{
 "site": "https://erroneo.us",
 "section": "Security Digest",
 "generated": "2026-10-21",
 "digest_date": "2026-10-21",
 "digest_url": "https://erroneo.us/security/2026-10-21/",
 "counts": {
  "briefs": 3,
  "kev": 0,
  "critical_advisories": 3
 },
 "leads": [
  {
   "slug": "php2shell-php-rce",
   "title": "PHP2Shell: Critical Unauthenticated RCE in PHP",
   "name": "PHP2Shell",
   "date": "2026-10-21",
   "updated": "2026-10-21",
   "url": "https://erroneo.us/security/briefs/php2shell-php-rce/",
   "markdown_url": "https://erroneo.us/security/briefs/php2shell-php-rce/index.md",
   "verdict": "act-now",
   "verdict_label": "Act now",
   "verdict_line": "If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped.",
   "who_must_act": "Anyone running PHP behind a web server (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed), including WordPress, Drupal, Magento, Laravel and appliance or container images that bundle PHP.",
   "who_can_relax": "Hosts where PHP is only used from the command line (scripts, cron, Composer) and never handles untrusted HTTP requests, and RHEL 7 or older, which Red Hat says ships unaffected PHP.",
   "severity": "critical",
   "exploited": "in-the-wild",
   "kev": false,
   "cves": [
    "CVE-2026-109618",
    "CVE-2026-109619"
   ],
   "affected": [
    "PHP 8.5.x before 8.5.12",
    "PHP 8.4.x before 8.4.27",
    "PHP 8.3.x before 8.3.36",
    "PHP 8.2.x before 8.2.35",
    "PHP 7.4, 8.0, 8.1 (EOL; source backports only)",
    "PHP 5.4 through 7.3 (EOL; no upstream fix)"
   ],
   "fixed": [
    "PHP 8.5.12",
    "PHP 8.4.27",
    "PHP 8.3.36",
    "PHP 8.2.35",
    "Debian 13 php8.4 8.4.27-1~deb13u1 (DSA-6574-1)",
    "Debian 12 php8.2 8.2.35-1~deb12u1 (DLA-4848-1)",
    "Ubuntu 24.04 php8.3 8.3.6-0ubuntu0.24.04.13",
    "Ubuntu 22.04 php8.1 8.1.2-1ubuntu2.28",
    "Official Docker php images rebuilt Oct 21, 2026"
   ],
   "actions": [
    "Inventory every PHP that serves HTTP: servers, containers, appliances, shared hosting.",
    "Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's fixed package, then restart every PHP worker (php-fpm, Apache).",
    "Rebuild and redeploy container images from refreshed php:* or distro base images; do not just restart old containers.",
    "For PHP 7.4-8.1, use a vendor/LTS backport or the PHP team's source backport branches, or upgrade.",
    "If you cannot patch today: set session.upload_progress.enabled=0, enforce memory_limit=-1, set fatal_error_backtraces=0 on 8.5, block multipart/form-data where unused, and keep WAF rules on; otherwise take the site offline.",
    "Verify the version actually serving requests, not just the CLI binary."
   ],
   "detect": [
    "Check the running version from a web request (phpinfo behind auth, or the X-Powered-By header if enabled) and compare packages with dpkg -l 'php*' or rpm -qa 'php*'.",
    "Look for bursts of multipart POSTs containing the upload-progress field followed by HTTP 500s or memory-limit errors.",
    "Watch for unexplained PHP worker churn, segfaults, or oversized or malformed PHPSESSID cookies in responses.",
    "Treat any exposed, unpatched host as possibly compromised: hunt for new PHP files, web shells, and unexpected child processes of php-fpm or httpd."
