Cybersecurity Weekly Recap (Oct 19–26, 2026): 9 Threats You Need to Know, from PHP2Shell to GitLab CVSS 10

This cybersecurity weekly recap covers October 19–26, 2026. It was the week of "X2Shell" bugs: PHP2Shell, HTTP2Shell and Plex2Shell all allow remote code execution. Add a CVSS 10 GitLab flaw, a certificate authority shutting down over weak keys, a poisoned LiteLLM release and AI agents in real attacks. Below, each story explains what happened, whether you're affected, and what to do.

If you only have five minutes for this cybersecurity weekly recap, jump to the patch checklist near the end. If you look after servers, CI/CD pipelines or AI tooling, it's worth reading the whole thing. This was one of those weeks where almost everyone had something to update.

Why did so many "2Shell" bugs land in one week?

The "2Shell" naming (from Log4Shell in 2021) has become shorthand for "this bug can give an attacker a shell on your server." This week several landed in core building blocks of the web: the language behind a large share of websites (PHP), a compression library used almost everywhere (Brotli), and a popular home and business media server (Plex).

Part of the reason, and a theme of every recent cybersecurity weekly recap, is speed. Rapid7's latest quarterly threat report says the average time between a high-severity vulnerability going public and being exploited is now three days, with 80% of tracked exploitation happening within 14 days. AI tools are also finding bugs faster: Anthropic reported this week that Claude found 493 issues across 25 major open-source projects, including a configuration flaw that had gone unnoticed for 21 years. More bugs, found faster, exploited sooner.

PHP2Shell: why did websites go offline?

The biggest story in this cybersecurity weekly recap is PHP2Shell.

What happened: On October 21, the PHP project shipped emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (each rated 9.2), nicknamed PHP2Shell. Together they can let an attacker run code on a web server without logging in, and in some configurations before the website's own code even runs. The Hacker News's weekly roundup also lists a related third CVE, CVE-2026-115560, among the PHP fixes to prioritise.

Why it was so dramatic: PHP runs a huge part of the web: WordPress, Drupal, Laravel apps, hosting control panels and countless internal tools. Cloudflare reported detecting millions of exploitation attempts after disclosure and pushed firewall rules to all plans, though its CTO warned that firewall rules are "only a stopgap." Some site operators simply took their sites offline until they could patch. As of the weekly roundup, no successful exploitation had been confirmed.

What to do:

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package).

• If you're on PHP 8.1 or older, you're out of routine support. Upgrade, or use a vendor that backports fixes. Our story on the volunteer behind many Debian and Ubuntu PHP packages explains why that matters.

• On shared hosting, confirm with your host that their PHP has been updated. Don't assume.

HTTP2Shell: how serious is the Brotli bug?

What happened: A critical out-of-bounds write in Google's Brotli decompression library, CVE-2026-111497, can lead to remote code execution when an application decompresses attacker-supplied data. It's been nicknamed Node2Shell, HTTP2Shell and Python2Shell, because Brotli sits inside so many runtimes and proxies.

Who's affected: anything that decompresses untrusted Brotli data with a vulnerable library: web servers and proxies that accept compressed request bodies, HTTP clients, and apps that unpack uploaded data.

Fixed versions confirmed by vendors:

• Node.js: 22.23.4, 24.22.1 and 26.12.1

• Bun: 1.4.4

• Python: Brotli 1.2.1 and brotlicffi 1.2.1.0

• C library: Brotli 1.0.10, 1.1.1 and 1.2.1

• Envoy: fixed per its GitHub security advisory

• Debian: patched packages for Debian 12 and 13

Some roundups also list Istio. When we checked, we could not find an Istio security bulletin for this CVE, so verify with Istio and your Envoy version directly rather than assuming.

What to do: update runtimes first, then rebuild container images. Statically bundled copies of Brotli won't update with your OS packages.

Plex2Shell: is your media server being hacked?

What happened: Attackers are chaining four Plex Media Server flaws, CVE-2026-96652, -96654, -96655 and -96656, into an exploit called Plex2Shell. According to BleepingComputer, the chain combines server-side request forgery and URL injection so an attacker can obtain the owner's admin token. The attacker then abuses a file-write bug to plant a malicious library that Plex loads, achieving code execution. Attackers have been dropping cryptocurrency miners and proxy software. CISA added all four to its Known Exploited Vulnerabilities (KEV) catalog.

