Today’s Field Note

Three things are on fire today, and PHP2Shell is the biggest. CVE-2026-109618 and CVE-2026-109619 hit the PHP core that roughly 70% of the web runs, working exploits are public, and exploitation started October 17 (four days before disclosure), caught in Amazon’s MadPot honeypot from a commercial anonymization network. Patches are out, mass scanning followed within hours, and expect a lot of 404s today as admins pull sites offline to patch. Separately, GitLab shipped a CVSS 10.0 unauthenticated RCE affecting every self-managed version back to 7.0 (2014), and the October 12 fix only covered 19.2+, so a second bump is required even if you patched nine days ago. And LiteLLM 1.107.0 was compromised on PyPI and Docker Hub with a credential stealer and backdoor, likely via a leaked GitHub token in AI gateway logs.

Today’s Action

  • Patch PHP now to the fixed releases for CVE-2026-109618 and CVE-2026-109619; if you cannot patch immediately, take exposed apps offline rather than leave them reachable.
  • Grep web and WAF logs back to October 17 for exploitation attempts; assume probing, not just scanning, on anything internet-facing.
  • Update self-managed GitLab to the new fixed versions one patch above the October 12 release; patching on the 12th is not sufficient.
  • Pull LiteLLM 1.107.0 from your environments (PyPI and Docker), rotate any credentials that touched those hosts, and audit GitHub tokens exposed in AI gateway or LLM logs.
  • Treat Plex (Plex2Shell, now on CISA’s radar) as next in line and confirm Plex Media Server is patched.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch the thing everyone runs first. The exotic bugs can wait.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.