   ],
   "sources": [
    {
     "label": "PHP — Security advisory for PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (Oct 21, 2026)",
     "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
    },
    {
     "label": "PHP — Upcoming critical PHP security release (Oct 20, 2026)",
     "url": "https://www.php.net/archive/2026.php#2026-10-20-1"
    },
    {
     "label": "PHP / GitHub — GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)",
     "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    },
    {
     "label": "PHP / GitHub — GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)",
     "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    },
    {
     "label": "Wiz Research — PHP2Shell",
     "url": "https://www.wiz.io/blog/php2shell-php-rce"
    },
    {
     "label": "Tenable — PHP2Shell FAQ",
     "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote"
    },
    {
     "label": "Sansec — PHP2Shell: Critical PHP RCE",
     "url": "https://sansec.io/research/php2shell"
    },
    {
     "label": "Cloudflare — Cloudflare deploys protections against php2shell",
     "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection"
    },
    {
     "label": "Qualys — PHP2Shell: PHP patches two critical RCE vulnerabilities",
     "url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities"
    },
    {
     "label": "Debian security tracker — CVE-2026-109618",
     "url": "https://security-tracker.debian.org/tracker/CVE-2026-109618"
    },
    {
     "label": "Ubuntu — CVE-2026-109618",
     "url": "https://ubuntu.com/security/CVE-2026-109618"
    },
    {
     "label": "Red Hat — RHSB-2026-013",
     "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-013"
    },
    {
     "label": "Red Hat — CVE-2026-109618",
     "url": "https://access.redhat.com/security/cve/cve-2026-109618"
    },
    {
     "label": "Docker official images — Update php to 8.5.12, 8.4.27, 8.3.36, 8.2.35 (#22541)",
     "url": "https://github.com/docker-library/official-images/pull/22541"
    },
    {
     "label": "UK NCSC — Critical security issue affecting PHP",
     "url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php"
    },
    {
     "label": "Socket — PHP Foundation says Chainguard broke security embargo",
     "url": "https://socket.dev/blog/php-embargo-dispute"
    }
   ]
  },
  {
   "slug": "nodejs-october-2026-security-releases",
   "title": "Node.js October 2026 Security Releases: 10 CVEs Fixed",
   "name": "",
   "date": "2026-10-21",
   "updated": "2026-10-21",
   "url": "https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/",
   "markdown_url": "https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/index.md",
   "verdict": "patch-this-week",
   "verdict_label": "Patch this week",
   "verdict_line": "Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.",
   "who_must_act": "Anyone running Node.js 22.x, 24.x or 26.x in production, especially services that decompress untrusted Brotli data or make TLS connections to hosts given as IP addresses.",
   "who_can_relax": "Nobody needs to drop everything today: no exploitation is reported, and the low-severity Permission Model and ZIP fixes only matter if you use those features.",
   "severity": "high",
   "exploited": "none-known",
   "kev": false,
   "cves": [
    "CVE-2026-111497",
    "CVE-2026-105482",
    "CVE-2026-105483",
    "CVE-2026-106069",
    "CVE-2026-105481",
    "CVE-2026-106072",
    "CVE-2026-106074",
    "CVE-2026-106070",
    "CVE-2026-106071",
    "CVE-2026-106073"
   ],
   "affected": [
    "Node.js 26.x before 26.12.1",
    "Node.js 24.x before 24.22.1",
    "Node.js 22.x before 22.23.4",
    "All End-of-Life Node.js lines (per the Node.js project)"
   ],
   "fixed": [
    "Node.js 26.12.1 (Current)",
    "Node.js 24.22.1 (LTS)",
    "Node.js 22.23.4 (LTS)"
   ],
   "actions": [
    "Check every runtime that serves traffic: node -v in each container, VM and CI image.",
    "Upgrade to 26.12.1, 24.22.1 or 22.23.4 (nvm install 24.22.1, or your package manager / official node:* images), then restart processes.",
    "Rebuild and redeploy container images and single executable applications (SEAs) so they embed the fixed runtime.",
    "Move anything still on an End-of-Life line (20.x or older) to a supported LTS; EOL lines are always affected.",
    "Rebuild startup snapshots and SEAs that use crypto.randomUUID() or crypto.randomInt(), so each process gets fresh entropy."
   ],
   "detect": [
    "Run node -v (and node -p process.versions) on hosts and inside images; anything below the fixed versions is affected.",
    "Scan image registries and SBOMs for older node binaries, including base images pinned by digest.",
    "Look for unexplained Node.js process crashes while handling compressed (br) request or response bodies."
