Internet Faces Cybersecurity Perfect Storm With PHP and LiteLLM Attacks

The cybersecurity world experienced an unprecedented convergence of critical vulnerabilities and supply chain attacks in late October 2026, sending security teams worldwide into emergency response mode. From AI-discovered flaws in PHP to a compromised AI gateway toolkit, the sheer volume and severity of simultaneous threats has tested the resilience of organizations across every sector.

PHP2Shell: AI Discovers Critical Remote Code Execution Flaws

The most urgent vulnerability disclosure came from the PHP programming language, which powers approximately 75% of all websites on the internet. Two critical remote code execution vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, were discovered through artificial intelligence analysis and carry a CVSS v4.0 score of 9.2 each. Security researchers have collectively dubbed the pair PHP2Shell.

The first vulnerability involves an out-of-memory corruption scenario. When an out-of-memory error interrupts a vulnerable operation during request processing, PHP leaves request data partially initialized. Subsequent cleanup routines then process that invalid state, creating an exploitable path to remote code execution. The second flaw involves stale global state, where PHP retains references to request data even after the backing memory has been freed, allowing a later request handled by the same worker to use the stale state before normal initialization completes.

The severity of these vulnerabilities cannot be overstated. The U.S. National Security Agency issued an unprecedented advisory recommending that organizations using PHP on internet-facing systems either immediately update or take their systems offline until patches could be applied. Government websites around the world went offline as administrators scrambled to assess exposure.

Patch Details and Affected Versions

PHP released patched versions ahead of its original schedule: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Apache mod_php deployments warrant the most immediate attention, as PHP has confirmed a demonstrated exploit that can trigger before application code even runs. Other affected configurations include PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

Active exploitation attempts have already been observed in the wild. Cloudflare has reported attack traffic targeting these vulnerabilities, including sophisticated attempts to evade its Web Application Firewall protections. Amazon Threat Intelligence and the hosting security firm Patchstack have also confirmed exploitation activity targeting unpatched PHP installations.

LiteLLM Supply Chain Attack: AI Gateway Compromised

On the same day as the PHP emergency, the open-source AI community faced its own crisis. LiteLLM, a popular Python proxy library for routing requests to multiple large language model providers with approximately 23 million weekly downloads, was compromised in a supply chain attack. Malicious version 1.107.0 was published to PyPI and Docker Hub, containing credential-stealing malware and a remote access trojan.

The attack was particularly insidious because the malicious code was placed in Python startup files. This means the malware executes automatically whenever Python starts in an affected environment, even if the application never imports LiteLLM. Three malicious files were injected: cook.pth, which triggers the second file cook.py to run automatically, and sitecustomize.py, which acts as a persistent backdoor.

The infostealer component targets an alarming range of sensitive data across 16 modules:

• Cloud credentials: AWS, Google Cloud Platform, and Microsoft Azure tokens, including instance metadata credentials
• Developer secrets: SSH keys, GPG keys, Git tokens, npm and PyPI tokens, environment files, and shell history
• AI service credentials: API keys for OpenAI, Anthropic, Google Gemini, and authentication files for Codex, Claude, Cursor, and Copilot
• Browser data: Saved passwords and cookies from Chrome, Firefox, Edge, and Safari
• LiteLLM proxy database: Upstream provider credentials stored in proxy deployment databases

The remote access trojan spawns a background daemon that polls attacker-controlled infrastructure every hour for new commands to execute, creating a persistent foothold on compromised systems. Stolen data is encrypted with AES-256 and RSA-4096 before being exfiltrated to a lookalike domain designed to evade detection.

Attack Methodology and Timeline

According to LiteLLM’s incident report, attackers used stolen GitHub CLI OAuth tokens from three engineer accounts to manipulate the software release pipeline. The stolen credentials enabled the attackers to change the release workflow, trigger a malicious release, approve it, and subsequently delete evidence of the unauthorized activity.

The malicious package was available on PyPI from 11:39 to 13:23 UTC, approximately one hour and forty-four minutes. Affected Docker images including the latest, main-latest, and main-stable tags served the malicious build from 11:46 to 14:20 UTC. The attackers created a lookalike repository named Berri-AI/litellm, differing from the legitimate BerriAI/litellm by a single hyphen, to inject the malicious code into the build pipeline.

