# Threat Intel Brief — October 23, 2026

TL;DR

  • PHP2Shell RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affect 75–80% of websites globally; active exploitation confirmed four days before patch release.
  • GitLab CVSS 10.0 unauthenticated RCE (CVE-2026-110264) impacts all self-managed versions since 2014; immediate patching required.
  • LiteLLM supply chain attack delivered credential-stealing malware via PyPI and Docker Hub; compromised systems require full rebuild and credential rotation.
  • Arista VeloCloud Orchestrator zero-day (CVE-2026-114625) under active exploitation; SQL injection enables privilege escalation to superuser.
  • SafePay ransomware has breached over 600 critical infrastructure organizations globally since August 2024.

---

Critical Threats

PHP2Shell Remote Code Execution Flaws

What happened:
Two critical memory corruption vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) enable unauthenticated remote code execution on web servers. The flaws affect all PHP versions serving web requests, including PHP-FPM, Apache mod_php, and CGI deployments. Amazon Threat Intelligence observed exploitation attempts beginning October 17, 2026—four days before patches were released on October 21. Cloudflare detected active exploitation within hours of public disclosure. With PHP powering approximately 75–80% of websites globally and over 5 million exposed hosts identified, the attack surface is massive.

Impact:
Attackers can execute arbitrary code as the web server user before application code runs, enabling full server compromise. Both vulnerabilities exploit memory corruption during error handling: CVE-2026-109618 leverages uninitialized memory after out-of-memory conditions, while CVE-2026-109619 exploits use-after-free conditions in global memory. Successful exploitation grants complete control over web servers, enabling data theft, malware deployment, and lateral movement. The UK NCSC issued emergency guidance directing organizations to patch immediately or take systems offline.

Recommendations:

  • Upgrade immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your branch; restart all PHP workers and web servers.
  • Deploy WAF rules to block exploitation attempts as an interim layer (Cloudflare and other vendors have released protective rulesets).
  • Audit web server logs from October 17 onward for suspicious activity, focusing on unusual POST requests, memory-limit errors, and connections from VPN/anonymization networks.
  • For systems that cannot be patched within 24 hours, isolate from the internet or place behind strict WAF controls.
  • Monitor for indicators of compromise including unexpected processes, file modifications, or outbound connections from PHP servers.

---

GitLab Unauthenticated RCE (CVSS 10.0)

What happened:
GitLab disclosed CVE-2026-110264, a maximum-severity unauthenticated remote code execution vulnerability affecting all self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 7.0 (released in 2014) through 19.5.0. The flaw stems from an integer overflow in the bundled Onigmo regex engine during compilation of crafted regular expressions. GitLab.com and GitLab Dedicated instances are already patched. An earlier October 12 patch only covered versions 19.2 and later, requiring administrators to apply new fixes for complete protection.

Impact:
Unauthenticated attackers can achieve arbitrary code execution on GitLab servers, gaining access to source code repositories, CI/CD pipelines, credentials, secrets, and potentially pivoting to connected infrastructure. GitLab is used by 50% of Fortune 100 companies with over 30 million users globally. This is the third maximum-severity GitLab vulnerability in recent weeks. No workaround exists; patching is the only mitigation.

Recommendations:

  • Immediately upgrade all self-managed GitLab instances to fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.
  • Deploy GitLab-provided Sigma detection rules ("Onigmo native worker crash" and "Org mode render error burst") to hunt for exploitation attempts in application logs.
  • Verify GitLab instances are not directly exposed to the internet without additional access controls; implement WAF or IP allowlisting where possible.
  • Audit GitLab access logs for suspicious unauthenticated requests or unusual regular expression processing activity prior to patching.
  • Rotate credentials, API tokens, and secrets stored in GitLab repositories and CI/CD variables as a precautionary measure.

---

LiteLLM Supply Chain Compromise

What happened:
On October 21, 2026, threat actors compromised the LiteLLM Python package release pipeline and published malicious version 1.107.0 to PyPI and Docker Hub. The attack involved stolen GitHub CLI OAuth tokens from three engineer accounts, bypassing branch protections and code signing. The malicious package contained a credential stealer targeting cloud credentials (AWS, Azure, GCP), SSH keys, browser data, AI development tool credentials, and LiteLLM proxy configurations. A backdoor component checks a GitHub-hosted dead drop hourly for remote code execution commands. The package was live for approximately 1 hour 43 minutes on PyPI and 2 hours 33 minutes on Docker registries.

Impact:
Organizations that installed LiteLLM 1.107.0 face immediate credential theft and persistent backdoor access. Exfiltrated credentials were validated and used for AWS reconnaissance (sts:GetCallerIdentity, bedrock:ListFoundationModels) starting 4.5 hours post-exfiltration from attacker-controlled IPs. The malware executes on every Python interpreter launch, including pip commands. LiteLLM has 92 million monthly PyPI downloads and is used by NVIDIA, Netflix, AT&T, and Okta.

