# Weekly Threat Roundup: Week 43, 2026

> Weekly Threat Roundup for 19 to 23 October 2026: PHP2Shell, the Brotli overflow in Node.js, four chained Plex bugs on CISA KEV, GitLab's second CVSS 10 and the backdoored LiteLLM release.

Canonical page: https://www.edgeprotect.io/blog/weekly-threat-roundup-2026-week-43

Weekly Threat Roundup · 23 October 2026 · Leo Thomson, Security Consultant at Precursor Security

---

## The week at a glance

Some weeks are a long list of patches. This one was different, because three of the things that broke sit underneath almost everything else: the language most of the web's back ends are written in, the runtime most of its tooling runs on, and the server a lot of organisations keep their source code in.

Between 19 and 23 October 2026 the NVD published 4,004 vulnerabilities. Of those, 311 were scored critical, 1,394 high, 1,439 medium and 230 low, with 630 still unscored. CISA added 8 entries to the Known Exploited Vulnerabilities catalogue, four of which were a single chain in one product.

Ransomware leak sites were quieter. Groups claimed 159 victims across 37 brands, down from 232 the week before. N0n led with 33 claims, ahead of Qilin on 23, SilentRansomGroup on 10, and BrainCipher and Akira on 8 each. Manufacturing and industrial firms took 20 of the claims, retail and commerce 15, and healthcare and pharmaceuticals 12. The US accounted for 59, Germany 13, and the UK 5.

![This week in numbers](https://www.edgeprotect.io/img/roundups/weekly-threat-roundup-2026-week-43/chart_numbers.png)

## Php2shell, and why it mattered

On Monday 20 October, roughly fifteen hours before a coordinated disclosure was due, a proof-of-concept bundle and write-up for two unauthenticated remote code execution bugs in PHP core went fully public. The pair were nicknamed php2shell.

CVE-2026-109618 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109618`) and CVE-2026-109619 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109619`) are both rated CVSS v4.0 9.2 by the PHP security team. The first is a memory-corruption bug reachable when out-of-memory handling interrupts PHP while internal request data is only partially initialised. The second leaves request-owned internal state alive after its backing memory has been freed. Both sit in the session upload progress handler and the multipart form-data parser, which means any multipart POST to any PHP endpoint is a plausible entry point. watchTowr reported reproducing the first one in a lab.

The PHP team pulled its out-of-band release forward to Wednesday 21 October at 14:00 UTC, shipping 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU issued Security Advisory 2026-018. Germany's BSI warned on 22 October that it had no confirmed exploitation at that point, and CISA added both CVEs to KEV four days later, on 26 October.

Three details are worth carrying into your own change window. PHP 8.1 and everything older is end of life and will not get a vendor fix, although PHP has published minimal source backports for 7.4, 8.0 and 8.1 for anyone who has to patch in place. The interim mitigations PHP suggests, `memory_limit=-1` for the first bug and `session.upload_progress.enabled=0` for the second, are explicitly described as incomplete, and for the multipart parser the only real fix is the patch. And a third related issue, CVE-2026-115560, was not covered by the 21 October releases at all, with `session.upload_progress.enabled = 0` recommended until it ships in the regular cycle.

Shadowserver's honeypots saw the first php2shell probes on 21 October. Across 21 to 23 October they logged 111 unique attacking IPs for CVE-2026-109618 and 31 for CVE-2026-109619.

## Exploited in the wild (CISA KEV)

CISA added 8 vulnerabilities to KEV during the week. Anything listed here carries a remediation deadline:

- CVE-2026-96652 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-96652`): Plex Media Server server-side request forgery, added 20 October 2026.
- CVE-2026-96654 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-96654`): Plex Media Server improper neutralisation of encoded URI schemes, added 20 October 2026.
- CVE-2026-96655 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-96655`): Plex Media Server server-side request forgery, added 20 October 2026.
- CVE-2026-96656 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-96656`): Plex Media Server external control of file name or path, added 20 October 2026.
- CVE-2026-106931 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-106931`): EG Secure Solutions SiteGuard Server Edition OS command injection, added 20 October 2026.
- CVE-2026-110936 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-110936`): Siemens Software Center uncontrolled search path element, added 20 October 2026.
- CVE-2026-110447 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-110447`): Collabora Online built-in CODE Server OS command injection, added 23 October 2026.
- CVE-2026-114625 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-114625`): Arista VeloCloud Orchestrator SQL injection, added 23 October 2026.

The four Plex entries are the interesting part, because individually they look unremarkable. Taken one at a time they range from CVSS 4.3 to 7.2, the sort of scores that sit in a backlog for months. Chained together they give an unauthenticated attacker file write and code execution, which the researcher who published the chain rates at 9.8. Miners and reverse proxies were already being dropped on unpatched servers. The fix, build 1.43.3.10861, had been available since August.

That gap between the severity of the parts and the severity of the whole is the lesson. A scoring model that looks at one CVE at a time will never show you a chain.

## New vulnerabilities worth a look

Beyond php2shell, two more pieces of widely deployed infrastructure needed attention:

- CVE-2026-111497 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-111497`) (CVSS 9.2): a buffer overflow in the Brotli decoder in versions 1.0.3 through 1.2.0 lets a remote unauthenticated attacker corrupt adjacent decoder state, disclose memory, cause a denial of service or potentially execute code from a crafted compressed stream. Because Brotli is bundled, the blast radius is larger than the advisory suggests: it reaches Node.js and Bun, which means Express 5 apps handling compressed request bodies, outbound `fetch()` calls to untrusted servers, and direct `node:zlib` use. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, and Bun 1.4.4.
- CVE-2026-110264 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-110264`) (CVSS 10.0): an integer overflow in GitLab's regular expression compiler lets an unauthenticated user run code on the server. It affects all versions from 7.0 before 18.11.13, and the 19.x line before 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. This was GitLab's second CVSS 10 in ten days.
- CVE-2026-114575 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-114575`) (CVSS 10.0) and CVE-2026-113802 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-113802`) (CVSS 9.8): command injection in TOTOLINK A950RG and Wavlink WL-WN530BE1-A routers respectively, both remotely exploitable without authentication and both with published exploits. The Wavlink bug is reached by forging an `IP-FROM: 127[.]0[.]0[.]1` header to bypass the login check entirely.
- CVE-2026-112195 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-112195`) (CVSS 4.7): OS command injection in the FusionPBX dialplan editor. The score is modest and the exploit is public, which is a combination worth watching on anything internet-facing.

## Exploit probability movers

EPSS estimates the probability that a vulnerability sees exploitation attempts in the next 30 days. The largest moves this week were:

- CVE-2026-35616 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-35616`), Fortinet FortiClientEMS unauthenticated access control, jumped from 9.1% to 94.0%. On KEV since 6 April.
- CVE-2017-9765 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2017-9765`), the gSOAP "Devil's Ivy" integer overflow affecting Axis cameras and other IoT kit, rose from 24.6% to 42.1%.
- CVE-2026-28318 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-28318`), a SolarWinds Serv-U crash triggered by `Content-Encoding: deflate`, moved from 1.9% to 43.7%. On KEV since 5 June.
- CVE-2026-105134 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-105134`), command injection in Ahsay AhsayCBS backup software, climbed from 4.8% to 38.3%. On KEV since 14 October.
- CVE-2008-4815 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2008-4815`), an untrusted search path in Adobe Reader on Unix and Linux, went from 7.8% to 29.1%. It is eighteen years old and still moving.

Three of the five were already on KEV when the score jumped, which is the usual shape. EPSS tends to confirm what exploitation data has already shown rather than predict it.

## What the honeypots saw

Shadowserver's honeypots count exploitation attempts against internet-facing services. By raw attempt volume between 19 and 23 October, the busiest were:

- CVE-2022-40684 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2022-40684`) (Fortinet FortiOS, FortiProxy and FortiSwitchManager): 50,133 attempts.
- CVE-2018-13379 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2018-13379`) (Fortinet FortiOS): 37,623 attempts.
- CVE-2026-3055 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-3055`) (Citrix NetScaler ADC and Gateway): 30,464 attempts.
- CVE-2025-55182 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2025-55182`) (Meta React Server Components): 24,985 attempts.
- CVE-2023-46805 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2023-46805`) (Ivanti Connect Secure and Policy Secure): 23,928 attempts.
- CVE-2014-8361 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2014-8361`) (Realtek SDK): 22,794 attempts.
- CVE-2026-21589 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-21589`) (Atlassian Confluence): 22,676 attempts.
- CVE-2022-26134 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2022-26134`) (Atlassian Confluence): 17,327 attempts.
- CVE-2025-5777 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2025-5777`) (Citrix NetScaler): 14,204 attempts.
- CVE-2024-23897 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2024-23897`) (Jenkins): 12,518 attempts.

![Most-attacked vulnerabilities this week](https://www.edgeprotect.io/img/roundups/weekly-threat-roundup-2026-week-43/chart_honeypots.png)

Counted by unique attacking IPs instead, the picture is older and duller: Realtek SDK UPnP on 1,836, Netgear on 1,695, Huawei HG532 on 1,609, Dasan GPON on 1,531, Microsoft Exchange ProxyNotShell on 1,492, Zyxel D1000 on 1,464 and Cisco IOS XE on 1,368. A 2014 Realtek bug attracted more distinct scanners in five days than php2shell managed in its first three, which says a good deal about how long commodity botnets keep a working exploit in rotation.

## Software supply chain

Advisories across npm, PyPI and RubyGems accounted for 195 flagged packages this week, and one of them was a genuine compromise of a project people actually depend on.

On 21 October, JFrog and Aikido disclosed that `litellm` 1.107.0 on PyPI shipped an infostealer and a remote-access trojan in all seven compiled wheels. The malicious code was injected at build time and never appeared in the source repository. A `cook.pth` file fires the stealer at every Python interpreter start rather than on import, harvesting credentials from cloud providers, CI/CD systems, browsers, AI tools and package registries, while a `sitecustomize.py` loop pulls fresh code from a GitHub dead-drop every hour. The release was live for roughly two hours and the Docker images were affected too. 1.106.2 is the safe version. If you want to check a host, look for `/tmp/.pc_once_*`, which means the exfiltration already ran, and `/tmp/remote_code_loader.lock`, which means the loader is resident. This was LiteLLM's second compromise of the year.

Two social-engineering campaigns ran alongside it. GitHub ingested 26 npm advisories on 20 October for a fake job interview campaign: Tailwind CSS plugins that all reuse the same Animate.css integration template and hide their payload inside a private scoped dependency, `@aaron205whitmore/postcss-animate-utils` or `@jasperquinn/postcss-motion-helpers`, which only resolves when a candidate clones the lure repository with a pre-configured npm token. Separately, Elastic Security Labs attributed `@apexacc/cli` and `@apexacc/audit` to a fake Web3 accelerator that lured crypto founders with free AI credits and audits. The CLI is a repackaged coding agent that hijacks OpenRouter traffic and drops a macOS credential stealer and a Windows infostealer exfiltrating over Telegram, and the audit package is an MCP server that returns fabricated security findings.

The rest was volume: the kam193 operator's `2026-10-semvver` typosquat family with a confirmed second-stage binary download, a 43-package PyPI loader campaign, and a new `@sudobility` cluster dropping XMRig from a postinstall script with a root-escalation branch.

## What we'd do first

Patch PHP. Everything else on this page can wait a day; two unauthenticated RCEs in the language serving your web requests cannot. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and treat the config-level mitigations as a holding measure rather than a fix. Then inventory what you missed, because PHP is rarely where you think it is: WordPress, phpMyAdmin, cPanel, monitoring tools and internal dashboards all count, under FPM, mod_php, php-cgi or LiteSpeed alike.

Next, Node.js and Bun for the Brotli overflow, and GitLab for its second CVSS 10 in ten days. If Plex Media Server is anywhere on your network, get to build 1.43.3.10861 before someone chains the four KEV entries into a miner.

Then check whether LiteLLM 1.107.0 ever ran anywhere, including in Docker images and CI. The payload triggers on interpreter start, so an import-graph search will miss it. If either marker file is present, rotate cloud, AI, CI/CD and browser credentials rather than only removing the package.

Finally, the quiet item: Fortinet's two long-lived FortiOS bugs drew 87,756 exploitation attempts between them in five days against kit that was patched years ago. The most-attacked list barely changes week to week, and that is the point.

Subscribe to our weekly newsletter to get this intelligence directly in your inbox: `hxxps[:]//www[.]edgeprotect[.]io/newsletter`

---

## Links

- All roundups and guides: https://www.edgeprotect.io/blog
- The EdgeProtect Brief, the free weekly threat email: https://www.edgeprotect.io/newsletter
- Start free (no card, nothing to install): https://www.edgeprotect.io/register