Cybersecurity Weekly Roundup: 19–26 October 2026
1. Critical PHP2Shell Vulnerabilities Allow Unauthenticated Remote Code Execution
Two critical vulnerabilities affecting the PHP runtime were disclosed on October 21, 2026. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws are collectively known as PHP2Shell and can allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers. The vulnerabilities involve memory corruption during request processing and use-after-free conditions in PHP's internal handling of requests.
The vulnerabilities affect web-facing PHP installations, including PHP-FPM, Apache mod_php, php-cgi, and LiteSpeed configurations. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP security team warned users to update immediately because exploitation can occur before application code runs.
CVE IDs: CVE-2026-109618 and CVE-2026-109619
Why It Matters: PHP is widely used to host websites, web applications, and backend services. Successful exploitation could give attackers control over vulnerable server processes, potentially exposing sensitive information, enabling malware deployment, or providing an entry point for further compromise.
Actions: Upgrade affected PHP installations to the appropriate fixed versions. Identify internet-facing servers running vulnerable PHP configurations and prioritise remediation. Review web server and PHP logs for unusual multipart requests, unexpected process execution, suspicious file creation, and abnormal outbound connections. Investigate potential compromise before considering the issue resolved.
2. LiteLLM Supply-Chain Attack Distributes Credential-Stealing Malware
On October 21, 2026, attackers compromised the release pipeline for LiteLLM, an open-source toolkit used to integrate applications with large language models. The malicious litellm==1.107.0 package was distributed through PyPI, while affected Docker images were also published through official container registries. The compromised artifacts contained malicious Python startup components designed to execute during normal Python interpreter initialisation.
Microsoft's investigation found that the malware targeted sensitive information, including developer credentials, cloud authentication material, SSH data, browser information, environment variables, and LiteLLM database data. The affected package was available for approximately two hours, while compromised container tags remained affected for a separate period. The malicious artifacts were subsequently removed or redirected to clean versions.
Affected version: LiteLLM 1.107.0, including specified compromised container tags
Why It Matters: Developers and AI infrastructure often have access to source-code repositories, cloud platforms, deployment credentials, and production environments. A compromised dependency can therefore expose multiple systems even when the application does not actively use the affected library's functionality.
Actions: Check package inventories, deployment records, and container registries for the compromised LiteLLM artifacts. Remove affected versions and reinstall a verified clean release, following LiteLLM's incident guidance. Treat credentials accessible to affected environments as potentially compromised, rotate them from a clean system, and review endpoint and cloud logs for suspicious Python execution, credential access, and unexpected outbound connections.
3. OVHcloud CLI Supply-Chain Attack Exposes Developer Secrets
On October 19, 2026, attackers used a compromised developer GitHub account to replace release binaries for OVHcloud's command-line interface (CLI). Versions v0.11.0 through v0.15.0 were affected during a limited distribution window, between 14:47 and 16:21 UTC+2. The malicious binaries contained information-stealing functionality designed to retrieve sensitive secrets from affected computers. OVHcloud confirmed that the source code and build chain were not affected.
The compromised release assets were removed, and OVHcloud published version v0.16.0 as an unaffected release. Users who downloaded and executed the affected binaries during the exposure window should treat secrets stored on those systems as potentially compromised.
Affected versions: OVHcloud CLI v0.11.0 to v0.15.0, downloaded during the compromise window. No CVE was assigned in the vendor advisory.
Why It Matters: Cloud administration tools can access infrastructure credentials, SSH keys, API tokens, and other sensitive configuration data. Compromising a trusted CLI can give attackers access to cloud resources and enable further attacks against connected environments.
Actions: Determine whether affected CLI binaries were downloaded or executed during the exposure window. Remove compromised binaries and install the verified v0.16.0 release or a later trusted version. Rotate potentially exposed cloud credentials, API tokens, SSH keys, and other secrets from a clean system. Review cloud audit logs for unusual authentication, unexpected resource changes, and suspicious API activity.
4. Stolen ConnectWise Cloud Backup Credentials Used Against Microsoft 365 Tenants
Security researchers reported that attackers abused a compromised application credential associated with ConnectWise Cloud Backup, formerly SkyKick, to authenticate to Microsoft 365 environments. The activity was observed between October 13 and 16, 2026, and involved unauthorised Microsoft Graph access through a trusted third-party application. Researchers confirmed unauthorised sign-ins in at least 162 tenants, while further activity indicated a wider potential exposure.
Because the attackers authenticated as an application rather than as individual users, the activity could use permissions previously granted to the integration without requiring the affected users to complete MFA. Investigations also identified related activity involving other ConnectWise Cloud Management applications, including attempts to obtain elevated privileges and establish persistent access. ConnectWise subsequently revoked affected application credentials and suspended relevant services while its investigation continued.
Affected service: ConnectWise Cloud Backup and related application integrations. No CVE was assigned to this credential-abuse incident.
Why It Matters: Third-party applications may have extensive access to Microsoft 365 mailboxes, SharePoint, OneDrive, Teams, and directory resources. If an application's credentials are compromised, attackers may inherit those permissions without compromising individual user accounts. This can expose sensitive organisational data and create opportunities for privilege escalation or persistence.
Actions: Review Microsoft Entra ID service principal sign-in logs, Microsoft Graph activity, and audit logs for suspicious application authentication. Check for unexpected application consent changes, newly added client secrets or certificates, unfamiliar privileged role assignments, and unusual access to mailboxes or files. Disable affected integrations in accordance with vendor guidance, confirm credential revocation, and investigate potential data access. Coordinate restoration with ConnectWise and re-enable integrations only after their security has been validated.
Key Recommendations
Prioritise critical vulnerabilities: Identify exposed PHP installations and apply the appropriate security updates for CVE-2026-109618 and CVE-2026-109619. Validate remediation through vulnerability scans and version checks.
Strengthen software supply-chain security: Audit LiteLLM dependencies and OVHcloud CLI installations for compromised releases. Verify package integrity, pin trusted versions, and use signed releases and software provenance checks where available.
Review Microsoft 365 application identities: Audit Entra ID service principal sign-ins, Graph API activity, OAuth permissions, and application credentials. Investigate suspicious third-party integrations and unexpected privilege assignments.
Improve endpoint and SIEM monitoring: Monitor for unusual Python execution, credential access, unexpected child processes, suspicious outbound connections, and cloud authentication anomalies. Correlate endpoint, identity, application, and network telemetry.
Investigate suspected compromise: Do not assume that patching or removing malicious software resolves an incident. Rotate potentially exposed credentials, investigate persistence and unauthorised access, and confirm that affected systems and integrations are secure before returning them to normal operation.