   ],
   "sources": [
    {
     "label": "Node.js — Wednesday, October 21, 2026 Security Releases",
     "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
    },
    {
     "label": "Node.js — Node.js 24.22.1 (LTS) release notes",
     "url": "https://nodejs.org/en/blog/release/v24.22.1"
    },
    {
     "label": "Node.js — Node.js 22.23.4 (LTS) release notes",
     "url": "https://nodejs.org/en/blog/release/v22.23.4"
    },
    {
     "label": "Node.js — Node.js 26.12.1 (Current) release notes",
     "url": "https://nodejs.org/en/blog/release/v26.12.1"
    }
   ]
  },
  {
   "slug": "litellm-1-107-0-supply-chain-compromise",
   "title": "LiteLLM 1.107.0: Malicious PyPI and Docker Release",
   "name": "",
   "date": "2026-10-21",
   "updated": "2026-10-21",
   "url": "https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/",
   "markdown_url": "https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/index.md",
   "verdict": "act-now",
   "verdict_label": "Act now",
   "verdict_line": "Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen.",
   "who_must_act": "Anyone whose laptops, CI runners, containers or Kubernetes nodes resolved litellm (unpinned or >=) or a latest/main-* LiteLLM image between about 11:39 and 14:20 UTC on October 21, 2026.",
   "who_can_relax": "Teams pinned to 1.106.2 or earlier by hash/lockfile, image users pinned by digest to a pre-incident image, and LiteLLM Enterprise private-registry customers, which LiteLLM says were not affected.",
   "severity": "critical",
   "exploited": "in-the-wild",
   "kev": false,
   "cves": [],
   "affected": [
    "PyPI litellm==1.107.0 (all seven wheels), 11:39:51 to ~13:23 UTC Oct 21, 2026",
    "ghcr.io/berriai/litellm, litellm-database, litellm-non_root tags v1.107.0, latest, main-latest, main-stable from 11:46:56 UTC",
    "docker.io/litellm/litellm same tags until 14:20 UTC (index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e)"
   ],
   "fixed": [
    "litellm==1.106.2 (last known-good)",
    "Malicious 1.107.0 quarantined on PyPI and tags removed from registries"
   ],
   "actions": [
    "Find exposure: pip show litellm, grep lockfiles and CI logs for 1.107.0, and list running image digests.",
    "On any hit, isolate the host or container and preserve evidence; do not run that environment's python or pip first.",
    "Kill the detached daemon holding /tmp/remote_code_loader.lock and delete cook.pth, cook.py, sitecustomize.py (and their .pyc) from site-packages, or better, destroy and rebuild the environment.",
    "Reinstall pinned to litellm==1.106.2 with hashes, and pin images by digest.",
    "From a clean machine, rotate everything the host could reach: cloud role/keys, every provider key in the LiteLLM DB plus master/virtual keys, DATABASE_URL, GitHub/npm/PyPI tokens, SSH/GPG keys, AI-tool sessions.",
    "Review CloudTrail/cloud audit logs for sts:GetCallerIdentity and Bedrock ListFoundationModels from unfamiliar IPs, including 168.100.8.57 and 165.227.201.8."
   ],
   "detect": [
    "pip show litellm (any environment) and pip download caches; look for litellm-1.107.0.dist-info.",
    "find / -name cook.pth -o -name 'sitecustomize.py' -path '*site-packages*' 2>/dev/null; check for /tmp/.pc_once_72129118c59f5636c0bb and /tmp/remote_code_loader.lock.",
    "docker images --digests | grep litellm and kubectl get pods -o jsonpath for image IDs; compare to sha256:1bbcb144... and the per-variant indexes.",
    "Egress/DNS logs for www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test, or requests with header X-Token: XWiA8gZNa7NcX2XRoAEb."
