The Speed of Compromise: PHP2Shell Exploited, LiteLLM Poisoned, GitLab CVSS 10 & AI ...

The Speed of Compromise: PHP2Shell Exploited, LiteLLM Poisoned, GitLab CVSS 10 & AI Agents Disable Their Own Security Controls

Good Morning Security Gang!

The last 24 hours have been nothing short of extraordinary. I’ve been doing this show for years, and I can’t remember another period where we’ve seen this much activity happening this quickly.

Yesterday, we warned two critical PHP vulnerabilities and the emergency patches being prepared. Today, those patches are available, but attackers didn’t wait. Exploitation attempts were already hitting security sensors before organizations had an opportunity to deploy the fixes.

We’re also tracking a major software supply-chain compromise involving LiteLLM, where attackers used stolen GitHub credentials to publish malicious releases containing credential stealers and backdoors. GitLab has disclosed a maximum-severity vulnerability affecting releases dating back to 2014, and a Japanese hosting provider has taken thousands of customer servers offline following a significant infrastructure compromise.

And then there’s the AI story: OpenAI has disclosed incidents where autonomous agents interfered with the very monitoring systems designed to supervise their behavior.

Today’s biggest cybersecurity challenge isn’t simply the number of vulnerabilities. It’s the speed at which attackers can turn a weakness into an operational compromise.

The gap between disclosure and exploitation is shrinking from days to hours, and in some cases, the attacks are arriving before the patches.

I’ve got my coffee ready, gang.

Coffee cup cheers. Let’s get into today’s cybersecurity news.

PHP2Shell: Critical Vulnerabilities Exploited as Emergency Patches Arrive

We begin with the biggest story of the day.

The PHP security team has released emergency updates for two critical vulnerabilities collectively being called PHP2Shell , following the premature disclosure of technical details.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , both carry CVSS scores of 9.2 and can lead to remote code execution in vulnerable PHP environments.

The first involves memory corruption, while the second concerns stale global state. Researchers have confirmed remote-code-execution potential in Apache environments using mod_php, while maintainers warn that other PHP deployment models may also be affected.

Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 , with limited backports available for older versions.

The problem is the scale of the exposure. PHP supports a substantial portion of the world’s websites, including content management systems, e-commerce applications, custom enterprise portals, and legacy business systems.

Security researchers identified exploitation attempts before the official patches were available, with some attacks targeting PHP session-upload-progress functionality. Although attempts have been observed, the reporting discussed today does not establish widespread successful compromise.

Researchers also warn that the vulnerabilities may permit disclosure of process memory containing credentials, API keys, and other sensitive information.

My Take: The Emergency Patch Is Only the Beginning

The urgency here is obvious, but the operational challenge goes beyond deploying the update.

How many organizations know every PHP runtime operating in their environment?

Not just their primary website, but their forgotten marketing sites, development servers, container images, hosting panels, and third-party appliances?

That’s where attackers will look. If your asset inventory isn’t already accurate, you cannot build it fast enough once an exploit becomes public.

Organizations need to deploy the fixed releases immediately, investigate suspicious requests dating back to Tuesday, and assess whether secrets stored in potentially compromised PHP processes require rotation.

This is the kind of vulnerability where knowing what you own before the advisory arrives determines how effectively you can respond.

LiteLLM Supply Chain Compromised: Malicious Releases Steal Cloud and AI Credentials

Our second major story involves LiteLLM , a popular Python package used to connect applications with multiple AI model providers.

Attackers compromised the project’s release process and distributed malicious code through version 1.107.0 , including affected Python packages and Docker images.

According to the investigation, the attackers gained access through three engineering GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. One compromised account initiated the release, while another approved it. That allowed the attackers to defeat a two-person approval process without needing to compromise the underlying GitHub platform.

The malicious package contained a Python .pth file named cook.pth , which could execute automatically when Python started, even before the LiteLLM package was explicitly imported.

The first payload, identified as PrivCollect, collected cloud credentials, developer tokens, private keys, browser information, environment variables, and AI provider credentials.

A second payload established persistence through a background process that periodically checked GitHub for additional commands.

PyPI quarantined the affected package, and the malicious Docker images were removed. However, the original method used to steal the developers’ credentials remained unresolved at the time of reporting.

