. Last safe version is 1.106.2; clean rebuilds and credential rotation are required. This is the second 2026 LiteLLM compromise; no link to the earlier TeamPCP-linked incident is established.

Palo Alto GlobalProtect CVE-2026-0257: PAN-OS GlobalProtect portal/gateway (and Prisma Access) accept forged authentication override cookies when GlobalProtect is enabled, authentication override cookies are enabled and the cookie certificate is reused or its public key is exposed (for example the portal HTTPS certificate). An unauthenticated attacker can forge a cookie, skip credentials and MFA and establish a VPN session. Disclosed 2026-05-13 with CVSS 4.7, exploit attempts seen from 2026-05-17, CVSS raised to 7.8 and CISA KEV listing on 2026-05-29 after Rapid7 published analysis and a PoC. Qilin, Inc and Settra ransomware operators and initial access brokers exploit it against healthcare, education, government and energy. Observed post-exploitation: rapid config retrieval, IPsec tunnel establishment, Impacket and NTLM relay lateral movement, Cobalt Strike, BloodHound/SharpHound, abuse of Veeam (CVE-2023-27532), pivot to VMware vCenter, weakening ESXi controls and offline extraction of credentials from domain controller virtual disks, which bypasses in-guest EDR. A VPN client hostname of 'kali' is a hunting indicator.

Also in the roundup: CVE-2026-111497 (Node.js Brotli out-of-bounds memory write enabling code execution) and CVE-2026-101296 (Apache Tomcat JNDIRealm authentication bypass with non-GSSAPI SASL mechanisms). Other items (Next.js RCE fixes, eMudhra CA key compromise, Plex2Shell, State Bank of India data) are only secondarily sourced and not modelled in depth.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1133 External Remote Services
- T1059.006 Command and Scripting Interpreter: Python
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1003.003 OS Credential Dumping: NTDS
- T1005 Data from Local System
- T1573.002 Encrypted Channel: Asymmetric Cryptography

## Sources

- [October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks](https://cybersecuritynews.com/october-21-cybersecurity-nightmare/)
- [LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI and Proxy Credentials (Endor Labs)](https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials)
- [LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials (Socket)](https://socket.dev/blog/litellm-compromise)
- [LiteLLM compromised on PyPI and Docker (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/)
- [litellm compromised in supply chain (The Hacker News)](https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html)
- [Arctic Wolf Security Bulletin: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass](https://arcticwolf.com/resources/blog/cve-2026-0257-pan-os-globalprotect-authentication-bypass/)
- [Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June (Help Net Security)](https://www.helpnetsecurity.com/?p=388600)
- [Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks (BleepingComputer)](https://bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks)
- [Rapid Response: PHP2Shell, Leaked Critical PHP Vulnerabilities (Huntress)](https://huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities)
- [PHP2Shell: PHP vulnerabilities patched, CVE-2026-109618 and CVE-2026-109619 (Help Net Security)](https://helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619)
- [PHP2Shell: Critical Vulnerabilities in PHP (Endor Labs)](https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4251