   ],
   "sources": [
    {
     "label": "LiteLLM — Security incident, October 21, 2026",
     "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
    },
    {
     "label": "Datadog Security Labs — LiteLLM supply chain compromise: What you need to know",
     "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/"
    },
    {
     "label": "Wiz — LiteLLM Compromised, Steals Credentials",
     "url": "https://wiz.io/blog/litellm-compromised-steals-credentials"
    },
    {
     "label": "Socket — LiteLLM PyPI package and Docker images compromised",
     "url": "https://socket.dev/blog/litellm-compromise"
    }
   ]
  }
 ],
 "kev": [],
 "critical_advisories": [
  {
   "ghsa": "GHSA-w889-685w-c8fh",
   "cve": "CVE-2026-112900",
   "summary": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",
   "url": "https://erroneo.us/security/cve/CVE-2026-112900/",
   "github_url": "https://github.com/advisories/GHSA-w889-685w-c8fh",
   "packages": [
    {
     "eco": "pip",
     "fixed": "13.0.0",
     "pkg": "Pillow",
     "range": ">= 2.6.0, < 13.0.0"
    }
   ],
   "cvss": {
    "score": 9.2,
    "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
    "version": "4.0"
   }
  },
  {
   "ghsa": "GHSA-f2ph-cmg5-wxc8",
   "cve": "CVE-2026-114125",
   "summary": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
   "url": "https://erroneo.us/security/cve/CVE-2026-114125/",
   "github_url": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
   "packages": [
    {
     "eco": "npm",
     "fixed": "8.6.19",
     "pkg": "storybook",
     "range": ">= 8.0.0, < 8.6.19"
    },
    {
     "eco": "npm",
     "fixed": "9.1.21",
     "pkg": "storybook",
     "range": ">= 9.0.0, < 9.1.21"
    },
    {
     "eco": "npm",
     "fixed": "10.6.2",
     "pkg": "storybook",
     "range": ">= 10.0.0, < 10.6.2"
    },
    {
     "eco": "npm",
     "fixed": "11.0.0-alpha.6",
     "pkg": "storybook",
     "range": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6"
    },
    {
     "eco": "npm",
     "fixed": "8.6.19",
     "pkg": "@storybook/core",
     "range": ">= 8.0.0, < 8.6.19"
    },
    {
     "eco": "npm",
     "fixed": "8.6.19",
     "pkg": "@storybook/core-server",
     "range": ">= 8.0.0, < 8.6.19"
    },
    {
     "eco": "npm",
     "fixed": "8.6.19",
     "pkg": "@storybook/experimental-addon-test",
     "range": ">= 8.0.0, < 8.6.19"
    },
    {
     "eco": "npm",
     "fixed": "9.1.21",
     "pkg": "@storybook/addon-vitest",
     "range": ">= 9.0.0, < 9.1.21"
    },
    {
     "eco": "npm",
     "fixed": "10.6.2",
     "pkg": "@storybook/addon-vitest",
     "range": ">= 10.0.0, < 10.6.2"
    },
    {
     "eco": "npm",
     "fixed": "11.0.0-alpha.6",
     "pkg": "@storybook/addon-vitest",
     "range": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6"
    },
    {
     "eco": "npm",
     "fixed": "10.6.2",
     "pkg": "@storybook/addon-mcp",
     "range": ">= 10.6.0, < 10.6.2"
    },
    {
     "eco": "npm",
     "fixed": "11.0.0-alpha.6",
     "pkg": "@storybook/addon-mcp",
     "range": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6"
    }
   ],
   "cvss": {
    "score": 9.4,
    "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
    "version": "4.0"
   }
  },
  {
   "ghsa": "GHSA-332p-7hrc-92wf",
   "cve": "CVE-2026-112393",
   "summary": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",
   "url": "https://erroneo.us/security/cve/CVE-2026-112393/",
   "github_url": "https://github.com/advisories/GHSA-332p-7hrc-92wf",
   "packages": [
    {
     "eco": "pip",
     "fixed": "13.0.0",
     "pkg": "Pillow",
     "range": ">= 2.0.0, < 13.0.0"
    }
   ],
   "cvss": {
    "score": 9.2,
    "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
    "version": "4.0"
   }
  }
 ],
 "sources": {
  "kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "ghsa": "https://github.com/advisories",
  "cve": "https://www.cve.org/",
  "epss": "https://www.first.org/epss/"
 },
 "kev_catalog_version": "2026.10.21",
 "epss_model_date": "2026-10-21"
}