# Threat Intel Brief — October 26, 2026

TL;DR

  • CISA adds two critical vulnerabilities to KEV catalog — CVE-2026-110447 (Collabora Online) and CVE-2026-114625 (Arista VeloCloud) are under active exploitation, with threat actors deploying web shells and targeting credential stores.
  • Brotli decoder memory corruption affects Node.js, Python, Bun, Envoy — CVE-2026-111497 enables remote code execution via crafted compressed data; proof-of-concept RCE demonstrated but no in-the-wild exploitation confirmed.
  • LiteLLM supply chain compromise via leaked master key — Threat actor exploited unrevoked GitHub credentials to publish malicious Python package v1.107.0, exfiltrating API keys for OpenAI, Anthropic, AWS Bedrock, and database credentials.
  • BlackX UEFI bootkit targets Central Asian diplomats — Espionage campaign attributed to APT41 exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot and deploy kernel drivers disabling Kaspersky and Avast security products.
  • AI coding agents vulnerable to instruction file hijacking — Malicious AGENTS.md files silently dropped into Downloads folders trick AI agents into installing rogue npm packages; 90% success rate demonstrated against OpenAI Codex.

---

Critical Threats

LiteLLM Supply Chain Attack via Leaked Master Key

What happened:
On October 21, 2026, a threat actor exploited a LiteLLM master key accidentally published to GitHub in May 2026 to compromise the Python package release pipeline. The attacker gained owner-level access to the BerriAI GitHub organization, extracted OAuth tokens, and published malicious version 1.107.0 to PyPI and Docker Hub. Malicious workflows exfiltrated credentials for GitHub, OpenAI, Anthropic, AWS Bedrock, Together AI, PostgreSQL, Redis, and other services via webhook[.]site endpoints. PyPI quarantined the package within 1.5 hours of publication.

Impact:
Organizations running LiteLLM v1.107.0 between October 21, 2026 11:46 a.m. and 1:23 p.m. UTC face immediate credential theft risk. Compromised credentials enable unauthorized access to AI inference platforms, source code repositories, databases, and third-party services. The attack demonstrates sophisticated CI/CD pipeline manipulation, including branch protection override and release source redirection to a lookalike repository (Berri-AI/litellm vs BerriAI/litellm).

Recommendations:

  • Audit all systems for LiteLLM v1.107.0 installations (pip freeze, Docker images tagged v1.107.0, latest, main-latest, main-stable from October 21). Uninstall immediately and upgrade to verified clean version.
  • Rotate all API keys for OpenAI, Anthropic, AWS Bedrock, Together AI, Tavily, GitGuardian, and LLM inference services accessible from environments running v1.107.0.
  • Review GitHub audit logs for repositories where v1.107.0 was deployed; search for unauthorized commits, workflow runs, or OAuth token usage between October 10-21, 2026.
  • Inspect PostgreSQL and Redis database access logs for anomalous connections or data exfiltration from affected systems.
  • Block webhook[.]site at network perimeter if not business-critical; monitor for connections to webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 and webhook[.]site/4da03473-a3e7-4d.

---

CISA: Collabora Online and Arista VeloCloud Under Active Exploitation

What happened:
CISA added CVE-2026-110447 (Collabora Online Built-in CODE Server, CVSS 9.2) and CVE-2026-114625 (Arista VeloCloud Orchestrator, CVSS 9.9) to the Known Exploited Vulnerabilities catalog on October 23, 2026. Threat actors are deploying web shells on NextCloud servers via command injection in proxy.php and exploiting SQL injection in VeloCloud Orchestrator to escalate privileges. Attackers are targeting credential stores, password managers, and cryptocurrency wallets. Exploitation traffic for VeloCloud originated from two IP addresses in Japan.

Impact:
This marks the third actively exploited VeloCloud vulnerability since July 2026, indicating sustained adversary interest in SD-WAN infrastructure. Organizations running vulnerable Collabora Online with NextCloud face remote code execution risk. Arista VCO customers face SQL injection enabling privilege escalation to internal functionality. Federal agencies must remediate by October 26, 2026 per CISA directive.

Recommendations:

  • Immediately upgrade Collabora Online Built-in CODE Server to version 26.4.303 or later if using NextCloud integration.
  • Upgrade Arista VeloCloud Orchestrator on-premise installations to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on branch.
  • Block inbound traffic from 74.82.197.86 and 38.54.50.151 at perimeter firewalls; review VCO logs for connections from these IPs.
  • Audit NextCloud servers for web shells, unauthorized file modifications in web directories, and suspicious outbound connections since September 2026.
  • Review VCO authentication logs for anomalous Enterprise Read Only account activity and privilege escalation attempts since July 2026.

