Skip to content
Critical PHP2Shell and LiteLLM Vulnerabilities Expose Enterprises to Attacks

Critical PHP2Shell and LiteLLM Vulnerabilities Expose Enterprises to Attacks

First seen 6 Nov 2026, 05:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 05:42 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow remote code execution.
  • •A malicious LiteLLM release acted as a credential stealer for various secrets.
  • •CISA has listed the PHP vulnerabilities due to confirmed active exploitation.

In October 2026, multiple cybersecurity incidents highlighted severe vulnerabilities affecting organizations. The PHP project disclosed two critical remote code execution flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to execute code on servers running affected PHP versions. Concurrently, a malicious release of the LiteLLM AI library was published, functioning as a credential stealer for cloud and AI provider secrets. These incidents demonstrate how interconnected systems can be exploited, emphasizing the need for immediate patching and credential rotation. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP vulnerabilities to its Known Exploited Vulnerabilities catalog due to. Organizations are urged to patch their systems and rotate credentials to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-20
Railway cloud platform breach detected
Railway reported a targeted campaign against its infrastructure, exposing customer API keys.
Itweb.Co.Za
2026-10-21
PHP vulnerabilities disclosed
The PHP project released fixes for two critical vulnerabilities, PHP2Shell, allowing unauthenticated code execution.
Itweb.Co.Za
2026-10-21
Malicious LiteLLM release published
A compromised version of LiteLLM was available for two hours, installing a credential stealer.
Itweb.Co.Za
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-26
CISA adds PHP vulnerabilities to KEV
CISA added the PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog due to active exploitation.
Itweb.Co.Za

More articles in this cluster (2)

Following this threat?

Track Ahold Delhaize and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (33)

1 / 4

Common questions

What are the CVEs related to PHP vulnerabilities?
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, both critical and allowing remote code execution.
How should organizations respond to these vulnerabilities?
Organizations should immediately apply patches for the PHP vulnerabilities and rotate any exposed credentials.
What is the status of the LiteLLM library?
The LiteLLM library was compromised for two hours, acting as a credential stealer, and organizations should review their use of this library.