Cybersecurity Watch · October 26, 2026
PHP2Shell Leaves Most of the Web Waiting to Patch, Microsoft Ties the ConnectWise Attack to an AI-Driven China-Aligned Group, and Two Supply Chain Compromises Hit Developer and AI Tooling
The Patch Window Is Collapsing: Critical Flaws, AI-Assisted Attackers and Poisoned Developer Tools All Landed in the Same Week
PHP2Shell, two critical remote code execution flaws in the PHP engine, is the week's defining vulnerability. PHP shipped emergency fixes on October 21 after details leaked, governments took public sites offline as a precaution, and exploitation attempts began before the patches existed. Yet no successful compromise has been publicly confirmed, and the practical risk depends heavily on server configuration. The larger problem is patch coverage: a Qualys analysis says roughly 71% of PHP instances in its data run end-of-life versions that will not receive an official fix.
Elsewhere, Microsoft attributed the ConnectWise Cloud Backup attack to Storm-0940, a China-aligned group that it says used an AI penetration-testing framework to automate the campaign. LiteLLM, an AI gateway library with about 23 million weekly downloads, was compromised for the second time this year, and OVHcloud's official CLI shipped a secret-stealing binary for part of a day. CISA also added two exploited flaws to its catalog with a deadline of today.
Editorial Note: This edition covers developments from October 19 to 25. Several stories continue from last week's Cybersecurity Watch, and each item states its original date. Claims about AI involvement, attribution and exploitation success vary across sources, and where they conflict the article says so.
Cybersecurity Watch at a Glance
| Development | Dates | Status |
|---|---|---|
| PHP2Shell (CVE-2026-109618, CVE-2026-109619) | Oct 20 to 25 | Patched; attacks attempted; no confirmed compromise; not in CISA KEV as of Oct 25 |
| Microsoft attributes ConnectWise attack to Storm-0940 | Oct 21 | Vendor attribution; AI role per Microsoft |
| LiteLLM 1.107.0 compromised | Oct 21 | Confirmed; malicious release removed |
| OVHcloud CLI releases replaced with stealer | Oct 19 | Confirmed by OVHcloud; postmortem promised |
| CISA KEV: Collabora Online and Arista VeloCloud flaws | Oct 24 | Exploited; federal deadline Oct 26 |
Active Exploitation and Vulnerability Intelligence
PHP2Shell: Emergency Patches Are Out, Attacks Are Being Tried, and Most Instances Are Still Exposed
What happened (October 20 to 25): PHP released fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 on CVSS v4.0 and described as enabling unauthenticated remote code execution. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal backports for 7.4, 8.0 and 8.1, per SecurityWeek. That release came one day earlier than planned after the CVE identifiers leaked online. Every PHP release from 5.4 onward is affected by at least one of the flaws. Wiz, OpenAI and Calif found them in August, and The Next Web reports that one audit was funded through OpenAI's Patch the Planet initiative while Wiz found the bugs independently using AI models.
Operational impact: Several government, school and hospital sites in Europe went offline on October 21, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly because of precautionary measures, per SecurityWeek. CNN reported that US and European security agencies advised organizations to act immediately, and that the PHP Foundation urged operators to update. The Tanium timeline shows CERT-EU advising on October 20 that internet-facing PHP applications be isolated if patching was not possible.
Exploitation: attempts, not confirmed breaches. Amazon reported the first attempt on October 17, four days before the patches, and watchTowr, Cloudflare and others reported attack attempts after disclosure. SecurityWeek reports that Sophos linked one attempt to a Mirai-derived botnet, though that attempt was stopped, that Hunt.io and Wordfence report attempts without known compromises, and that VulnCheck built a commercial exploit that gets around ASLR on production-style configurations. Sansec revised an earlier prediction of immediate mass exploitation, saying attackers need detailed knowledge of a server and publicly available exploits fail against default PHP installations. SOCRadar found an attacker's toolkit on an exposed server, and none of the 20 or so sites the operator fingerprinted met its requirements. Some vendors describe the flaws as broadly exploited, which is a statement about attempts. Neither CVE was in CISA's Known Exploited Vulnerabilities catalog as of October 25, and CISA said on October 21 that it had not observed exploitation.
Why it matters: Qualys analysis cited by SecurityWeek found only 199,000 PHP instances patched within 12 hours. Roughly 110 million instances, about 71%, run PHP 5.4 through 8.1, which are past end of life, and about 44 million more run supported branches that had not yet been updated. The discovery story is also significant: frontier AI models helped find and chain decade-old bugs in under a week, a pace that compresses the time defenders have between discovery and exploitation.
What to do: Update internet-facing PHP first and restart workers, since an update alone may not replace running processes. For unsupported versions, plan migration and apply backports or compensating controls in the meantime, and monitor for unusual multipart requests as Wiz advises. Treat the hosting stack, including control panels and CMS plugins, as in scope. Censys is tracking patch progress on a public dashboard.
