SecOraLens
CriticalBreachCVE-2026-109618

October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks

Cyber Security News·Source published ·1 min read

What happened?

October 21, 2026 brought a demanding mix of emergency security updates, poisoned software releases, and warnings about attacks already underway. PHP servers needed urgent patches. An AI software package was stealing credentials. Other investigations exposed weaknesses in certificate trust, remote management, and VPN access. Several incidents began before October 21, but their recovery work collided with fresh disclosures that day.

Key details

  • PHP emergency release fixes two critical PHP2Shell flaws allowing unauthenticated remote code execution.
  • LiteLLM version 1.107.0 supply chain compromise includes credential stealer and remote code loader in all wheels and container tags.
  • OVHcloud CLI binaries for versions 0.11.0 through 0.15.0 replaced during 94-minute window after developer account compromise.
  • Plex2Shell chain combines four flaws for unauthenticated code execution; attackers deployed miners and proxy software.

Affected

  • PHP versions before 8.5.12, 8.4.27, 8.3.36, 8.2.35 with Apache mod_php.
  • Node.js versions before 26.12.1, 24.22.1, 22.23.4.
  • Next.js versions before 16.4.1 or 15.5.28.
  • LiteLLM version 1.107.0 (all Python wheels and container tags latest, main-stable).
  • UpdraftPlus Free before 1.26.13, Premium before 2.26.13; UpdraftCentral connection keys exposed Oct 17-18.
  • OVHcloud CLI versions 0.11.0 through 0.15.0 downloaded during Oct 19 window.

Fixes and mitigations

  1. Verify UpdraftPlus 1.26.13 Free or 2.26.13 Premium, remove exposed connection keys, inspect sites for backdoors.
  2. Patch Palo Alto GlobalProtect gateways and investigate suspicious successful VPN sessions.

What to look for

  • Cloudflare reported early attack attempts against PHP2Shell flaws.
  • Wiz observed stolen AWS credentials used about four and a half hours after LiteLLM data theft.
  • Malicious Python startup hooks execute when unrelated Python commands run without importing LiteLLM.
  • Unexpected administrators or backdoors on WordPress sites connected to UpdraftCentral.
  • Cryptocurrency miners and proxy software deployed on compromised Plex servers.
  • Suspicious successful VPN sessions on Palo Alto GlobalProtect gateways.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories