# Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise

> In the week of 2026-10-17 to 2026-10-22, a malicious LiteLLM 1.107.0 release (credential stealer plus GitHub dead-drop backdoor) was published to PyPI and Docker, alongside critical PHP (PHP2Shell), Node.js/Brotli (Node2Shell) and GitLab (CVSS 10.0) RCE patches, unpatched KSMBD disclosures, and eight eMudhra emSign intermediate CAs with trivially recoverable private keys.

- **Published:** 2026-10-29T05:56:59Z
- **Last reviewed:** 2026-10-29T05:56:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4706
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4706.png
- **ID:** TL-2026-4706
- **Severity:** CRITICAL (CVSS 10)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-110264

## Description

This record consolidates a cluster of independent critical issues summarized in ESET's 'Lessons from Cybersecurity Black Week' (2026-10-28) and corroborated by vendor and researcher write-ups.

LiteLLM supply-chain compromise: on 2026-10-21 a malicious litellm 1.107.0 was published to PyPI (11:39 UTC) and pushed to Docker Hub/GHCR (11:46 UTC; tags v1.107.0, latest, main-latest, main-stable). The package is reported at about 23 million weekly downloads; roughly 49,000 downloads of the malicious version were reported (ClickPy via press). Per LiteLLM, the attackers used stolen GitHub CLI OAuth credentials of three developer accounts, including an organization-owner token, to disable branch protections, force-push, and run a modified release workflow that built from an attacker-controlled lookalike repository. Datadog reports the leaked tokens likely originated from logged response bodies in which Claude Code embedded a user's GitHub CLI OAuth token. The wheels add cook.pth (a one-line 'import cook' hook that runs on every Python start, even if litellm is never imported), cook.py (credential stealer, 'privcollect') and sitecustomize.py (background loader). The stealer harvests SSH keys and shell history, AWS/GCP/Azure/kubeconfig/Docker credentials, CI/CD secrets, AI developer-tool configuration (Claude Code, Cursor, Codex), browser data and the LiteLLM proxy credential database, encrypts it with AES-256 and RSA-4096 and POSTs it to litellm[.]dev/healthcheck. The loader fetches a C2 domain hourly from a GitHub dead-drop (letters9813/pythonclient-test, domain.txt) and executes code returned from <domain>/codepy; Datadog and Mend-cited analysis note no second-stage payload was observed in practice. Attackers validated stolen AWS credentials from 168.100.8.57 and 165.227.201.8 using sts:GetCallerIdentity, bedrock:ListFoundationModels and limited IAM/CloudTrail discovery. PyPI quarantined the release ~13:20-13:23 UTC and Docker images were removed 13:53-14:20 UTC. An earlier, separate compromise (1.82.7/1.82.8, March 2026) was linked by Datadog to TeamPCP; no attribution is made for 1.107.0.

PHP2Shell (CVE-2026-109618, CVE-2026-109619; CVSS 4.0 9.2): memory corruption after out-of-memory during multipart body parsing, and a stale global state flaw, both enabling unauthenticated RCE before application code runs. PHP 5.4-8.5.11 affected; fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (source-only backports for 7.4, 8.0, 8.1) on 2026-10-21. Amazon Threat Intelligence MadPot recorded an exploitation attempt on 2026-10-17, four days before disclosure; Sansec and ESET report public PoCs failed against default installations.

Node2Shell (CVE-2026-111497; CVSS 4.0 9.2): out-of-bounds write in the Brotli decoder triggered by a crafted stream; reported by OpenAI Codex Security; fixed in Node.js 22.23.4, 24.22.1, 26.12.1, Bun 1.4.4+ and Brotli 1.2.1 (also 1.0.10, 1.1.1). EOL Node lines get no fix. Aikido demonstrated RCE on Node.js 24.22.0. Python Brotli packages, Bun and Envoy are also exposed.

GitLab CVE-2026-110264 (CVSS 10.0): integer overflow in the Onigmo regex engine's repetition-group IDs when compiling a crafted regular expression, reachable unauthenticated through rendered content (Org mode files, wikis, Markdown). GitLab 7.0 through 19.5.0 affected; fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (older backports carry only the critical fix).

Linux KSMBD: ZDI-CAN-33549 (integer underflow in SMB Direct, requires RDMA) and ZDI-CAN-33774 (race condition) both CVSS 9.0 RCE; technical details were published 2026-10-21 before fixes were ready.

eMudhra emSign: eight intermediate CA certificates (six TLS, two code signing) had P-384 private keys with values below 256, so anyone can compute them from the public certificates; the weak keys came from an error in a certificate-generation script (April 2025). Reported 2026-10-17; Mozilla (OneCRL, Firefox 158.0.1), Chrome and Apple blocked them; certifi 2026.10.19 and webpki-roots 1.0.10 removed emSign ECC Root CA - G3. python.org and pypi.org trust paths were exposed to MITM; no evidence of exploitation was reported.

## MITRE ATT&CK

- T1583.001 Domains
- T1195.002 Compromise Software Supply Chain
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.006 Python
- T1546.018 Python Startup Hooks
- T1685 Disable or Modify Tools
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1555.003 Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1557 Adversary-in-the-Middle
- T1087.004 Cloud Account
- T1526 Cloud Service Discovery
- T1102.001 Dead Drop Resolver
- T1573.002 Asymmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LiteLLM 1.107.0 Malicious Install and cook.pth Startup Hook Drop — Exploitation** (`TL-2026-4706-SPL-001`)

Detects installation of the compromised litellm 1.107.0 release (PyPI, 2026-10-21) and the artifacts its wheel drops into site-packages: cook.pth (a one-line 'import cook' hook that runs on every Python start), cook.py (the 'privcollect' credential stealer) and the sitecustomize.py backdoor loader. Behaviour-first: fires on the install command line or on the file drops, so it catches hosts and CI runners that pulled the package even if litellm was never imported. Maps to the T1195.002 supply-chain compromise and T1546.018 Python startup-hook persistence in TL-2026-4706.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1546.018, T1059.006, T1552.001
- **Data sources:** sysmon, sysmon_for_linux, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 (CommandLine="*litellm==1.107.0*" OR CommandLine="*litellm-1.107.0*") (Image="*pip*" OR Image="*uv" OR Image="*poetry*" OR Image="*python*")) OR (EventCode=11 (TargetFilename="*site-packages*cook.pth" OR TargetFilename="*site-packages*cook.py" OR TargetFilename="*dist-packages*cook.pth" OR TargetFilename="*site-packages*sitecustomize.py")))
| eval indicator=case(EventCode=1, "Malicious litellm 1.107.0 install", match(TargetFilename, "cook[.](pth|py)$"), "cook.pth/cook.py stealer (privcollect) dropped", true(), "sitecustomize.py loader dropped")
| stats min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators values(Image) as processes values(CommandLine) as command_lines values(TargetFilename) as files by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine contains 'litellm==1.107.0' or ProcessCommandLine contains 'litellm-1.107.0'
 | where FileName in~ ('pip', 'pip3', 'uv', 'pipx', 'poetry', 'python', 'python3', 'pip.exe', 'uv.exe', 'python.exe')
 | project Timestamp, DeviceName, AccountName, Indicator = 'Malicious litellm 1.107.0 install', Detail = ProcessCommandLine, Process = FileName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where ActionType in ('FileCreated', 'FileModified')
 | where FolderPath has_any ('site-packages', 'dist-packages')
 | where FileName in~ ('cook.pth', 'cook.py', 'sitecustomize.py')
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Indicator = iff(FileName =~ 'sitecustomize.py', 'sitecustomize.py loader dropped', 'cook.pth/cook.py stealer dropped'), Detail = FolderPath, Process = InitiatingProcessFileName)
| sort by Timestamp desc
```

### Sigma

