Critical RCE exploits: PHP, GitLab, LiteLLM under active attack

Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) are [exploitation unverified] in the wild; GitLab's 12-year-old RCE flaw (CVSS 10.0) affects all self-managed versions; and LiteLLM supply-chain compromise delivers credential stealer and backdoor to thousands of Python environments.

PHP Foundation released emergency patches for two critical remote-code-execution vulnerabilities affecting nearly 70% of all websites; exploitation attempts detected before patches were released.

GitLab disclosed a CVSS 10.0 unauthenticated RCE flaw affecting every version from 7.0 (2014) through current releases; October 12 patches do not protect against this flaw.

LiteLLM Python package compromised in supply-chain attack delivering credential stealer and backdoor via PyPI wheels and Docker images.

Google Chrome adds Gemini-powered defenses and ClickFix warnings to mitigate social-engineering attacks.

Lazarus APT group adopts post-quantum cryptography for malware delivery in new campaigns.

1. PHP Critical RCE Vulnerabilities Under [exploitation unverified]

Severity: CRITICAL Affected: Technology

The PHP Foundation has released emergency patches for two critical remote-code-execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated attackers to execute arbitrary code on affected servers [1] . The vulnerabilities are collectively referred to as “PHP2Shell” [1] . Nearly 70 percent of websites running PHP require immediate updates [1] . Cybersecurity companies detected exploitation attempts targeting both CVEs before patches became available [2] , indicating active in-the-wild exploitation risk. The fixes are deployed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . ⚠ Sources: [1] Krebs on Security [2] SecurityWeek

Immediately update PHP to patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) [4]

Monitor web application logs for signs of exploitation attempts targeting PHP processes

If patching is delayed, consider temporarily disabling affected PHP services or restricting network access

2. GitLab Unauthenticated RCE Affecting All Self-Managed Releases Since 2014

Severity: CRITICAL Affected: Technology

GitLab released fixes on October 21 for a critical vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute code on self-managed GitLab servers [1] . The flaw affects every version of GitLab from 7.0 (released in 2014) through current releases [1] . Organizations that applied the October 12 security update remain vulnerable to this specific flaw, as that earlier patch does not address it [1] . Sources: [1] The Hacker News

Apply the October 21 GitLab security patch immediately to all self-managed instances, regardless of prior patch status

Review access logs for evidence of exploitation or unauthorized code execution

Restrict network access to GitLab administrative interfaces pending patching

3. LiteLLM Supply-Chain Compromise Delivers Credential Stealer and Backdoor

Severity: CRITICAL Affected: Technology

The widely-used LiteLLM Python package was compromised in a supply-chain attack that delivered both a credential stealer and backdoor [1] . The compromise affects LiteLLM version 1.107.0 distributed through PyPI wheels and Docker images, according to reports from SafeDep, Socket, StepSecurity, and Upwind ⚠ [1] . This represents a critical threat to any Python environment that installed or pulled the affected package version. Sources: [1] The Hacker News

Immediately audit Python environments and container registries for LiteLLM 1.107.0; remove and replace with a clean version

Rotate all credentials and API keys used by systems running LiteLLM

Review process execution logs and network connections from systems running the compromised package for signs of backdoor activity

Monitor for credential usage from affected systems in unauthorized contexts

4. Lazarus APT Adopts Post-Quantum Cryptography for Malware Delivery

Severity: HIGH Affected: Defense

North Korean threat actor Lazarus is using post-quantum cryptographic mechanisms to secure malicious payload delivery in new operations that combine old and new malware [1] . This represents an escalation in operational security sophistication and suggests sustained capability to conduct advanced cryptographic evasion. Sources: [1] BleepingComputer

Review threat intelligence for Lazarus campaign indicators and IOCs

Monitor network traffic and endpoints for anomalous cryptographic patterns or unknown encryption schemes

Coordinate with government and sector-specific information-sharing communities for updated Lazarus attribution data

5. Google Chrome Adds ClickFix and Scam Protections

Severity: HIGH Affected: Technology

Google announced that Chrome is rolling out improved safeguards against ClickFix social-engineering attacks when Enhanced Protection is enabled [1] . The browser now uses Gemini-powered analysis to detect deceptive websites and warns users when they copy suspicious commands from compromised or malicious web pages [2] . This addresses a common attack vector in which adversaries trick users into pasting malicious code into terminals or command-line interfaces. Sources: [1] The Hacker News [2] BleepingComputer

Ensure Chrome Enhanced Protection is enabled organization-wide via policy

Educate users ClickFix risks and the importance of understanding code before pasting into terminals

Monitor for and block execution of suspicious commands from web-based sources

Today’s Action Checklist

☐ URGENT: Apply PHP emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) to all web servers and verify successful deployment

☐ URGENT: Apply GitLab October 21 security patch to all self-managed instances, including those already patched on October 12

☐ URGENT: Audit Python/PyPI environments for LiteLLM 1.107.0; remove and rotate all associated credentials

☐ Review web application logs and process execution logs for signs of PHP and GitLab exploitation

☐ Enable Chrome Enhanced Protection organization-wide and reinforce user training on ClickFix risks