---

Brotli Decoder Memory Corruption Enables RCE Across Multiple Platforms

What happened:
CVE-2026-111497, a memory-corruption vulnerability in Google's Brotli C library (versions 1.0.3–1.2.0), allows crafted compressed data to overwrite buffer boundaries and corrupt program memory. The flaw affects Node.js 22.x/24.x/26.x, Bun ≤1.4.3, Python Brotli ≤1.2.0, brotlicffi ≤1.2.0.x, Envoy 1.36–1.39, and Istio 1.29–1.31. Proof-of-concept RCE was demonstrated on Node.js 24.22.0 ARM64 Linux by Imperva researchers.

Impact:
Applications using affected runtimes to decode Brotli-compressed HTTP traffic (Content-Encoding: br) are at risk of remote code execution. Node.js and Bun servers using fetch() or body parsers that accept br-encoded requests/responses are exposed. Python applications with Brotli/brotlicffi installed are vulnerable even without explicit import, as HTTP clients auto-decode br responses. Envoy/Istio proxies with Brotli decompression enabled are affected. CVSS 4.0: 9.2 (Critical per Google); 8.1 (Important per Red Hat). No in-the-wild exploitation confirmed as of October 23, 2026.

Recommendations:

  • Update immediately: Node.js to 22.23.4/24.22.1/26.12.1; Bun to 1.4.4; Envoy to 1.40.0/1.39.3/1.38.6/1.37.8/1.36.12; Istio to 1.31.2/1.30.6/1.29.9; Python Brotli to 1.2.1; brotlicffi to 1.2.1.0. Restart all services and rebuild container images after patching.
  • For Python environments: uninstall Brotli and brotlicffi packages entirely if immediate patching is not possible, forcing HTTP clients to fall back to gzip/deflate.
  • Block Brotli decompression at ingress: configure reverse proxies, load balancers, or WAF to reject requests with Content-Encoding: br headers before they reach application code.
  • Disable automatic Brotli decoding in HTTP client libraries where configurable; reject Content-Encoding: br responses at the application layer until patching is complete.
  • Audit Envoy and Istio configurations: disable Brotli decompression filters if not operationally required.

---

BlackX UEFI Bootkit Targets Central Asian Diplomats

What happened:
BlackX, a UEFI bootkit attributed with medium confidence to APT41 (Brass Typhoon, Wicked Panda), was deployed in an espionage campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The bootkit exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot by enrolling custom Machine Owner Keys and loading malicious EFI files. It deploys a kernel driver signed with a revoked certificate that disables security callbacks, tampers with Event Tracing for Windows, and specifically targets Kaspersky and Avast security products.

Impact:
BlackX demonstrates significant code overlap with BlackLotus, suggesting either access to proprietary source code or sophisticated reverse-engineering. The bootkit intercepts file access requests to protect its files by launching Windows Calculator instead. Follow-on payloads include a RAT using Google Drive, OneDrive, and Yandex.Disk for C2, and OxiDLLRunner, an OLLVM-obfuscated DLL that sideloads via googleupdate.exe. All identified victims were running fully patched Windows systems but had not manually activated additional Secure Boot revocations required to fully mitigate CVE-2022-21894.

Recommendations:

  • Manually activate Secure Boot revocations for CVE-2022-21894 (Baton Drop) following Microsoft guidance, as patch installation alone does not automatically revoke vulnerable certificates.
  • Add the "Windows Production PCA 2011" certificate to blocklists to prevent vulnerable binaries from loading, even after its October 19, 2026 expiration date.
  • Monitor for suspicious kernel driver loads signed with revoked certificates, particularly those issued to Chinese entities like Wenjiang District Mingyu Network Technology Service Studio.
  • Detect anomalous ETW provider tampering and disabled security callbacks through kernel-level monitoring and integrity checks.
  • Implement network monitoring for C2 communications via cloud storage services (Google Drive, OneDrive, Yandex.Disk) using unusual API patterns from system processes.
  • Deploy UEFI firmware integrity monitoring to detect bootkit persistence mechanisms and validate Secure Boot configuration state.
  • Investigate unexpected googleupdate.exe process behavior and DLL sideloading activity, particularly OLLVM-obfuscated payloads decrypting v8_context_snapshot.bin files.