```yaml
title: LiteLLM 1.107.0 Malicious cook.pth Startup Hook Dropped in site-packages
id: 7c1d2e4a-5b3f-4a96-8d10-2f6b9c3e7a11
status: experimental
description: Detects creation of cook.pth or cook.py inside a Python site-packages directory, the startup hook and credential stealer (privcollect) shipped in the compromised litellm 1.107.0 wheel (TL-2026-4706).
references:
  - https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker.md
  - https://www.welivesecurity.com/en/business-security/lessons-cybersecurity-black-week/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.persistence
  - attack.t1546.018
  - attack.execution
  - attack.t1059.006
logsource:
  category: file_event
detection:
  selection_dir:
    TargetFilename|contains:
      - 'site-packages'
      - 'dist-packages'
  selection_file:
    TargetFilename|endswith:
      - '/cook.pth'
      - '\cook.pth'
      - '/cook.py'
      - '\cook.py'
  condition: selection_dir and selection_file
falsepositives:
  - An internal package that legitimately ships a module or .pth hook named cook
level: critical

```

**Known false positives:**

- Internal Python package that legitimately ships a module or .pth hook named cook.py or cook.pth
- Debian, conda or managed environments that legitimately provide a site-wide sitecustomize.py
- Security scanners or sandboxes that unpack the malicious wheel for analysis

**Tuning notes:** For a retro-hunt replace earliest=-24h with 2026-10-21 onward (malicious release window 11:39-13:23 UTC) and include CI runners and container build hosts. sitecustomize.py alone is weak evidence in environments that ship their own, so prioritise hosts where it appears alongside cook.pth/cook.py or the 1.107.0 install command. Sysmon for Linux emits the same EventCode 1/11 schema; adjust index and sourcetype to your deployment. Hosts that installed litellm without a pinned version in the release window need a package-inventory check as well.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web Runtime Spawning Shell with Download or Recon Commands (PHP2Shell, Node2Shell, GitLab Regex RCE) — Exploitation (locked: unlock with TL Creds)
- LiteLLM Stealer and Backdoor Runtime Marker Files (.pc_once and remote_code_loader.lock) — Post-Exploitation (locked: unlock with TL Creds)
- Python Process Egress to [indicator], GitHub Dead-Drop and Community-Observed Sibling Infrastructure — C2 (locked: unlock with TL Creds)
- GitHub Branch Protection or Ruleset Tampering Preceding a Malicious Release — Exploitation (locked: unlock with TL Creds)
- Stolen AWS Credential Validation from LiteLLM Attacker IPs (GetCallerIdentity, ListFoundationModels) — Post-Exploitation (locked: unlock with TL Creds)
- DNS Resolution of [indicator] Lookalike Exfiltration Domain — C2 (locked: unlock with TL Creds)
- Python Process Sweeping Multiple Credential Stores (privcollect Stealer Behavior) — Post-Exploitation (locked: unlock with TL Creds)
- LiteLLM Stealer Exfiltration and GitHub Dead-Drop C2 Polling in HTTP Traffic — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `168.100.8[.]57`
- Domain: `litellm[.]dev`
- URL: `hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Lessons from Cybersecurity Black Week (Roman Kováč, WeLiveSecurity)](https://www.welivesecurity.com/en/business-security/lessons-cybersecurity-black-week/)
- [LiteLLM suspects GitHub token leak in supply chain attack (The Hacker News)](https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html)
- [LiteLLM compromised: PyPI and Docker analysis (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker.md)
- [LiteLLM 1.107.0 Compromised: Check, Clean and Rotate (Developers Digest)](https://www.developersdigest.tech/blog/litellm-1-107-0-compromised-pypi-what-to-do-2026)
- [GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
- [PHP2Shell: PHP patched CVE-2026-109618 and CVE-2026-109619 (Help Net Security)](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/)
- [PHP ships emergency patches for critical PHP2Shell flaws (BleepingComputer)](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)
- [Node2Shell: Node.js Brotli RCE CVE-2026-111497 (Aikido)](https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497)
- [Critical HTTP2Shell Brotli vulnerability triggers emergency patches (BleepingComputer)](https://bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches)
- [Mozilla, Google, Apple block compromised eMudhra CA certificates (BleepingComputer)](https://bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates)
- [Browsers block eight eMudhra intermediate CAs after their private keys leak](https://startwithidentity.com/blog/2026-10-20-browsers-block-eight-emudhra-intermediate-cas-after-private-keys-leak/)
- [oss-security: emSign/eMudhra intermediate CA disclosure](https://openwall.com/lists/oss-security/2026/10/22/28)
- [CVE-2026-110264: GitLab's Critical CVSS 10.0 Regex RCE Explained (Astra)](https://www.getastra.com/blog/security-advisory/cve-2026-110264-explained/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4706