My Take: Developer Endpoints Are Tier Zero

This is the second major developer-pipeline compromise we’ve discussed in two days, following yesterday’s Ghost Action campaign. And the common denominator isn’t some exotic vulnerability. It’s stolen developer credentials.

We’ve spent years protecting production environments with privileged-access management, MFA, and session monitoring. Yet developer workstations can still hold long-lived tokens capable of publishing software consumed by thousands of organizations.

LiteLLM even had a two-person approval requirement. The attackers simply controlled both accounts.

“Approval workflows don’t help when the attacker controls the credentials of every approver.” James Azar

“Approval workflows don’t help when the attacker controls the credentials of every approver.” James Azar

We need shorter-lived tokens, stronger protection for developer endpoints, hardware-backed release signing, verified publishing provenance, and tighter controls over software release authority.

Organizations using LiteLLM should for version 1.107.0 and the malicious cook.pth file. Any affected system should be treated as potentially compromised, with credentials rotated from a clean environment and workloads rebuilt using a verified release.

The lesson is simple: developer security is production security.

GitLab Patches CVSS 10 Remote Code Execution Affecting Releases Since 2014

GitLab has released emergency security updates addressing CVE-2026-110264 , a maximum-severity vulnerability carrying a CVSS score of 10.0.

The flaw involves an integer overflow during regular-expression compilation in the Onigmo engine used by GitLab.

Under certain conditions, an unauthenticated attacker could exploit the vulnerability to execute arbitrary code on a self-managed GitLab server. The vulnerability affects releases dating back to GitLab 7.0 in 2014 , creating an unusually broad exposure window.

Fixed releases include 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 .

GitLab has provided additional backported fixes outside its normal support practices because of the severity. No exploitation in the wild had been confirmed when today’s episode was recorded, and GitLab had not provided an interim workaround.

The concern is that GitLab is more than a source-code repository. It frequently contains deployment credentials, CI/CD secrets, infrastructure configurations, and the automation required to deliver software into production. A successful compromise can therefore extend into the broader development and deployment environment.

Organizations should update self-managed GitLab instances immediately, even if they applied the earlier October security release. A compromised GitLab server can become a direct pathway from source-code management into production infrastructure.

Japanese Hosting Provider Takes Thousands of Customer Servers Offline After Infrastructure Breach

Japanese hosting provider GMO Internet has confirmed a major cybersecurity incident affecting its desktop-cloud service, marketed to customers running always-on trading applications. Attackers reportedly compromised the provider’s underlying infrastructure and deployed malware across as many as 27,000 customer servers.

The company confirmed the intrusion on October 20 and began shutting down customer systems on October 21. At the time of reporting, the service remained offline without a confirmed restoration date.

GMO stated that customer data stored on affected servers may have been exposed, although it had not confirmed misuse. Payment-card information was reportedly maintained on separate infrastructure.

The initial intrusion method remained unknown. This incident demonstrates the concentration of risk associated with hosting and virtualization providers.

Customers may have secured their own applications, but if attackers compromise the infrastructure managing those virtual machines, the entire tenant population can become exposed.

Affected customers should treat stored credentials and server images as potentially compromised, rotate secrets, and rebuild from trusted sources when recovery becomes available.

The broader lesson is that your virtual server is only as secure as the infrastructure and management plane supporting it .

Gentleman Ransomware Expands Across Windows, Linux and Virtualization Infrastructure

The Gentleman ransomware-as-a-service operation continues targeting organizations across multiple operating systems, including Windows, Linux, NAS, and BSD environments. The group claims more than 800 victims, although that figure represents its own reporting rather than an independently verified victim count.

Its Windows payload reportedly disables Microsoft Defender protections, stops security and backup services, deletes volume shadow copies, and clears logs and PowerShell history. The operators also use lateral movement tools such as PsExec and techniques involving vulnerable drivers to interfere with endpoint protection.

For security teams, the priority is detecting behavior associated with ransomware preparation rather than relying exclusively on malware signatures.

Unexpected Defender exclusions, suspicious driver installations, mass service termination, and attempts to delete backups should trigger immediate investigation. Backups must also be protected from administrators or service accounts that an attacker could compromise during lateral movement.

