Threat reportSupply ChainTL-2026-4706

Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise

criticalACTIVE

In the week of 2026-10-17 to 2026-10-22, a malicious LiteLLM 1.107.0 release (credential stealer plus GitHub dead-drop backdoor) was published to PyPI and Docker, alongside critical PHP (PHP2Shell), Node.js/Brotli (Node2Shell) and GitLab (CVSS 10.0) RCE patches, unpatched KSMBD disclosures, and eight eMudhra emSign intermediate CAs with trivially recoverable private keys. First disclosed 2026-10-20.

Key facts for LiteLLM 1.107.0 supply chain

Identifiers	TL-2026-4706, CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-110264
Also known as	Cybersecurity Black Week, PHP2Shell, Node2Shell, HTTP2Shell
Severity	CRITICAL
CVSS	10
First disclosed	2026-10-20
Exploitation status	Exploited in the wild; Listed in CISA KEV: CVE-2026-109618 (added 2026-10-26), CVE-2026-109619 (added 2026-10-26), CVE-2026-111497 (added 2026-10-27)
EPSS	CVE-2026-109618: 99.9% (99.9th percentile); CVE-2026-109619: 99.9% (99.9th percentile); CVE-2026-111497: 82.6% (99.6th percentile)
Affected products	BerriAI LiteLLM; PHP Group PHP; OpenJS Foundation Node.js (Brotli decoder); Oven Bun; GitLab GitLab (self-managed); Linux kernel KSMBD (ZDI-CAN-33549, ZDI-CAN-33774); eMudhra emSign intermediate CAs (8 certificates)
Weaknesses (CWE)	CWE-787, CWE-190, CWE-416
Malware	PHP, Python, privcollect
MITRE ATT&CK techniques	T1059.006 Python, T1078 Valid Accounts, T1087.004 Cloud Account, T1102.001 Dead Drop Resolver, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1526 Cloud Service Discovery, T1528 Steal Application Access Token, T1546.018 Python Startup Hooks, T1552.001 Credentials In Files, T1552.004 Private Keys, T1555.003 Credentials from Web Browsers and 4 more in the attack flow
Motivation	UNKNOWN
Target sectors	technology, software development, cloud, ai-ml, government administration, finance
Target regions	Global
Detection rules	9 (1 shown free)
Sources	13 cited sources

Detection coverage for LiteLLM 1.107.0 supply chain

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4706 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LiteLLM 1.107.0 Malicious Install and cook.pth Startup Hook Drop — Exploitation

Detects installation of the compromised litellm 1.107.0 release (PyPI, 2026-10-21) and the artifacts its wheel drops into site-packages: cook.pth (a one-line 'import cook' hook that runs on every Python start), cook.py (the 'privcollect' credential stealer) and the sitecustomize.py backdoor loader. Behaviour-first: fires on the install command line or on the file drops, so it catches hosts and CI runners that pulled the package even if litellm was never imported. Maps to the T1195.002 supply-chain compromise and T1546.018 Python startup-hook persistence in TL-2026-4706.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1195.002, T1546.018, T1059.006, T1552.001
Data sources: sysmon, sysmon_for_linux, microsoft_defender_for_endpoint
Severity: critical
Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 (CommandLine="*litellm==1.107.0*" OR CommandLine="*litellm-1.107.0*") (Image="*pip*" OR Image="*uv" OR Image="*poetry*" OR Image="*python*")) OR (EventCode=11 (TargetFilename="*site-packages*cook.pth" OR TargetFilename="*site-packages*cook.py" OR TargetFilename="*dist-packages*cook.pth" OR TargetFilename="*site-packages*sitecustomize.py")))
| eval indicator=case(EventCode=1, "Malicious litellm 1.107.0 install", match(TargetFilename, "cook[.](pth|py)$"), "cook.pth/cook.py stealer (privcollect) dropped", true(), "sitecustomize.py loader dropped")
| stats min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators values(Image) as processes values(CommandLine) as command_lines values(TargetFilename) as files by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine contains 'litellm==1.107.0' or ProcessCommandLine contains 'litellm-1.107.0'
 | where FileName in~ ('pip', 'pip3', 'uv', 'pipx', 'poetry', 'python', 'python3', 'pip.exe', 'uv.exe', 'python.exe')
 | project Timestamp, DeviceName, AccountName, Indicator = 'Malicious litellm 1.107.0 install', Detail = ProcessCommandLine, Process = FileName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where ActionType in ('FileCreated', 'FileModified')
 | where FolderPath has_any ('site-packages', 'dist-packages')
 | where FileName in~ ('cook.pth', 'cook.py', 'sitecustomize.py')
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Indicator = iff(FileName =~ 'sitecustomize.py', 'sitecustomize.py loader dropped', 'cook.pth/cook.py stealer dropped'), Detail = FolderPath, Process = InitiatingProcessFileName)
| sort by Timestamp desc

Sigma

title: LiteLLM 1.107.0 Malicious cook.pth Startup Hook Dropped in site-packages
id: 7c1d2e4a-5b3f-4a96-8d10-2f6b9c3e7a11
status: experimental
description: Detects creation of cook.pth or cook.py inside a Python site-packages directory, the startup hook and credential stealer (privcollect) shipped in the compromised litellm 1.107.0 wheel (TL-2026-4706).
references:
  - https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker.md
  - https://www.welivesecurity.com/en/business-security/lessons-cybersecurity-black-week/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.persistence
  - attack.t1546.018
  - attack.execution
  - attack.t1059.006
logsource:
  category: file_event
detection:
  selection_dir:
    TargetFilename|contains:
      - 'site-packages'
      - 'dist-packages'
  selection_file:
    TargetFilename|endswith:
      - '/cook.pth'
      - '\cook.pth'
      - '/cook.py'
      - '\cook.py'
  condition: selection_dir and selection_file
falsepositives:
  - An internal package that legitimately ships a module or .pth hook named cook
level: critical

Known false positives:

Internal Python package that legitimately ships a module or .pth hook named cook.py or cook.pth
Debian, conda or managed environments that legitimately provide a site-wide sitecustomize.py
Security scanners or sandboxes that unpack the malicious wheel for analysis

Tuning notes: For a retro-hunt replace earliest=-24h with 2026-10-21 onward (malicious release window 11:39-13:23 UTC) and include CI runners and container build hosts. sitecustomize.py alone is weak evidence in environments that ship their own, so prioritise hosts where it appears alongside cook.pth/cook.py or the 1.107.0 install command. Sysmon for Linux emits the same EventCode 1/11 schema; adjust index and sourcetype to your deployment. Hosts that installed litellm without a pinned version in the release window need a package-inventory check as well.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

Web Runtime Spawning Shell with Download or Recon Commands (PHP2Shell, Node2Shell, GitLab Regex RCE) — Exploitation · unlock with TL Creds
LiteLLM Stealer and Backdoor Runtime Marker Files (.pc_once and remote_code_loader.lock) — Post-Exploitation · unlock with TL Creds
Python Process Egress to [indicator], GitHub Dead-Drop and Community-Observed Sibling Infrastructure — C2 · unlock with TL Creds
GitHub Branch Protection or Ruleset Tampering Preceding a Malicious Release — Exploitation · unlock with TL Creds
Stolen AWS Credential Validation from LiteLLM Attacker IPs (GetCallerIdentity, ListFoundationModels) — Post-Exploitation · unlock with TL Creds
DNS Resolution of [indicator] Lookalike Exfiltration Domain — C2 · unlock with TL Creds
Python Process Sweeping Multiple Credential Stores (privcollect Stealer Behavior) — Post-Exploitation · unlock with TL Creds
LiteLLM Stealer Exfiltration and GitHub Dead-Drop C2 Polling in HTTP Traffic — C2 · unlock with TL Creds

Indicators of compromise for LiteLLM 1.107.0 supply chain

As of 2026-10-29, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-4706.

Sample indicators (3 of 17)

IP address: 168.100.8[.]57
Domain: litellm[.]dev
URL: hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

How LiteLLM 1.107.0 supply chain works

This record consolidates a cluster of independent critical issues summarized in ESET's 'Lessons from Cybersecurity Black Week' (2026-10-28) and corroborated by vendor and researcher write-ups.

