# Threat Intel Brief — October 24, 2026

TL;DR

  • Critical supply chain attack: LiteLLM Python package v1.107.0 compromised on PyPI and Docker Hub, deploying credential stealers and backdoors targeting cloud infrastructure and AI service credentials.
  • Active zero-day exploitation: Arista VeloCloud Orchestrator SQL injection flaw under attack; GitLab unauthenticated RCE (CVE-2026-110264, CVSS 10.0) patched after disclosure.
  • State-sponsored activity: China-linked APT41 deployed BlackX UEFI bootkit against Central Asian diplomatic targets; Russian groups Sandworm and UAC-0099 conducted destructive wiper attack on Ukrainian logistics.
  • Widespread vulnerability patching: Critical RCE flaws addressed in PHP, Node.js (CVE-2026-111497), Pillow (CVE-2026-112900), Ruby/GitLab, and HPE ArubaOS (8 maximum-severity flaws: CVE-2026-79844 through CVE-2026-79851).
  • Law enforcement wins: INTERPOL Operation Serengeti III disrupted 10,909 cybercrime networks across Africa, arresting 1,462 suspects and recovering $105 million.

---

Critical Threats

LiteLLM Supply Chain Compromise

What happened: On October 21, 2026, threat actors compromised the LiteLLM Python package release pipeline, publishing malicious version 1.107.0 to PyPI (11:39–13:23 UTC) and Docker Hub (11:46–14:20 UTC). The attack leveraged suspected GitHub token leakage in AI gateway logs to bypass security controls. The malicious package deployed credential stealers targeting AWS, Azure, GCP, Kubernetes, GitHub, and AI service credentials, plus a persistent backdoor via Python startup hooks (sitecustomize.py, .pth files). Microsoft observed active credential validation attempts against AWS from attacker IPs 168.100.8.57 and 165.227.201.8 within hours of exfiltration.

Impact: Organizations using LiteLLM in CI/CD pipelines, Kubernetes clusters, or developer workstations during the compromise window face credential theft and persistent remote code execution. The malware executes automatically during Python interpreter startup without requiring LiteLLM import, affecting any Python environment where the package was installed. LiteLLM serves major enterprises including NVIDIA, Netflix, AT&T, and Okta, with 92 million monthly PyPI downloads.

Recommendations:

  • Immediate (0–24h): Isolate and rebuild systems that installed LiteLLM v1.107.0 or used Docker tags latest, main-latest, or main-stable between Oct 21 11:39–14:20 UTC. Rotate all credentials: AWS/Azure/GCP keys, GitHub tokens, Kubernetes secrets, SSH keys, AI provider credentials.
  • 24–72h: Hunt for IOCs using Microsoft Defender queries; search for /tmp/remote_code_loader.lock, outbound connections to litellm[.]dev/healthcheck, and AWS CloudTrail entries for sts:GetCallerIdentity or bedrock:ListFoundationModels from attacker IPs.
  • This week: Upgrade to LiteLLM v1.107.1+, pin package versions in requirements.txt, audit GitHub organization access for compromised CLI tokens.

---

GitLab Unauthenticated RCE (CVE-2026-110264)

What happened: GitLab disclosed a maximum-severity (CVSS 10.0) integer overflow vulnerability in the regular expression compiler affecting Community and Enterprise Editions versions 7.0 through 19.5.0. The flaw allows unauthenticated remote code execution on GitLab servers. GitLab.com and Dedicated instances were patched proactively; self-managed deployments require immediate updates. The vulnerability was reported via HackerOne by researcher 'joaxcar' and is linked to three bugs in Ruby's Onigmo regex engine (also affecting Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, 3.3.0–3.3.12).

Impact: Over 2,700 internet-exposed GitLab CE instances face immediate risk of full server compromise without credentials. GitLab is used by 50% of Fortune 100 companies and hosts source code, CI/CD pipelines, credentials, and secrets. Given GitLab's history of rapid exploitation (CVE-2026-85706 added to CISA KEV within one month), weaponization is likely imminent.