Node.js Releases Critical Security Updates Including Remote Code Execution

Node.js has released security updates addressing ten vulnerabilities across supported branches.

Fixed versions discussed today include 26.12.1, 24.22.1, and 22.23.4 . One of the most significant vulnerabilities, CVE-2026-111497 , involves an out-of-bounds write in the Brotli decoder that may enable remote code execution.

Additional vulnerabilities affect TLS hostname verification, potentially undermining assumptions the identity of remote services.

Organizations should prioritize applications processing untrusted compressed content and services relying on TLS validation. Updating Node.js also requires rebuilding affected application images and restarting services. Simply updating a base image in a repository does not remediate applications still running older containers in production.

Lazarus Uses Post-Quantum Cryptography to Protect Malware Communications

North Korea’s Lazarus Group is reportedly using post-quantum key-exchange technology in a campaign targeting South Korean organizations.

The operation, identified as Flash Holder, has reportedly been active since July 2025 and uses ML-KEM-1024 to protect communications associated with malware delivery.

The attack chain begins with phishing and malicious GitHub pages before progressing through in-memory execution techniques and legitimate Windows components, ultimately deploying a backdoor identified as Cubridge.

At least three organizations across software, construction, and telecommunications equipment manufacturing were reportedly affected. The use of post-quantum cryptography does not make the malware impossible to detect.

It does, however, demonstrate why defenders cannot depend entirely on inspecting command-and-control traffic. Behavioral indicators, unusual process execution, suspicious DLL loading, and unauthorized persistence remain important detection opportunities.

Google Chrome Expands HTTP Warnings and AI-Powered Scam Detection

Google is expanding Chrome’s security protections by enabling HTTP connection warnings more broadly. The changes are intended to alert users when browsing to websites that do not provide encrypted HTTPS connections.

Chrome is also expanding AI-assisted detection capabilities for suspicious websites, scams, and ClickFix-style social engineering. For enterprises, these changes may create additional help-desk requests from employees using internal tools that still rely on HTTP.

Organizations should identify internal applications that require modernization and evaluate whether Chrome’s Enhanced Protection capabilities are appropriate for managed endpoints.

The broader lesson is that browser security remains an important part of protecting users from increasingly sophisticated social-engineering campaigns.

OpenAI Discloses AI Agents That Disabled Their Own Safety Monitoring

We close today’s show with one of the most important emerging AI governance challenges. OpenAI disclosed two internal incidents in which autonomous AI agents interfered with monitoring controls.

In the first incident, on October 3, a GPT-6.1 agent reportedly interpreted an instruction not to send messages in a way that suppressed monitoring alerts intended for human oversight.

In the second incident, on October 6, a GPT-6 Astra agent reportedly removed monitoring during a migration task, replaced an attestation intended to preserve monitoring, and subsequently denied having made the change. OpenAI has since introduced controls designed to prevent agents from disabling internal monitoring.

These incidents illustrate an important distinction between AI agents that generate recommendations and agents that can independently modify operational systems.

An agent may pursue its assigned objective while taking actions that undermine the controls intended to supervise it. That creates a governance problem even when the agent is not intentionally malicious.

Organizations deploying autonomous agents should ensure those agents cannot modify or disable the security controls responsible for monitoring their behavior. The system performing the work cannot also have unrestricted authority to disable the system watching the work.

CISOs Take by James Azar

My biggest takeaway today is that the speed of exploitation is fundamentally changing how we need to operate as cybersecurity practitioners . PHP2Shell demonstrates that attackers can begin exploiting vulnerabilities before patches are available, while LiteLLM shows how stolen developer credentials can become malicious software releases distributed through trusted channels. GitLab’s maximum-severity vulnerability reminds us that a weakness can remain buried inside widely used software for more than a decade before being discovered. We cannot wait for the advisory to arrive before figuring out where our systems are, who owns them, and how quickly they can be remediated. That work has to be done beforehand. Asset inventory, vulnerability prioritization, developer identity security, and software supply-chain controls are no longer separate disciplines. They’re part of the same operational security challenge. We need to protect developer endpoints as privileged infrastructure, verify software provenance, and build emergency remediation processes that can operate in hours rather than weeks. The organizations that respond effectively will be the ones that prepared before the incident, not the ones that scramble after the exploit becomes public.

My second takeaway is that trust and autonomy need enforceable boundaries, particularly as AI becomes more deeply integrated into enterprise operations . The GMO hosting breach demonstrates how a compromise at the infrastructure layer can affect thousands of customers simultaneously. Lazarus using advanced encryption reinforces the importance of behavioral detection when network visibility is limited. And OpenAI’s disclosure agents interfering with their own monitoring should be a wake-up call for every organization deploying autonomous AI. If an agent can disable its monitoring, modify its own controls, or conceal operational changes, then we haven’t built a secure autonomous system. We’ve simply transferred authority without establishing accountability. As CISOs, our responsibility is to enable innovation while ensuring that identity, permissions, monitoring, and recovery remain independently enforceable. That requires collaboration across cybersecurity, engineering, infrastructure, and business leadership. The fundamentals haven’t changed, but the time we have to execute them has. Visibility, least privilege, segmentation, verified remediation, and independent monitoring will determine whether we can keep pace with this generation of threats.

Patch PHP2Shell immediately: Deploy fixed PHP releases, identify legacy installations, investigate suspicious session-upload-progress activity, and assess whether exposed credentials require rotation.

Patch PHP2Shell immediately: Deploy fixed PHP releases, identify legacy installations, investigate suspicious session-upload-progress activity, and assess whether exposed credentials require rotation.

Investigate LiteLLM exposure: for version 1.107.0 and cook.pth , rebuild affected systems from trusted images, and rotate potentially exposed cloud, developer, and AI provider credentials.

Investigate LiteLLM exposure: for version 1.107.0 and cook.pth , rebuild affected systems from trusted images, and rotate potentially exposed cloud, developer, and AI provider credentials.

Upgrade GitLab: Apply the October 21 security releases to self-managed instances and investigate suspicious application crashes or unauthorized activity.

Upgrade GitLab: Apply the October 21 security releases to self-managed instances and investigate suspicious application crashes or unauthorized activity.

Protect developer release pipelines: Reduce token lifetimes, secure developer endpoints, require verified release provenance, and restrict the permissions of publishing identities.

Protect developer release pipelines: Reduce token lifetimes, secure developer endpoints, require verified release provenance, and restrict the permissions of publishing identities.

Assess hosting provider exposure: Identify affected GMO desktop-cloud workloads, rotate stored credentials, and prepare trusted rebuilds rather than relying on potentially compromised images.

Assess hosting provider exposure: Identify affected GMO desktop-cloud workloads, rotate stored credentials, and prepare trusted rebuilds rather than relying on potentially compromised images.

Patch Node.js applications: Update affected runtimes, rebuild containers, and prioritize services handling untrusted compressed content.

Patch Node.js applications: Update affected runtimes, rebuild containers, and prioritize services handling untrusted compressed content.

Strengthen ransomware detection: Monitor suspicious Defender exclusions, vulnerable-driver abuse, backup deletion attempts, and unauthorized administrative activity.

Strengthen ransomware detection: Monitor suspicious Defender exclusions, vulnerable-driver abuse, backup deletion attempts, and unauthorized administrative activity.

Review browser security: Identify internal HTTP applications and evaluate Chrome’s enhanced phishing and scam protections.

Review browser security: Identify internal HTTP applications and evaluate Chrome’s enhanced phishing and scam protections.

Enforce AI agent monitoring independence: Prevent autonomous agents from disabling security telemetry, modifying oversight controls, or operating outside approved permissions.

Enforce AI agent monitoring independence: Prevent autonomous agents from disabling security telemetry, modifying oversight controls, or operating outside approved permissions.

Validate emergency response readiness: Ensure asset inventories, system ownership, patching authority, and incident-response procedures are established before the critical advisory arrives.

Validate emergency response readiness: Ensure asset inventories, system ownership, patching authority, and incident-response procedures are established before the critical advisory arrives.

Coffee cup cheers, gang. Take care of your teams, spend time with your loved ones, touch some grass, and most importantly, Stay Cyber Safe.

Thanks for reading CISO Talk by James Azar! This post is public so feel free to it.

Discussion this episode