LiteLLM supply-chain compromise: on 2026-10-21 a malicious litellm 1.107.0 was published to PyPI (11:39 UTC) and pushed to Docker Hub/GHCR (11:46 UTC; tags v1.107.0, latest, main-latest, main-stable). The package is reported at about 23 million weekly downloads; roughly 49,000 downloads of the malicious version were reported (ClickPy via press). Per LiteLLM, the attackers used stolen GitHub CLI OAuth credentials of three developer accounts, including an organization-owner token, to disable branch protections, force-push, and run a modified release workflow that built from an attacker-controlled lookalike repository. Datadog reports the leaked tokens likely originated from logged response bodies in which Claude Code embedded a user's GitHub CLI OAuth token. The wheels add cook.pth (a one-line 'import cook' hook that runs on every Python start, even if litellm is never imported), cook.py (credential stealer, 'privcollect') and sitecustomize.py (background loader). The stealer harvests SSH keys and shell history, AWS/GCP/Azure/kubeconfig/Docker credentials, CI/CD secrets, AI developer-tool configuration (Claude Code, Cursor, Codex), browser data and the LiteLLM proxy credential database, encrypts it with AES-256 and RSA-4096 and POSTs it to litellm[.]dev/healthcheck. The loader fetches a C2 domain hourly from a GitHub dead-drop (letters9813/pythonclient-test, domain.txt) and executes code returned from <domain>/codepy; Datadog and Mend-cited analysis note no second-stage payload was observed in practice. Attackers validated stolen AWS credentials from 168.100.8.57 and 165.227.201.8 using sts:GetCallerIdentity, bedrock:ListFoundationModels and limited IAM/CloudTrail discovery. PyPI quarantined the release ~13:20-13:23 UTC and Docker images were removed 13:53-14:20 UTC. An earlier, separate compromise (1.82.7/1.82.8, March 2026) was linked by Datadog to TeamPCP; no attribution is made for 1.107.0.

PHP2Shell (CVE-2026-109618, CVE-2026-109619; CVSS 4.0 9.2): memory corruption after out-of-memory during multipart body parsing, and a stale global state flaw, both enabling unauthenticated RCE before application code runs. PHP 5.4-8.5.11 affected; fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (source-only backports for 7.4, 8.0, 8.1) on 2026-10-21. Amazon Threat Intelligence MadPot recorded an exploitation attempt on 2026-10-17, four days before disclosure; Sansec and ESET report public PoCs failed against default installations.

Node2Shell (CVE-2026-111497; CVSS 4.0 9.2): out-of-bounds write in the Brotli decoder triggered by a crafted stream; reported by OpenAI Codex Security; fixed in Node.js 22.23.4, 24.22.1, 26.12.1, Bun 1.4.4+ and Brotli 1.2.1 (also 1.0.10, 1.1.1). EOL Node lines get no fix. Aikido demonstrated RCE on Node.js 24.22.0. Python Brotli packages, Bun and Envoy are also exposed.

GitLab CVE-2026-110264 (CVSS 10.0): integer overflow in the Onigmo regex engine's repetition-group IDs when compiling a crafted regular expression, reachable unauthenticated through rendered content (Org mode files, wikis, Markdown). GitLab 7.0 through 19.5.0 affected; fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (older backports carry only the critical fix).

Linux KSMBD: ZDI-CAN-33549 (integer underflow in SMB Direct, requires RDMA) and ZDI-CAN-33774 (race condition) both CVSS 9.0 RCE; technical details were published 2026-10-21 before fixes were ready.

eMudhra emSign: eight intermediate CA certificates (six TLS, two code signing) had P-384 private keys with values below 256, so anyone can compute them from the public certificates; the weak keys came from an error in a certificate-generation script (April 2025). Reported 2026-10-17; Mozilla (OneCRL, Firefox 158.0.1), Chrome and Apple blocked them; certifi 2026.10.19 and webpki-roots 1.0.10 removed emSign ECC Root CA - G3. python.org and pypi.org trust paths were exposed to MITM; no evidence of exploitation was reported.

MITRE ATT&CK techniques by tactic:

Remediation for LiteLLM 1.107.0 supply chain

Patches

PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4+; Brotli 1.2.1
GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
certifi 2026.10.19, pip 26.2.2, uv 0.13.4; Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, 3.11.18
Firefox 158.0.1 and current Chrome/Apple trust-store updates

Immediate actions

Remove litellm 1.107.0 and any image tagged v1.107.0/latest/main-latest/main-stable pulled on 2026-10-21; treat affected hosts and CI runners as compromised
Hunt for cook.pth, cook.py, sitecustomize.py in site-packages, /tmp/.pc_once_* and /tmp/remote_code_loader.lock without executing Python
Block litellm.dev and review egress to the GitHub dead-drop path letters9813/pythonclient-test
Rotate cloud, SSH, GitHub, CI/CD, LLM provider and LiteLLM proxy credentials from a clean system; review CloudTrail for GetCallerIdentity from 168.100.8.57 and 165.227.201.8
Patch PHP, Node.js/Bun/Brotli and GitLab to fixed releases

Workarounds

Pin litellm==1.106.2 or earlier
Restrict KSMBD exposure and RDMA interfaces until kernel fixes ship
Retire EOL Node.js lines that receive no Brotli fix

Longer-term hardening

Pin container images by digest and Python packages by hash; verify exact wheel versions before build integration
Restrict and monitor GitHub CLI OAuth token scope; avoid logging response bodies that can contain tokens
Rebuild containers without layer cache after trust-store updates

Affected and fixed versions

BerriAI — LiteLLM
Vulnerable versions: 1.107.0 (PyPI); Docker tags v1.107.0, latest, main-latest, main-stable
Fixed in: 1.106.2 and earlier (pin); remove 1.107.0
PHP Group — PHP
Vulnerable versions: 5.4 through 8.5.11
Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35
OpenJS Foundation — Node.js (Brotli decoder)
Vulnerable versions: Node.js 22.x < 22.23.4; 24.x < 24.22.1; 26.x < 26.12.1; EOL lines 25.x and earlier
Fixed in: 22.23.4; 24.22.1; 26.12.1
Oven — Bun
Vulnerable versions: < 1.4.4
Fixed in: 1.4.4
GitLab — GitLab (self-managed)
Vulnerable versions: 7.0 through 19.5.0
Fixed in: 19.5.1; 19.4.3; 19.3.6; 19.2.9; 19.1.9; 19.0.10; 18.11.13
Linux kernel — KSMBD (ZDI-CAN-33549, ZDI-CAN-33774)
Vulnerable versions: versions with KSMBD enabled at disclosure
eMudhra — emSign intermediate CAs (8 certificates)
Vulnerable versions: certifi < 2026.10.19; webpki-roots < 1.0.10
Fixed in: certifi 2026.10.19; webpki-roots 1.0.10

Timeline of LiteLLM 1.107.0 supply chain

2026-10-17 Amazon Threat Intelligence MadPot honeypots record a PHP2Shell exploitation attempt four days before public disclosure.
2026-10-17 Researcher reports that eight locked-ioc-17 emSign intermediate CA private keys (P-384, values below 256) are computable; Mozilla blocks via OneCRL and Chrome blocks six intermediates the same day.
2026-10-19 LiteLLM release permissions are temporarily expanded for two internal engineers, preceding the pipeline compromise.
2026-10-20 Mozilla releases Firefox 158.0.1 distrusting the compromised locked-ioc-17 intermediates.
2026-10-21 Between 16:20 and 17:01 UTC attackers validate stolen AWS credentials from locked-ioc-11 and locked-ioc-10 using sts:GetCallerIdentity and bedrock:ListFoundationModels.
2026-10-21 PyPI quarantines the malicious release (~13:20-13:23 UTC) and Docker images are removed (13:53-14:20 UTC); the attacker's GitHub dead-drop repository is removed around 13:30 UTC.
2026-10-21 PHP (8.5.12, 8.4.27, 8.3.36, 8.2.35), Node.js (22.23.4, 24.22.1, 26.12.1), Brotli 1.2.1 and GitLab (19.5.1 and backports) ship fixes; ZDI KSMBD technical details are published before kernel fixes.
2026-10-21 Malicious litellm 1.107.0 is published to PyPI at 11:39 UTC and to Docker Hub/GHCR at 11:46 UTC after attackers abuse stolen GitHub CLI OAuth tokens to alter the release workflow.
2026-10-22 Apple adds protections against the compromised locked-ioc-17 certificates; NBC News reports no observed PHP2Shell attacks at that point; oss-security posts the emSign disclosure.
2026-10-28 ESET WeLiveSecurity publishes 'Lessons from Cybersecurity Black Week' summarizing the cluster and urging patching and credential rotation.