Security researchers at Wiz observed the stolen credentials being tested within four and a half hours of exfiltration, with the attacker validating AWS credentials and checking access to AI models on Amazon Bedrock, a technique known as LLMjacking.

Compromised TLS Certificates: Bigger Than Heartbleed

Adding to the day’s chaos, an Indian certificate authority called eMudhra was found to have eight intermediate TLS certificates with private keys so weak that anyone could mint trusted browser credentials for any website on the internet. The private key sizes ranged from an astonishing 3 to 8 bits, compared to the standard 384 bits of entropy for NIST P-384 elliptic curve keys.

Cryptography engineer Filippo Valsorda described the situation as a massive cleanup job, potentially bigger than Heartbleed, the infamous 2014 OpenSSL vulnerability that required years of remediation across thousands of servers worldwide. Browser makers including Google Chrome and Mozilla Firefox have already blocked the eight compromised intermediate certificates, but the long tail of remediation will be extensive.

The challenge extends far beyond browser updates. Linux distributions are still rolling out patches, and embedded devices, IoT systems, Docker containers, and unmaintained command-line tools that ship their own copies of root certificates will require individual attention. The heterogeneity of systems that rely on TLS trust chains makes comprehensive remediation exceptionally difficult.

Node.js Vulnerabilities and Plex Exploitation

The onslaught continued with Node.js disclosing four high-severity vulnerabilities in its latest security release. One allowed remote code execution, while two others would have permitted a TLS validation bypass, potentially allowing attackers to circumvent server identity verification checks that form the backbone of secure web communication.

Simultaneously, hackers were actively exploiting four patched Plex Media Server flaws collectively called Plex2Shell. These vulnerabilities allowed attackers to gain shell access to Plex servers exposed to the internet, demonstrating how quickly patched vulnerabilities can be weaponized against unpatched systems.

Security Lessons and Best Practices

This convergence of critical threats offers several important lessons for cybersecurity professionals and organizations:

• Patch immediately: The PHP2Shell vulnerabilities demonstrate that patch windows have collapsed to hours, not days. AI-powered vulnerability discovery and exploitation means organizations can no longer afford delayed patching cycles.
• Verify supply chain integrity: The LiteLLM attack shows that even widely trusted open-source packages can be compromised. Organizations should implement software composition analysis tools and monitor for suspicious package updates.
• Rotate credentials proactively: Any system that ran LiteLLM version 1.107.0 should assume all credentials are compromised. Immediate rotation of cloud, developer, and API keys is essential.
• Inventory all PHP installations: The PHP vulnerabilities affect multiple configurations beyond standard web deployments. Organizations should audit all PHP installations including those bundled with appliances and management panels.
• Monitor certificate trust chains: The eMudhra compromise highlights the importance of monitoring certificate transparency logs and maintaining current root certificate stores across all systems.
• Implement network segmentation: Limiting the blast radius of compromised systems through proper network segmentation can contain the impact of supply chain attacks and remote code execution exploits.

The AI Factor in Cybersecurity

The PHP vulnerabilities were discovered through AI analysis, demonstrating how artificial intelligence is transforming both attack and defense. While AI can identify vulnerabilities faster than traditional methods, it also enables attackers to develop exploits more rapidly once flaws are disclosed. This acceleration creates an increasingly asymmetric battlefield where defenders must leverage AI-powered security tools to match the speed of AI-assisted attacks.

The LiteLLM compromise is particularly notable because it targeted infrastructure that connects organizations to AI services. As enterprises increasingly rely on AI gateways and proxies to manage their LLM interactions, these components become high-value targets for supply chain attacks. Securing the AI supply chain is now a critical priority that extends beyond traditional application security.

As cybersecurity teams process the lessons from this extraordinary week, one reality is clear: the threat landscape is evolving faster than ever. Organizations that invest in rapid patching capabilities, supply chain security, credential hygiene, and AI-powered defense tools will be best positioned to weather the storms ahead.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous