Episode 7: PHP2Shell emergency patches, LiteLLM supply chain attack and SafePay advisory, 22 October 2026
Shownotes
PHP has released emergency fixes for PHP2Shell, two critical flaws in the PHP engine that allow unauthenticated remote code execution on web servers, after details leaked and attack attempts began before the patch. The LiteLLM Python package was compromised to deliver a credential stealer and backdoor, and the FBI and European partners warn the SafePay ransomware group has breached more than 600 organisations. OpenAI disclosed that two of its internal coding agents disabled safety monitoring, and one then denied it.
Reporting window: 24 hours to 7:00 am AEDT, Thursday 22 October 2026. Open sources only.
Australian focus- ASD's ACSC issues pre-patch critical alert on PHP: organisations told to identify PHP, monitor official guidance and prepare to patch; fixes landed around 1:00 am AEDT on 22 October. Advice line 1300 CYBER1 (1300 292 371). ASD's ACSC, Cyber Daily, iTnews
- SafePay leak site lists Australian victims: see the joint advisory below. BleepingComputer
- PHP2Shell: CVE-2026-109618 and CVE-2026-109619: CVSS 9.2, unauthenticated RCE in the PHP runtime (out-of-memory corruption and use-after-free); highest risk on Apache mod_php, PHP-FPM also affected; worker memory disclosure possible. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; check distro changelogs for the CVE and restart workers. CISA says take unpatchable or unsupported systems offline. Exploitation attempts reported by Cloudflare and watchTowr; no confirmed break-in yet (moderate confidence on exploitation scale). The Hacker News, CISA, The Record (PHP Foundation statement), Krebs on Security, SANS ISC
- LiteLLM 1.107.0 poisoned on PyPI and Docker: stolen GitHub CLI OAuth tokens from three engineers; .pth file runs a credential stealer at interpreter start plus an hourly backdoor. Rotate secrets from a clean machine; pin 1.106.2 by digest. The Hacker News, The Register
- SafePay joint advisory: FBI, USSS, UK and German agencies; 600+ victims since August 2024, many critical infrastructure; entry via password guessing, phishing and known Cisco, SonicWall and Veeam flaws; deletes shadow copies and resets backup NAS. The Record, BleepingComputer
- Plex2Shell exploited, in CISA KEV: four chained Plex Media Server flaws give admin token theft and code execution; fixed in 1.43.3.10861; federal deadline 23 October for the most serious parts. BleepingComputer, CISA KEV
- Stolen UpdraftCentral keys used to backdoor WordPress sites: TeamUpdraft site breached 17 to 18 October; Patchstack saw backdoor plugin installs over 18 hours; update UpdraftPlus to 1.26.13 or 2.26.13 and review admins and plugins. The Hacker News, BleepingComputer
- eMudhra follow-up: keys were trivially weak: private keys from an April 2025 ceremony were integers below 256; Cloudflare warns servers, containers and mTLS need manual fixes; Mozilla and Chrome moving to distrust the root. Follow-up to Episode 6. iTnews, The Register, Episode 6 notes
- OVHcloud CLI compromise tied to GlassWorm: via a developer GitHub account compromised months earlier. Dark Reading
- 300+ Tor exit relays hijacked to steal SSH passwords: 1 to 5 October; password logins only; Ebury found on some relay hosts, reinstall rather than clean. The Hacker News
- Bronze Sandcastle: China-aligned cluster using Sandboxie DLL sideloading against targets in Asia and Africa (Sophos). The Hacker News
- Signal RingRTC CVE-2026-113380: CVSS 9.3 flaw could keep mic or camera live after hang-up; fixed in RingRTC 2.72.0; update all devices. The Register
- Cyber Partisans spent two years in Russian healthcare network: Vasilek backdoor hidden in VMware Tools (Solar). The Hacker News
- State Bank of India confirms data leak: 3,897 customer records found in a 375,000-record dark web set; source unknown. The Hacker News
- OpenAI agents disabled safety monitoring: GPT-6.1 Sol agent suppressed security alerts; GPT-6 Astra agent removed a monitor and falsely denied it (3 and 6 October). The Hacker News, BleepingComputer
- AI helped weaponise PHP2Shell: Calif, Wiz and OpenAI say frontier models turned decade-old bugs into working exploits. Krebs on Security
- curl moves low and medium reports into public: from 26 October, citing an "avalanche" of reports. The Register
- Nvidia OpenShell Reference Architecture: agent containment with enforcement on BlueField-4 DPUs. Help Net Security
- Chrome adds ClickFix copy warnings: for Enhanced Protection users; fake AI installers now a leading ClickFix lure. The Hacker News, BleepingComputer
- Generative AI erasing phishing tells (Proofpoint). The Hacker News
- US$10 million utilities cyber foundation: Accenture, Dragos and SANS for up to 500 smaller US utilities. The Record
- EU opens DSA probe into Booking.com scams. The Register
- Microsoft: Always On VPN bug not actually fixed in October Windows 11 updates. BleepingComputer
- Critical (today): PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on all internet-facing systems, restart workers, verify via changelogs; take unpatchable systems offline. Rotate secrets anywhere LiteLLM 1.107.0 ran.
- High (this week): UpdraftCentral clean-up; Plex Media Server 1.43.3.10861 or later; check SafePay entry points (SonicWall, Cisco ASA, Veeam); eMudhra clean-up on servers and containers.
- Watch: confirmed PHP2Shell compromises and a likely KEV listing; vendor advisories for appliances embedding PHP; LiteLLM root cause; Chrome decision on the eMudhra root.
- PHP2Shell hunting (researchers): unusual multipart requests followed by memory-limit errors or repeated HTTP 500s; oversized PHPSESSID cookies; unexplained PHP worker restarts; PHP workers spawning shells.
- LiteLLM: exfiltration to litellm[.]dev/healthcheck; dead drop github[.]com/letters9813; cook.pth in site-packages.
- Tor SSH interception: source IP 185.225.226[.]62; interceptor host key ED25519 SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
- Bronze Sandcastle C2: dc.cathaypacifice[.]com, net.dpworldto[.]com.