---

Threat Actor Activity

APT41 (Brass Typhoon) — BlackX UEFI Bootkit Campaign

APT41, a Chinese state-sponsored threat group, is attributed with medium confidence to the BlackX UEFI bootkit campaign targeting diplomatic agencies in Central Asia. The bootkit exploits CVE-2022-21894 to bypass Secure Boot and deploy kernel drivers that disable Kaspersky and Avast security products. BlackX contains code present in BlackLotus samples but missing from the publicly leaked BlackLotus repository, suggesting the operator obtained proprietary code through purchase or advanced reverse-engineering. The campaign demonstrates APT41's continued focus on espionage operations against diplomatic entities in regions of strategic interest to China.

North Korea (Lazarus Group) — PHP2Shell Scanning Campaign

North Korean threat actors, attributed with moderate confidence to the Lazarus Group ecosystem, are conducting a deliberate scanning campaign targeting vulnerable PHP infrastructure globally. The activity is coordinated via a closed I2P channel by Korean-speaking operators previously observed in covert DPRK operations. The campaign targets government agencies, financial institutions, logistics, airports, manufacturing, and online transaction platforms across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, U.A.E., Saudi Arabia, and the European Union. Post-compromise TTPs include reconnaissance of authentication databases, Active Directory enumeration via curl-based anonymous LDAP queries, NTLM relay tunnel establishment, and attempted Domain Admin privilege escalation. Commands exhibit machine-parseable output delimiters suggesting agentic AI platform usage.

Unknown Actor — LiteLLM Supply Chain Compromise

An unidentified threat actor operating from IP address 69.48.229[.]143 exploited an unrevoked LiteLLM master key to compromise the Python package release pipeline. The actor demonstrated sophisticated understanding of CI/CD pipeline security, GitHub Actions workflows, and supply chain attack methodologies. Their motivation appears to be credential harvesting and potential downstream compromise of LiteLLM users. The actor exhibited strong operational security by using throwaway branches, deleting workflow runs, and timing actions to evade detection.

---

Geopolitical Context

CISA KEV Additions Reflect Sustained Threat to Enterprise Infrastructure

The addition of CVE-2026-110447 and CVE-2026-114625 to CISA's Known Exploited Vulnerabilities catalog reflects ongoing threats to enterprise collaboration and network infrastructure platforms. The targeting of Nextcloud servers via the Collabora vulnerability—with threat actors seeking credential stores, password managers, and cryptocurrency wallets—is consistent with financially motivated or espionage-oriented campaigns. The Arista VeloCloud Orchestrator flaw represents the third actively exploited vulnerability in that product since July 2026, suggesting sustained adversary interest in software-defined WAN infrastructure used by enterprises and service providers. The exploitation activity originating from IP addresses geolocated to Japan may indicate use of proxy infrastructure rather than attribution to Japanese actors.

North Korean PHP2Shell Campaign Targets Global Financial and Government Infrastructure

The suspected North Korean campaign exploiting PHP2Shell vulnerabilities represents a continuation of DPRK cyber operations targeting financial and government infrastructure for intelligence collection and revenue generation. The activity demonstrates sophisticated tradecraft including low-volume scanning, node rotation, and use of closed I2P channels for coordination. The targeting of government agencies, financial institutions, and transaction platforms in the U.S., Japan, South Korea, and EU aligns with established DPRK priorities: sanctions evasion through cryptocurrency theft and strategic intelligence gathering. The parallel observation of agentic AI use in post-exploitation—including rapid credential harvesting and Active Directory reconnaissance within two hours of compromise—signals an evolution in attacker capabilities.

Dutch Firm's Preemptive Remediation Raises Questions on Cyber Norms

Eye Security's Operation IXIM, which deployed over 2 million updates to disable a vulnerable background updater in Time4Popcorn (an abandoned Popcorn Time fork), represents a private-sector intervention into a systemic vulnerability affecting millions of endpoints globally, including government, military, and corporate networks. The case highlights the absence of clear international norms governing defensive remediation actions by non-state actors when software maintainers have abandoned products. The firm's decision to push unsolicited updates, while legally vetted domestically, raises questions about sovereignty and consent in cross-border cyber operations, even when conducted with defensive intent.

