Touchpoint Security Advisory

PHP2Shell Attacks Predate Patches as Arista Fixes an Exploited VeloCloud Zero-Day and a Backdoored LiteLLM Release Targets AI Credentials

TSTouchpoint Security·October 23, 2026

The PHP2Shell flaws lead this morning: attackers probed them four days before patches shipped, and broad exploitation attempts are under way. Arista has patched an actively exploited VeloCloud Orchestrator zero-day. A backdoored LiteLLM release, built from a lookalike repository and reporting to a lookalike domain, shows how fast a supply-chain compromise becomes a credential and data-protection problem.

Priority at a glance

PHP2Shell and the Arista VeloCloud flaw are both under active exploitation. The LiteLLM compromise is a closed supply-chain window you need to check against, not an ongoing exploit. GitLab's flaw isn't known to be exploited yet, but its severity and reach make it worth fixing this week regardless.

Issue Exploited Fix status Our recommended timing
PHP2Shell, CVE-2026-109618 / -109619 (CVSS v4.0 9.2) Yes — probed since Oct 17, before the fix Fixed releases available, no full mitigation Today — and hunt back to October 17
Arista VeloCloud Orchestrator, CVE-2026-114625 (CVSS 9.9) Yes, confirmed by Arista Fixed on-prem builds available Today
Backdoored LiteLLM 1.107.0 (supply chain) Active credential exfiltration during the Oct 21 window Pin to clean 1.106.2, rotate secrets Today, if you installed 1.107.0 or pulled those tags
GitLab, CVE-2026-110264 (CVSS 10.0) No exploitation reported Fixed releases available This week — internet-facing self-managed instances first

1. PHP2Shell: exploitation began four days before the fix

What happened. PHP shipped emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619. Both are memory-handling flaws, rated CVSS v4.0 9.2, that allow unauthenticated remote code execution. Amazon Threat Intelligence saw the first exploit attempt on October 17, after details leaked during the embargo. Broad attempts followed the release, including blocked attempts to install a Mirai-derived botnet; no confirmed compromises have been reported yet. VulnCheck has built a working exploit, covering CVE-2026-109618. The UK NCSC advises updating PHP or taking servers offline.

Who is affected. Every PHP installation serving web requests, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is at highest risk. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older need an LTS vendor or source backports. Appliances that bundle PHP are also exposed.

The LFI angle. Arctic Wolf reports that scanners probing for PHP2Shell are also testing an older technique that pairs PHP's session upload progress feature with local file inclusion (LFI) bugs in the application itself. An attacker writes PHP code into a session file through an upload request, then uses a vulnerable include parameter to load that file and run the code. The LFI is an application flaw, not one of the two CVEs, and Arctic Wolf notes these probes don't prove a target is vulnerable.

What to do. — click a step to check it off, click any code snippet to copy it

  1. Inventory every PHP runtime and appliance, internet-facing first, and ask vendors for their patch status.
  2. Upgrade. PHP says no configuration fully mitigates the flaws.
  3. If patching must wait, apply PHP's partial mitigations, such as session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart workers. This also closes the session-file write that LFI chains rely on, and covers a low-likelihood session issue PHP flagged on October 23 (CVE-2026-115560).
  4. Close LFI paths: never pass user input to include or require, and allowlist the files an application may load.
  5. Hunt back to October 17: look for PHP_SESSION_UPLOAD_PROGRESS in upload requests, parameters that reference session files (sess_) or directory traversal, unexpected child processes, and new files in web roots.

2. Arista VeloCloud Orchestrator zero-day exploited (CVE-2026-114625, CVSS 9.9)

What happened. Arista disclosed on October 22 that attackers are exploiting a SQL injection flaw in on-premises VeloCloud Orchestrator (VCO), the console that runs its SD-WAN. Any authenticated user, even one with read-only rights, can gain operator privileges — and with them, control of branch network configuration.

Who is affected. On-premises VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. Arista has already patched hosted and Dedicated instances. The flaw was not in CISA's Known Exploited Vulnerabilities (KEV) catalog as of its latest release (October 21).

What to do. — click a step to check it off

  1. Upgrade now. Until then, restrict the web interface to admin networks and block the source IPs Arista published (74.82.197[.]86, 38.54.50[.]151).
  2. Review access logs and admin changes, and check for web shells.
  3. Preserve logs before remediating any suspected compromise.

3. Backdoored LiteLLM release built from a lookalike repository

What happened. On October 21, an attacker using stolen developer GitHub tokens published a backdoored LiteLLM 1.107.0, a popular AI gateway library. It was on PyPI from 11:39 to 13:23 UTC. The Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable served it until 14:20 UTC. The build came from a lookalike GitHub repository, Berri-AI/litellm, imitating the real BerriAI/litellm. Upwind researchers, reporting in LiteLLM's own repository, found stolen data going to www.litellm[.]dev/healthcheck. The domain was registered on October 13 and imitates the real litellm.ai with a TLD swap. Neither source says whether it has been taken down.

Who is affected. Any system that installed 1.107.0 or pulled those tags in that window. The payload runs whenever Python starts. It steals cloud, Kubernetes, CI/CD and AI provider credentials, SSH keys and browser data, including saved logins and payment autofill, and fetches new code hourly.

What to do. — click a step to check it off

  1. Check lockfiles and image digests for the affected version and tags.
  2. On affected hosts, do not run Python or pip first. Rebuild from clean images pinned to 1.106.2, and rotate every secret the host could reach.
  3. Block litellm[.]dev in DNS and proxies, search logs for past connections, and pin dependencies by hash.

4. GitLab patches maximum-severity remote code execution flaw (CVE-2026-110264, CVSS 10.0)

What happened. GitLab's October 21 patch release fixes an integer overflow in its regular expression compiler. Under certain conditions, it could let an unauthenticated user run code on the server. No exploitation has been reported.

Who is affected. Self-managed GitLab CE and EE from version 7.0 onward. Fixed releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched.

What to do. — click to check it off

  1. Upgrade self-managed instances now, internet-facing ones first. They hold source code and CI/CD secrets.

Compliance and personal data

$25 billion privacy penalty against Meta New Mexico's Department of Justice announced on October 21 a $25 billion civil penalty against Facebook under the state's Unfair Practices Act. A jury had found 43,899,725 violations tied to privacy statements and third-party access to data. Meta plans to appeal. Privacy notices are enforceable promises, so confirm yours match how you actually share data.
HIPAA penalties unchanged for 2026 An HHS Federal Register notice (October 21, 91 FR 66566) cancels the 2026 inflation adjustment because the 2025 government shutdown left no inflation data to compute it. The 2025 maximums in 45 CFR 102.3 still apply.
When stolen secrets become a data breach The LiteLLM and Railway incidents exposed credentials that can open databases holding personal data, and LiteLLM's payload also took browser logins and payment data. Once access to personal data is confirmed or reasonably suspected, clocks may start: 72 hours under GDPR, up to 60 days for unsecured PHI under HIPAA, state deadlines, and SEC Form 8-K Item 1.05 for material incidents. Record what each key could reach and when it was rotated, and require prompt notice in vendor contracts and business associate agreements.
Patch timelines are evidence When judging whether security was "reasonable," regulators may ask how long internet-facing PHP stayed unpatched after a public fix. Record the date and decision for each system.

This section is general information, not legal advice.

Also notable

Railway customer secrets exposed The cloud platform Railway disclosed on October 21 that an intruder may have accessed encrypted customer environment variables, and in some cases their decrypted contents, such as API keys and database credentials. It says a subset of users is affected and paused deployments during its investigation. All Railway customers should rotate stored secrets and review logs on the services those secrets unlock.
INTERPOL's Operation Serengeti III Police in 21 countries, including the US, arrested 1,462 suspects and disrupted 10,909 malicious networks across Africa between June 29 and August 31, INTERPOL announced on October 22. The schemes included business email compromise, ransomware and investment fraud. Investigators identified 65,929 victims, more than $385 million in losses and more than $105 million recovered.
Node.js security release Node.js versions 22.23.4, 24.22.1 and 26.12.1 (October 21) fix 10 flaws. The most serious is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that the project says permits remote code execution. Node.js 20 and earlier are end of life, so services that decompress untrusted input should move to a supported line.
Chrome distrusts an eMudhra root on October 27 Google says its removal of the emSign ECC Root CA - G3 from the Chrome Root Store should reach all devices on October 27. The move follows the discovery of easily guessable keys on eMudhra intermediate CAs. Site owners with certificates chaining to that root, many issued through the InCommon service used by universities, must replace them now to avoid outages.
Signal call-teardown flaw CVE-2026-113380 in RingRTC, the library behind Signal calls, lets a caller flood the call so that hanging up may not end it, leaving audio and possibly video flowing. No CVSS score has been published. It's fixed in RingRTC 2.72.0, with no exploitation known. Keep Signal clients updated across managed devices.

Touchpoint's Take

The disclosure date no longer starts the clock. PHP2Shell was probed four days before its fix, and Arista learned of its flaw because attackers were already using it. Plan for internet-facing patches within hours, and start hunting before the advisory date.

LiteLLM shows where attackers are heading: AI tools in build pipelines that hold an organization's most valuable keys, reached through stolen tokens and lookalike names. Knowing what each secret unlocks is now as much a compliance control as a security one.

If you would like help assessing your exposure to these issues or your notification readiness, the Touchpoint Security team is available.

Sources

  • PHP: October 21, 2026 security releases and October 23 informational advisory
  • CERT/CC VU#763488: Memory corruption vulnerabilities in PHP
  • PHP Foundation: Today's PHP security release
  • Amazon Threat Intelligence: PHP2Shell exploitation prior to public disclosure
  • UK NCSC: Critical security issue affecting PHP
  • Sophos: Proof-of-concept exploit released for PHP vulnerabilities
  • Arctic Wolf: PHP2Shell critical PHP vulnerabilities enable unauthenticated remote code execution
  • VulnCheck: PHP2Shell vulnerabilities
  • BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches
  • Arista Security Advisory 0199
  • CISA Known Exploited Vulnerabilities catalog (official data feed)
  • BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day
  • LiteLLM: Security incident, October 21, 2026
  • LiteLLM GitHub issue #47826 (Upwind research, indicators)
  • BleepingComputer: LiteLLM release pipeline hacked
  • GitLab Patch Release 19.5.1
  • BleepingComputer: GitLab warns of new max severity code execution vulnerability
  • New Mexico Department of Justice: $25 billion penalty against Facebook
  • Federal Register: No Adjustment to HHS Civil Monetary Penalty Amounts for 2026
  • The Hacker News: Meta ordered to pay $25 billion
  • The HIPAA Journal: HHS confirms HIPAA penalties will not be adjusted for inflation
  • Railway: Security disclosure, October 21
  • INTERPOL: Cybercrime crackdown in Africa nets 1,462 arrests
  • Node.js: October 2026 security releases
  • Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
  • The Hacker News: eMudhra to exit global SSL/TLS business
  • CVE record: CVE-2026-113380
  • Signal RingRTC fix commit
  • Help Net Security: Signal flaw could expose audio and video after hang-up

Not sure where you stand on any of this?

Our team is available to talk through your exposure to today's issues.

Contact us