Recommendations:

  • Immediate (0–24h): Upgrade all GitLab CE/EE instances to patched versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. Verify GitLab Dedicated tenants run 19.3.5-internal0 or 19.4.2-internal0+.
  • 24–72h: Deploy GitLab's published detection rules (onigmo_native_worker_crash, org_mode_render_error_burst) to SIEM. Review access logs for suspicious unauthenticated requests.
  • This week: Restrict network access to GitLab instances; remove unnecessary internet exposure. Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 for standalone deployments.

---

Arista VeloCloud Orchestrator Zero-Day

What happened: Arista disclosed active exploitation of a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. Attackers with valid authenticated sessions and basic user privileges can escalate to superuser operator level, gaining full control over SD-WAN management. Exploitation confirmed from IPs 74.82.197.86 and 38.54.50.151. This is the fourth actively exploited Arista zero-day in 2026.

Impact: Organizations using on-prem VCO for SD-WAN management face immediate risk of complete infrastructure compromise, affecting confidentiality, integrity, and availability of orchestrator data and potentially the underlying host. The vulnerability scored 9.9 CVSS.

Recommendations:

  • Immediate (0–24h): Upgrade VCO On-Prem to fixed versions: 5.2.3.18+, 6.1.3.10+, or 6.4.2.12+. Block attacker IPs 74.82.197.86 and 38.54.50.151 at perimeter firewalls.
  • 24–72h: Restrict VCO web interface access to administrative networks only. Review web access logs for SQL injection indicators (unusual URL-encoded characters, references to internal services, abnormal request rates).
  • This week: Audit recent administrator activity and privilege escalations; preserve logs if compromise is suspected.

---

HPE ArubaOS Critical Vulnerabilities

What happened: Hewlett Packard Enterprise released security updates patching 72 vulnerabilities in Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and remote code execution flaws (CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851). The vulnerabilities are exploitable remotely without authentication, with low attack complexity and no user interaction required. HPE explicitly urged immediate patching due to "complexity, breadth, and impact."

Impact: Unauthenticated remote code execution on critical network devices managing wireless access and mobility. Affects Aruba mobility conductors, access points, controllers, and gateway devices. 90% of Fortune 500 companies use HPE products.

Recommendations:

  • Immediate (0–24h): Apply HPE security updates for all ArubaOS-8 and ArubaOS-10 devices per advisory guidance. Restrict access to AOS CLI and web-based management interfaces to dedicated layer 2 segment/VLAN until patching is complete.
  • 24–72h: Implement firewall policies at layer 3+ to control access to ArubaOS management interfaces. Enable accounting controls to track user activities.
  • This week: Audit network logs for suspicious authentication attempts or unusual command execution on Aruba devices since advisory publication.

---

Node.js Brotli RCE (CVE-2026-111497)

What happened: Imperva researchers demonstrated remote code execution on Node.js 24.22.0 (Linux arm64) via crafted Brotli compression data. Applications decoding untrusted Brotli data via fetch() responses or request body middleware (Express 5.x body parsers, body-parser 2.x) are vulnerable. Fixed in 24.22.1 and corresponding patched releases for 22.x and 26.x lines. End-of-life Node.js 20.x and earlier will not receive patches.

Impact: Critical risk for Node.js applications that decompress Brotli data from untrusted sources. Successful exploitation grants arbitrary code execution. Container images and bundled Node binaries require updates beyond npm package management.

Recommendations:

  • Immediate (0–24h): Update Node.js to patched releases: 24.22.1+ for 24.x line, and corresponding fixes for 22.x and 26.x released October 21, 2026. Rebuild and redeploy container images bundling Node.js binaries.
  • 24–72h: Migrate applications on Node.js 20.x and earlier to supported release lines (22.x, 24.x, or 26.x) immediately.
  • This week: Review application code for use of Express 5.x body parsers and body-parser 2.x on routes accepting external input; prioritize patching those services.

---

Pillow Library RCE (CVE-2026-112900)

What happened: A critical vulnerability in Pillow (Python's image library) versions 2.6.0–12.3.0 allows remote code execution through crafted EPS image files. The flaw exists in how Pillow handles EPS images by passing unsanitized filenames to Ghostscript without validation. Additional critical flaws affect JPEG (FPX format) and TIFF handling.

Impact: High impact for web applications, ML pipelines, document processing systems, and any service handling untrusted image uploads. Pillow is downloaded ~436 million times monthly. Successful exploitation enables remote code execution on affected servers.

