CISO Platform · This Week: the exploited vulnerabilities, breaches and campaigns that need a decision this week. No vendor content. Each item links to a full technical analysis with primary sources.
1. PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch now
- What: two unauthenticated RCE flaws in the PHP runtime, CVSS v4.0 9.2. Added to CISA KEV on Oct 26; US federal deadline Oct 29.
- Exposure: Censys counts 32.5M+ PHP services on affected versions. Vendor appliances are affected too (PAN-OS/Panorama with no fix yet; Cisco Expressway fixed in 15.5.21).
- Fix: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. PHP published source backports for 8.1, 8.0 and 7.4; 7.3 and older get no fix.
- Monday action: inventory internet-facing PHP including appliances, patch, isolate what you can't, and hunt back to Oct 17.
Read the full analysis: PHP2Shell →
2. LiteLLM 1.107.0 poisoned on PyPI, Docker Hub and GHCR
- Stolen maintainer tokens ran the project's own release pipeline; the payload ran on every Python start and stole cloud, CI, developer and AI-provider credentials. Root cause: an admin key committed in May, removed but never revoked.
- Monday action: find 1.107.0 and the floating image tags, rebuild from scratch, rotate everything those hosts could reach.
Read the full analysis: LiteLLM supply-chain compromise →
3. Storm-0940 abuses ConnectWise Cloud Backup app identities
- Microsoft attributes the campaign to China state-aligned Storm-0940, using the ARTEX agentic pentest framework. App-only sign-ins hit 2,250+ Microsoft 365 tenants; some reached privileged access in under 3 hours.
- Monday action: disable (don't delete) the ConnectWise apps, review service-principal roles and new app secrets since Oct 13.
Read the full analysis: Storm-0940 / ConnectWise →
4. Railway and Zeabur: PaaS secrets exposed
- Railway: build infrastructure compromised; a subset of encrypted environment variables decrypted with stolen CI credentials; up to ~100,000 workspaces may be affected. Zeabur: ~321,810 accounts and 3.2M+ env-var records exposed; shutting down Dec 31.
- Monday action: rotate AI provider keys, database and registry credentials stored there; check AI provider billing.
Read the full analysis: Railway and Zeabur →
5. Also exploited: Plex2Shell, Arista VeloCloud, Collabora, SiteGuard, Siemens; GitLab CVSS 10.0
- Eight KEV additions Oct 20–23, plus an unexploited CVSS 10.0 GitLab RCE. Plex and Collabora fixes existed months before exploitation.
Read the full analysis: the full patch table and per-flaw guidance →
6. Other breaches to note
- PwC: Everest claims ~590 GB from an employee learning platform; PwC confirmed an incident (volume unverified).
- SBI: ~375K records surfaced on the dark web; scope under investigation.
- Capcom (~11.8M accounts), Nikkei (third breach in about a month), Ahold Delhaize (operations disruption).
- eMudhra: weak intermediate CA keys (CERT-In warning); no customer data compromise reported; exiting public TLS.
Discuss with peers
Have you patched PHP2Shell yet? What is your stopgap for legacy PHP or appliances you can't upgrade? Reply in the comments.
Get this briefing every Monday
CISO Platform members get the weekly threat briefing, peer benchmarks and closed-door discussions with 6,000+ security leaders. No vendor pitches.
Join CISO Platform (free for security leaders) →
Related on CISO Platform
Sources are listed in each linked analysis: CISA KEV, vendor advisories, Microsoft Threat Intelligence, Datadog, StepSecurity, SOCRadar, Railway, The Hacker News, BleepingComputer, The Register.
Comments