Connect to: Cloud Computing Watch · Technology Intelligence · AI Intelligence
CISA Adds Exploited Collabora Online and Arista VeloCloud Flaws, With a Deadline of Today
What happened (October 24): The Hacker News reports that CISA added two flaws to its Known Exploited Vulnerabilities catalog on Friday. CVE-2026-110447 (CVSS 9.2) is an OS command injection flaw in Collabora Online's built-in CODE server when used with Nextcloud. Attackers have been observed using it to plant web shells on Nextcloud servers and search for credential stores, password-manager artifacts and cryptocurrency wallets. CVE-2026-114625 (CVSS 9.9) is an SQL injection flaw in on-premises Arista VeloCloud Orchestrator, with fixes released in October in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12. Exploitation requires network access to the orchestrator's web interface and an authenticated session. It is the third flaw in that product to be exploited since July. Federal civilian agencies were directed to patch by October 26.
Why it matters: Collaboration servers and network orchestrators hold credentials and sit in privileged network positions, so a compromise there gives an attacker both access and a place to look for more. A KEV listing is the clearest public signal that exploitation is real, and the deadline applies by directive only to US federal agencies, though it is a reasonable benchmark for everyone else.
Connect to: Technology Intelligence
Cyber Incidents and AI-Assisted Attacks
Microsoft Ties the ConnectWise Cloud Backup Attack to Storm-0940 and an AI Pentest Framework
What happened (October 21 advisory; continuing story): Microsoft assessed that Storm-0940, a China-aligned actor active since 2021, was responsible for the ConnectWise Cloud Backup compromise covered in last week's edition, per SecurityWeek. Microsoft said the group used ARTEX, an open-source agentic AI penetration-testing framework, to automate scanning, password spraying and OAuth application abuse, and that on October 15 it used ARTEX to compromise Microsoft 365 environments of Cloud Backup customers, per Silicon UK. SecurityWeek reports Microsoft captured more than 151,000 failed logon events and also saw successful authentication using the identities of multiple ConnectWise cloud applications.
Scale and speed: Tom's Hardware reports that the agents attempted sign-ins at more than 2,250 Microsoft 365 tenants, that Microsoft confirmed unauthorized sign-ins for 162 tenants, and that some attacks reached privileged access in under three hours. That 162 figure is lower than the 173-tenant researcher estimate cited last week, so treat tenant counts as evolving. Cybersecurity News notes Zscaler's separate report showing an operator combining ARTEX with AI coding assistants, and that changes made to application credentials could preserve access even after the original ConnectWise connection was disabled.
Caveats: Microsoft did not state a confidence level for the attribution, per a review of the reporting, and the same review notes that AI use in this phase is Microsoft's claim without published artefacts, with only the speed and scale as public indicators. SC Media quotes a Horizon3 co-founder saying AI did not break in; a poorly protected vendor secret did, and agentic tooling made the damage faster. ARTEX's developer has said the project will no longer be updated and will become closed source, per Reuters as relayed by Tom's Hardware. I could not confirm ConnectWise's current restoration status, so check its advisory page before advising customers.
Why it matters: Both views can be true. The root cause was a vendor credential with broad tenant access, which is a conventional failure. The AI element is about tempo, since automated reconnaissance and credential attacks across thousands of tenants shrink the time between initial access and privilege. Defenders should assume faster attackers and reduce standing access.
Connect to: Enterprise AI Intelligence · Company Intelligence
Software Supply Chain and Developer Tooling
LiteLLM Is Compromised for the Second Time This Year
What happened (October 21, confirmed): Malicious LiteLLM version 1.107.0 was published to PyPI and distributed in official container images, per Help Net Security. Datadog Security Labs says the release was published at 11:39 UTC and quarantined at 13:20 UTC, roughly two hours, while SecurityWeek says about three hours and estimates over 49,000 downloads. The payload steals cloud credentials, SSH keys and AI provider keys and acts as a remote access tool. It was placed in Python startup files, so it runs whenever Python starts in an affected environment, even if LiteLLM is never imported. Microsoft published its own analysis on October 23. The last known safe version is 1.106.2.
How: Per Datadog, the attackers used stolen credentials to launch and approve an unauthorized run of the legitimate build pipeline against a malicious fork named with one extra hyphen. SecurityWeek says GitHub CLI OAuth tokens were compromised, and a third-party analysis attributes them to an exposed internal deployment log, per BerriAI. LiteLLM was also hit in March, which makes this its second compromise this year.
Why it matters: AI gateways sit between applications and many model providers, so they concentrate API keys and cloud identities. If you installed 1.107.0, assume the credentials on that machine are compromised, rotate them and check for the malicious startup files.
Connect to: Enterprise AI Intelligence · Technology Intelligence
OVHcloud's Official CLI Releases Were Swapped for a Secret Stealer
What happened (October 19, confirmed by OVHcloud): An attacker used a developer's GitHub account to replace binaries for OVHcloud CLI versions 0.11.0 through 0.15.0 with a build designed to steal secrets from disk, per SecurityWeek. OVHcloud founder Octave Klaba said v0.10.0 and the new v0.16.0 are clean. BleepingComputer reports Klaba later said GitHub's release immutability setting had been disabled, which let a privileged account modify existing releases without passing CI/CD checks. Researchers say the developer's account had been compromised since March with a loader linked to the GlassWorm campaign. They could not confirm that the same actor carried out both events, and OVHcloud has not mentioned GlassWorm. Only builds for the most common platforms were replaced. One analysis says a user's CI job, which pinned the file hash, caught the change.
What to do: If you installed or updated the CLI on October 19, revoke and regenerate OVHcloud API credentials, including those in ~/.ovh.conf and CI runners, and rotate other secrets on the machine. OVHcloud has promised a detailed postmortem. It has not said which files the binary reads, where it sends them, or how many copies were downloaded. Reports of how long the malicious files stayed up differ across sources.
Why it matters: The attack changed release files, not source code, using an account that already had write access. Hash pinning and immutable releases are cheap controls that worked or would have worked here. This is also the second OVHcloud item this week, after its capacity and AI-model news covered in Cloud Computing Watch.
Connect to: Cloud Computing Watch · Company Intelligence
Enterprise Response Priorities
- Inventory PHP everywhere. Include shared hosting, containers, CMS platforms, vendor appliances and control panels. Patch internet-facing systems first, restart workers, and put end-of-life versions on a migration plan with interim backports or compensating controls.
- Decide in advance when to go offline. This week's precautionary takedowns show the trade-off between risk and availability. Define who decides, which services can be isolated and how they come back.
- Check KEV items today. Confirm whether you run Collabora Online CODE with Nextcloud or Arista VeloCloud Orchestrator, and check them for web shells or unexpected accounts as well as patching.
- Finish the ConnectWise review. Check service principal sign-ins and recent changes to app credentials, permissions and admin roles in every tenant you manage, since persistence can outlast the original connection.
- Search for LiteLLM 1.107.0 and the OVHcloud CLI versions 0.11.0 to 0.15.0. Check developer machines, CI runners and images. Rotate credentials found on any affected host rather than only the ones you know were used.
- Harden release pipelines. Pin dependencies by hash, require immutable releases, limit token scopes, and keep tokens out of logs.
What to Watch Next
- PHP2Shell exploitation outcomes. The first confirmed successful compromise, any CISA KEV listing, and Censys patch-progress numbers.
- ConnectWise. Restoration instructions, the remaining unexplained question of how the vendor credential was stolen, and any independent corroboration of Microsoft's AI-use claim.
- OVHcloud postmortem. Which files the binary read, where it sent them and how many users were exposed.
- LiteLLM follow-up. Whether further tokens or packages from the same pipeline were abused, and the scale of credential misuse.
- Next KEV additions and Microsoft's November 10 Patch Tuesday. Also unpatched research such as the Tailscale SSH findings published October 25, which The Hacker News reports as unpatched and requiring an already compromised device on the network.
Discovery, exploitation and credential theft are all getting faster, but the controls that limit damage are still the unglamorous ones: inventory, patching, least privilege and verified builds.
For security teams: Know where you run widely embedded components like PHP before a disclosure, because the first 24 hours decide whether you are patching or improvising.
For engineering leaders: Treat release pipelines, GitHub tokens and package registries as production systems. Two of this week's incidents exploited their weaknesses.
For executives: Plan for disclosure-driven outages. Precautionary shutdowns of government and corporate sites show that availability is now part of the patching decision.
The CODEW Stat
~110 million — the number of PHP instances, about 71% of those in Qualys's analysis, running end-of-life versions 5.4 through 8.1 that will not get an official PHP2Shell fix. Another roughly 44 million run supported versions that had not yet been updated. Whatever happens with exploitation in the coming days, that gap is the story: critical flaws in foundational software outlive the support window of the software that contains them.
Sources: SecurityWeek, The Hacker News, Microsoft Security Blog, Datadog Security Labs, Help Net Security, BleepingComputer, The Next Web, CNN, Tanium, Sansec, Tom's Hardware, Silicon UK, SC Media and secondary technical analyses, covering October 19 to 25, 2026. Where a story is relayed through a secondary outlet, the item says so.
Confirmed incidents, vendor attributions, researcher estimates and unconfirmed claims are labeled separately. Exploitation status changes quickly; verify against CISA, vendor advisories and the original researcher write-ups before acting. This series does not provide security or investment advice.
Reviewed by Erwin Castro
on
Monday, October 26, 2026
Rating:
No comments: