Today's brief:
- PHP2Shell CVE-2026-109618/-109619 (CVSS v4 9.2): fixed 8.5.12/8.4.27/8.3.36/8.2.35. Probed since Oct 17; hunt PHP_SESSION_UPLOAD_PROGRESS + LFI of sess_ files
- Arista VCO CVE-2026-114625 (9.9), exploited: fixed 5.2.3.18/6.1.3.10/6.4.2.12
- LiteLLM 1.107.0 backdoored; exfil www.litellm[.]dev/healthcheck; pin 1.106.2, rotate secrets
- GitLab CVE-2026-110264 (10.0)
https://tp-security.com/news/cyber-brief-2026-10-23-php2shell-arista-velocloud-litellm
Touchpoint SecurityPHP2Shell Attacks Predate Patches as Arista Fixes an Exploited VeloCloud Zero-Day and a Backdoored LiteLLM Release Targets AI CredentialsPHP2Shell attacks began before patches, Arista fixes an exploited VeloCloud zero-day, and a backdoored LiteLLM release steals cloud and AI keys.