Recommendations:

  • Immediately identify and isolate all systems running LiteLLM 1.107.0 via package manager queries (pip list | grep litellm) and container image scans.
  • Revoke and rotate all cloud credentials, SSH keys, API tokens, and browser-stored credentials from a clean environment.
  • Roll back to LiteLLM 1.106.2 pinned by digest and block version 1.107.0 in dependency management tools.
  • Search logs for HTTP POST requests to litellm[.]dev/healthcheck and HTTP GET requests to github[.]com/letters9813 to identify compromised hosts.
  • Rebuild compromised hosts from clean backups or golden images; do not attempt manual cleanup.

---

Arista VeloCloud Orchestrator Zero-Day

What happened:
Arista disclosed CVE-2026-114625, a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO) that is being actively exploited in attacks. The flaw allows attackers with read-only customer account access to escalate privileges to operator level, gaining full control over the SD-WAN management system. Arista has observed attacks originating from 74.82.197.86 and 38.54.50.151. This is the fourth actively exploited Arista zero-day in 2026.

Impact:
Authenticated attackers can escalate to superuser operator privileges through low-complexity SQL injection, gaining access to internal functionality not intended for remote access. Full compromise of orchestrator confidentiality, integrity, and availability is possible, affecting SD-WAN management and configuration across the enterprise.

Recommendations:

  • Apply security updates immediately for all VeloCloud Orchestrator On-Prem deployments (versions 5.2.3.18+, 6.1.3.10+, or 6.4.2.12+ depending on branch).
  • Block IP addresses 74.82.197.86 and 38.54.50.151 at perimeter and internal firewalls.
  • Restrict VCO web interface access to administrative networks only; remove internet-facing exposure.
  • Review VCO web access logs for SQL injection indicators: unusual URL-like path components, encoded characters, references to local/internal services.
  • Audit recent administrator activity for unauthorized privilege escalations or configuration changes.

---

Threat Actor Activity

Storm-0940 Leverages AI in ConnectWise Supply Chain Attack

China-aligned threat actor Storm-0940 compromised ConnectWise in a large-scale supply chain attack, enabling application credential abuse across Microsoft 365 environments. The actor deployed the ARTEX agentic AI framework to automate password spraying, reconnaissance, and OAuth application abuse, compressing attack timelines from initial access to privileged access to under three hours in multiple instances. Affected sectors include aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, and technology organizations globally.

Defensive actions:
Review service principal sign-ins in Azure AD/Entra ID for unexpected authentication patterns since September 2026. Audit OAuth application credentials and privilege changes; revoke and rotate credentials for ConnectWise-related service principals per ConnectWise containment guidance published October 16, 2026. Deploy Microsoft Defender XDR detections for suspicious Microsoft Graph activity and implement conditional access policies requiring interactive user sign-in for high-privilege operations.

---

SafePay Ransomware Targets Critical Infrastructure

SafePay, a private ransomware operation active since August 2024, has breached over 600 critical infrastructure organizations across North America, South America, Europe, and Australia. The group employs double-extortion tactics, exfiltrating sensitive data before encryption. Initial access vectors include credential exposure, brute force attacks, VPN exploitation (particularly Mullvad VPN IP addresses), phishing, and exploitation of CVEs affecting edge devices. Post-compromise, the group deletes shadow copies and resets network-attached storage devices to disrupt recovery operations.

Defensive actions:
Implement multifactor authentication across all remote access points and enforce identity, credential, and access management policies. Prioritize patching of CVEs affecting VPNs, firewalls, and edge devices listed in CISA's Known Exploited Vulnerabilities catalog. Implement immutable backup solutions with offline or air-gapped storage and regularly test restoration procedures. Monitor for suspicious activity associated with Mullvad VPN IP addresses and deploy behavioral analytics to detect brute force attempts and shadow copy deletion.

---

Bronze Sandcastle Targets Asia and Africa

China-aligned threat actor Bronze Sandcastle has been targeting organizations in the Philippines, Taiwan, Afghanistan, and Namibia since mid-2025 using Sandboxie DLL sideloading to deploy backdoors. The actor uses encrypted configuration files for payload delivery and leverages legitimate file-sharing services (file.io, gofile.io, ably.net) and GitHub repositories for command-and-control. Post-compromise activities include credential enumeration, keylogging, and screen capture.

Defensive actions:
Monitor for unusual process execution chains involving legitimate South Korean security software such as INISAFE CrossWeb EX. Implement behavioral detection for in-memory code execution patterns and reflective DLL loading. Establish network monitoring for unusual cryptographic handshakes to C2 infrastructure, including detection of GOST and Threefish encryption algorithm usage. Audit and restrict access to private GitHub repositories and monitor for suspicious repository creation and access patterns.