Recommendations:

  • Immediate (0–24h): Upgrade Pillow to version 13.0.0 using pip install -U "Pillow>=13.0.0" and verify Python 3.11+ is installed. Rebuild all Docker containers and base images bundling Pillow.
  • 24–72h: Until upgrade: remove Ghostscript (gs binary) from servers processing untrusted EPS uploads and sanitize all filenames passed to Image.open().
  • This week: Audit web upload endpoints to ensure user-supplied filenames are never directly used when opening images; generate filenames server-side instead.

---

Threat Actor Activity

APT41 (China): BlackX UEFI Bootkit in Central Asia

APT41 deployed the BlackX UEFI bootkit against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The bootkit exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on patched Windows systems lacking manual certificate revocations. The malware uses a stolen certificate from Wenjiang District Mingyu Network Technology Service Studio, disables Kaspersky and Avast security products, and communicates via Google Drive, OneDrive, and Yandex.Disk. The operation delivered SprySOCKS backdoor and OxiDLLRunner payloads for espionage.

Defensive priorities: Apply Microsoft Secure Boot revocation mitigations by manually adding 'Windows Production PCA 2011' certificate to UEFI Forbidden List (DBX). Monitor for suspicious UEFI partition modifications and unsigned EFI binaries. Detect abuse of legitimate cloud storage services as C2 channels.

---

Sandworm & UAC-0099 (Russia): Ukraine Wiper Attack

Russian state-sponsored group Sandworm collaborated with UAC-0099 (Earth Sirrush) to conduct a destructive wiping attack against a Ukrainian logistics company in July 2025. The attack began with spear-phishing emails and deployed MythicRatatoskr, a custom backdoor communicating via Yggdrasil mesh network C2 infrastructure—the first documented state-aligned abuse of this peer-to-peer network. The operation culminated in data destruction via SDelete utility deployed through Active Directory Group Policy on September 17, 2025.

Defensive priorities: Monitor for spear-phishing with malicious attachments. Detect unusual network connections to Yggdrasil mesh network nodes. Alert on SDelete.exe execution and unusual Group Policy modifications. Implement detection for SOCKS5 proxy deployment on endpoints.

---

INC & The Gentlemen Ransomware Affiliates: AI-Driven Intrusion Framework

Russian-speaking affiliates of INC and The Gentlemen ransomware groups deployed an "Autonomous Red Team Kill Chain Framework" called Phantom. The AI-driven ecosystem uses OpenCode with OpenRouter-hosted commercial models to execute intrusions through mass exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), cPanel/WHM (CVE-2026-41940), and VPN gateways. The operation targeted 62 organizations (over 50% in the United States), focusing on industrial, manufacturing, energy, and healthcare sectors.

Defensive priorities: Prioritize patching CVE-2026-35616, CVE-2024-57727, and CVE-2026-41940. Implement network segmentation and enforce unique credentials across VPN, RMM, backup, and security management platforms. Monitor for reverse-SOCKS proxy establishment (RevSocks) and anomalous outbound connections to Cloudflare Workers, Telegram APIs, and DNS tunneling patterns.

---

Geopolitical Context

Central Asia: APT41's targeting of diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan reflects China's strategic intelligence priorities in Belt and Road Initiative partner states. The use of sophisticated UEFI bootkits demonstrates willingness to leverage criminal innovation for state intelligence purposes.

Ukraine: The Sandworm-UAC-0099 collaboration targeting Ukrainian logistics infrastructure represents sustained Russian cyber operations aimed at degrading Ukraine's economic resilience and wartime supply chains. The two-month dwell time suggests deliberate operational security and possible intelligence collection prior to destructive action.

Africa: INTERPOL Operation Serengeti III (June 29–August 31, 2026) disrupted 10,909 cybercrime networks across 21 African countries, arresting 1,462 suspects and recovering $105 million. The operation highlights Africa's growing role as both source and target of transnational cybercrime, with concentration in business email compromise, cryptocurrency fraud, and phishing operations.

India: eMudhra's exit from the global SSL/TLS certificate business after eight intermediate CA private keys were found easily guessable creates operational disruption for U.S. higher education institutions (30,800 unexpired certificates, 99.9% via InCommon). Chrome distrusts the emSign ECC Root CA - G3 effective October 27, 2026.