---

Recommended Actions

Immediate (0-24 hours)

  • Audit and remediate LiteLLM v1.107.0 installations: Scan all systems for the compromised package version; uninstall immediately and rotate all API keys for OpenAI, Anthropic, AWS Bedrock, Together AI, PostgreSQL, Redis, and other services accessible from affected environments.
  • Patch CISA KEV vulnerabilities: Upgrade Collabora Online to 26.4.303 and Arista VeloCloud Orchestrator to patched versions (5.2.3.18, 6.1.3.10, 6.4.2.12). Federal agencies must remediate by October 26, 2026.
  • Update Brotli-affected runtimes: Patch Node.js to 22.23.4/24.22.1/26.12.1, Bun to 1.4.4, Python Brotli to 1.2.1, brotlicffi to 1.2.1.0, Envoy to latest patched versions, and Istio to 1.31.2/1.30.6/1.29.9. Restart services and rebuild containers.
  • Disable Tailscale SSH: Disable Tailscale SSH on all nodes until patches are released, especially on headscale 0.29.5 deployments where port forwarding cannot be disabled.
  • Prohibit AI coding agents in Downloads folders: Enforce policy prohibiting running AI coding agents (Codex, Claude Code, Cursor CLI) from ~/Downloads or home directories; require project-specific working directories only.

Within 24-72 hours

  • Activate Secure Boot revocations for CVE-2022-21894: Manually activate Secure Boot revocations for Baton Drop following Microsoft guidance; add "Windows Production PCA 2011" certificate to blocklists.
  • Hunt for LiteLLM compromise indicators: Review GitHub audit logs for unauthorized commits, workflow runs, or OAuth token usage between October 10-21, 2026; inspect database access logs for anomalous connections.
  • Audit NextCloud and VeloCloud for compromise: Search for web shells, unauthorized file modifications, and suspicious outbound connections on NextCloud servers since September 2026; review VCO logs for connections from 74.82.197.86 and 38.54.50.151.
  • Block Brotli decompression at ingress: Configure reverse proxies, load balancers, or WAF to reject requests with Content-Encoding: br headers before they reach application code.
  • Tighten Tailscale ACLs: Review and tighten Tailscale ACLs to use single source-to-destination pairs rather than broad network access rules; enable Tailnet Lock feature.

Within one week

  • Scan for Time4Popcorn installations: Identify and uninstall Time4Popcorn/Popcorn Time installations (Updater.exe, PT.updd.plist); block network access to popcorntimeupd[.]xyz and related update domains.
  • Deploy UEFI firmware integrity monitoring: Implement UEFI firmware integrity monitoring to detect bootkit persistence mechanisms and validate Secure Boot configuration state.
  • Implement low-and-slow scanning detection: Deploy time-series analysis for scanning detection rather than threshold-based alerting; track scanning node rotation patterns and correlate with known Lazarus C2 infrastructure.
  • Audit AI agent sandbox protections: Configure AI agent sandbox protections and approval prompts to require user confirmation before installing packages or executing shell commands.
  • Review credential rotation procedures: Establish automated secret scanning and immediate revocation workflows for any credentials exposed in public repositories.

---

Watch List

  • Tailscale SSH vulnerability patches: Monitor Tailscale security bulletins at https://tailscale.com/security for patches addressing unpatched SSH flaws enabling root escalation from compromised devices.
  • Additional Arista VeloCloud vulnerabilities: Given three actively exploited VeloCloud flaws since July 2026, monitor for additional vulnerability disclosures and exploitation activity targeting SD-WAN infrastructure.
  • North Korean PHP2Shell exploitation: Track for transition from reconnaissance to active exploitation of PHP2Shell vulnerabilities (CVE: see source) against government and financial institutions in the U.S., EU, Japan, and South Korea.
  • AI coding agent attack evolution: Monitor for additional malicious instruction files (AGENTS.md, CLAUDE.md, CURSOR.md) targeting AI coding agents and expanded attack techniques beyond npm package installation.
  • LiteLLM downstream impact: Track for evidence of downstream compromise resulting from LiteLLM v1.107.0 credential exfiltration, particularly unauthorized access to AI inference platforms and source code repositories.

---

Sources

  • BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder — https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
  • BleepingComputer: BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot — https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
  • The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software — https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
  • The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud — https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
  • The Hacker News: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline — https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
  • The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity — https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
  • The Hacker News: Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet — https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
  • The Hacker News: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers — https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html