---

Geopolitical Context

International Law Enforcement Disrupts African Cybercrime Networks

INTERPOL conducted Operation Serengeti III between June 29 and August 31, 2026, disrupting 10,909 malicious networks and arresting 1,462 suspects across 21 countries. The operation targeted business email compromise, ransomware, online scams, phishing infrastructure, fraudulent mobile lending apps, and illegal cryptocurrency mining operations. Over $105 million in illicit funds was recovered, with 65,929 victims identified and estimated losses exceeding $385 million. Notable seizures include 2,000 cryptocurrency mining devices in Angola and disruption of a phishing operation controlling 2.1 million email addresses in Nigeria.

---

eMudhra Certificate Authority Exits Global SSL/TLS Market

Indian certificate authority eMudhra announced its withdrawal from the global SSL/TLS certificate business after a researcher discovered that eight of its intermediate CA private keys were easily guessable due to insufficient randomness during generation. Chrome will distrust eMudhra's emSign ECC Root CA - G3 on October 27, 2026, affecting approximately 30,800 unexpired certificates—99.9% issued through InCommon to U.S. higher education institutions. Organizations using eMudhra certificates face immediate service disruption and must transition to alternative CAs.

---

Recommended Actions

Immediate (0–24 hours)

1. Patch PHP servers to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35; restart all workers and web servers.
2. Upgrade GitLab to patched versions (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13).
3. Identify and isolate systems running LiteLLM 1.107.0; rotate all credentials and rebuild from clean images.
4. Patch Arista VeloCloud Orchestrator On-Prem deployments and block attacker IPs 74.82.197.86 and 38.54.50.151.
5. Review service principal sign-ins in Azure AD/Entra ID for Storm-0940 indicators; audit OAuth application credentials.

Within 24–72 hours

6. Audit web server logs from October 17 onward for PHP2Shell exploitation indicators.
7. Deploy GitLab Sigma detection rules to hunt for CVE-2026-110264 exploitation attempts.
8. Search logs for LiteLLM malware indicators: connections to litellm[.]dev/healthcheck and github[.]com/letters9813.
9. Review VCO web access logs for SQL injection patterns and unauthorized privilege escalations.
10. Implement MFA across all remote access points to mitigate SafePay ransomware initial access vectors.

This week

11. Replace eMudhra certificates chained to emSign ECC Root CA - G3 before October 27, 2026.
12. Conduct compromise assessment on all GitLab servers, reviewing authentication logs and CI/CD job history.
13. Monitor for Plex2Shell exploitation (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656); upgrade Plex Media Server to version 1.43.3.10861 or later.
14. Audit Bronze Sandcastle indicators: DLL sideloading behavior, connections to file.io/gofile.io/ably.net, and GitHub account LatonyCharnleyaW.
15. Review threat intelligence feeds from Operation Serengeti III for IOCs related to African-hosted phishing kits and botnets.

---

Watch List

  • Linux KSMBD RCE vulnerabilities (ZDI-CAN-33774, ZDI-CAN-33549): Two CVSS 9.0 remote code execution flaws disclosed before kernel fixes are available; disable KSMBD module if active and not required.
  • Plex2Shell exploitation: CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to Known Exploited Vulnerabilities catalog; federal agencies must patch by October 23.
  • ClickFix campaigns: Surge in attacks leveraging fake AI installers, malicious search results, and trusted chatbot platforms; 67% of browser-based attacks in August 2026.
  • Tor exit relay compromise: Over 300 Tor exit relays hijacked October 1–5, 2026, to intercept SSH credentials; users who accepted changed host keys during this window should rotate passwords.
  • Lazarus Group post-quantum cryptography: North Korean threat actor deploying ML-KEM-1024 in FlashHole campaign targeting South Korean organizations.

---

Sources

  • BleepingComputer: PHP2Shell, GitLab, LiteLLM, Arista VeloCloud, Railway, Capcom, Operation Serengeti III, Plex2Shell, SafePay ransomware, Lazarus Group, ClickFix, Onamae Desktop Cloud
  • The Hacker News: Arista VeloCloud, eMudhra, Linux KSMBD, Meta privacy ruling, INTERPOL Operation Serengeti III, OpenCode, LiteLLM, GitLab, PHP2Shell, Bronze Sandcastle, Tor exit relays
  • Unit 42 (Palo Alto): PHP vulnerabilities, eMudhra CA compromise, AI-assisted cybercrime
  • Microsoft Security: Storm-0940 ARTEX campaign
  • NCSC UK: PHP critical vulnerabilities
  • CERT-EU: GitLab CVE-2026-110264
  • CERT.BE: PHP and Apache Camel vulnerabilities
  • CERT.PL: CleanShot X CVE-2026-16477
  • Krebs on Security: PHP2Shell analysis