---

Recommended Actions

Immediate (0–24 hours)

1. LiteLLM compromise response: Isolate systems with v1.107.0 installed; rotate all credentials (AWS, Azure, GCP, GitHub, Kubernetes, AI providers).
2. GitLab patching: Upgrade all GitLab CE/EE instances to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.
3. Arista VCO patching: Upgrade VeloCloud Orchestrator On-Prem to 5.2.3.18+, 6.1.3.10+, or 6.4.2.12+; block attacker IPs 74.82.197.86 and 38.54.50.151.
4. HPE ArubaOS patching: Apply security updates for all ArubaOS-8 and ArubaOS-10 devices.
5. Node.js patching: Update to 24.22.1+ (or corresponding 22.x/26.x releases); rebuild container images.
6. Pillow patching: Upgrade to version 13.0.0; rebuild Docker containers and base images.

24–72 hours

1. LiteLLM IOC hunting: Search for /tmp/remote_code_loader.lock, connections to litellm[.]dev/healthcheck, and AWS CloudTrail anomalies.
2. GitLab detection: Deploy published detection rules (onigmo_native_worker_crash, org_mode_render_error_burst) to SIEM.
3. Arista VCO hardening: Restrict VCO web interface access to administrative networks; review logs for SQL injection indicators.
4. Ruby patching: Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 for standalone deployments.
5. PHP mitigation: Set session.upload_progress.enabled=0 for CVE-2026-115560 mitigation.

This week

1. eMudhra certificate replacement: Identify and replace all TLS certificates chaining to emSign ECC Root CA - G3 before October 27 Chrome distrust deadline.
2. Ransomware affiliate defenses: Patch CVE-2026-35616 (FortiClient), CVE-2024-57727 (SimpleHelp), CVE-2026-41940 (cPanel/WHM); enforce unique credentials across VPN/RMM platforms.
3. APT41 defenses: Apply Microsoft Secure Boot revocation mitigations; add 'Windows Production PCA 2011' to UEFI Forbidden List (DBX).
4. PHP2Shell patching: Apply PHP patches for CVE-2026-109618 and CVE-2026-109619 (actively exploited pre-patch).
5. CGM CLININET patching: Upgrade to version 2026.MS3+ to remediate 11 vulnerabilities (CVE-2025-30043, CVE-2025-30045, CVE-2025-30046, CVE-2025-30047, CVE-2025-30049, CVE-2025-30050, CVE-2025-30051, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054, CVE-2025-58403).

---

Watch List

  • PHP2Shell exploitation: Widespread scanning for CVE-2026-109618 and CVE-2026-109619 to deploy Mirai variant Potassium; exploitation attempts largely unsuccessful but working exploits expected.
  • Linux KSMBD RCE: Two CVSS 9.0 vulnerabilities disclosed on public mailing lists before kernel fixes; no CVE assigned yet; ZDI-CAN-33774 requires no authentication.
  • x402 SDK flaws: Malicious APIs can drain AI agent wallets; fixed August 18, 2024, but no CVE assigned and no vulnerability database warnings.
  • OpenCode AI agent flaw: Malicious MCP servers can execute code on Windows/WSL during sign-in; fixed in version 1.18.33 (September 2024); no CVE assigned.
  • Railway breach: Platform-as-a-Service provider detected unauthorized access to customer environment variables; users urged to rotate secrets.
  • Quest Diagnostics breach: Unauthorized access to Quanum LSM system exposed patient records; investigation ongoing.
  • Capcom breach: 11.7 million CAPCOM ID accounts exposed; 196 accounts had passwords manipulated.

---

Sources

  • BleepingComputer, The Hacker News, Microsoft Security, CERT.BE (Belgium), CERT.PL (Poland), CERT-EU, Unit 42 (Palo Alto Networks)
  • GitLab Security Advisory, HPE Security Bulletin, Arista Security Advisory, Kaspersky APT Reports, ESET APT Activity Report Q2-Q3 2025
  • INTERPOL Operation Serengeti III Press Release, New Mexico District Court Ruling (Meta), eMudhra Public Statement