What to do: the flaws affect versions before 1.43.3.10861, released on August 4. If you've been ignoring Plex updates, now's the time. Also check for unexpected CPU usage (a sign of mining) and unknown processes. If you don't need remote access, don't expose Plex directly to the internet.

What's the critical GitLab flaw (CVSS 10)?

What happened: On October 21, GitLab fixed CVE-2026-110264, rated a maximum 10.0. An integer overflow when compiling a specially crafted regular expression could let an unauthenticated attacker run code on a GitLab server under certain conditions. The root cause was in Onigmo, Ruby's regular-expression engine. On October 23, Ruby shipped 4.0.9, 3.4.12 and 3.3.13 to fix it and three related bugs (CVE-2026-89078, CVE-2026-93577 and CVE-2026-97229).

The same GitLab release fixed 11 other issues, including CVE-2026-15723 (CVSS 8.2), an account-takeover risk when SAML and LDAP auto-linking are both enabled.

What to do:

• Self-managed GitLab: upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.

• GitLab.com and GitLab Dedicated are already protected.

• Ruby apps that build regular expressions from user input should update Ruby too.

Why did eMudhra quit the TLS certificate business?

This was the strangest story in this cybersecurity weekly recap. Eight intermediate certificate authority (CA) certificates from Indian firm eMudhra were found to use private keys that were absurdly weak. According to Help Net Security, the keys were numbers below 256, when they should be random numbers over 100 digits long. Security researcher Scott Helme recovered them in under a second. Anyone with those keys could, in theory, issue trusted certificates for any website.

The timeline:

• October 17: a researcher discovers the flaw.

• October 18: eMudhra revokes the certificates.

• October 19: Apple starts blocking them.

• October 20: Mozilla, Chrome and Microsoft follow.

• October 22: eMudhra announces it is leaving the global SSL/TLS certificate business.

eMudhra traced the problem to a faulty script during an April 2025 key ceremony. It says only one of the intermediates was used in production and none issued customer certificates. Nobody yet knows whether the keys were abused in the roughly 17 months they existed.

What to do: update browsers and operating systems. Developers should update CA bundles: Python's certifi, pip, uv, sigstore, conda and pixi all shipped updates removing the eMudhra root. Servers, containers and IoT devices that never update their trust stores are the real risk here.

What happened with LiteLLM and Railway?

LiteLLM 1.107.0 was poisoned

LiteLLM, a widely used Python library and proxy for calling AI models, had a malicious version 1.107.0 published to PyPI and Docker. The package included a file named cook.pth, which Python runs automatically at startup, even if your code never imports LiteLLM. It stole cloud tokens, private keys, AI tool credentials, browser data and environment variables, and installed a backdoor that checked for new code every hour.

LiteLLM says the attacker acted through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. The weekly roundup also links the incident to a master key accidentally published in a public GitHub repository in May.

What to do: if you installed 1.107.0 anywhere, treat that machine as compromised. Pin 1.106.2, and rotate every credential that machine could reach, from a clean environment.

Railway: rotate your environment variables

Developer platform Railway disclosed on October 21 that an attacker may have accessed customers' encrypted environment variables, and in some cases decrypted them. Railway believes the goal was to steal AI provider API keys, part of a wider wave of attacks on platform companies. It paused deployments during the investigation.

What to do: if you use Railway, rotate all environment variables (API keys, database and registry credentials), review service logs, and recreate CLI and CI credentials.

What other GitHub and supply chain attacks happened this week?

• Gheist: Wiz disclosed a campaign that used stolen GitHub tokens to plant 13,500+ workflows printing CI secrets into logs. It was blocked in public repos but succeeded in private ones. Our Gheist guide has a five-minute audit.

• Malicious AGENTS.md: Forever Security reported a planted AGENTS.md instruction file in a user's Downloads folder that tricked an AI coding agent into installing a rogue npm package (function-color). Markdown files that agents obey are becoming an attack surface.

• Pillow: the Python imaging library released 13.0.0 with fixes for CVE-2026-112900, CVE-2026-112403 and CVE-2026-112393. Update if your app processes uploaded images.

Which bugs still have no patch?

Not everything in this cybersecurity weekly recap can be fixed with an update yet. Two stories need mitigations instead.

Linux KSMBD: two CVSS 9.0 flaws disclosed before fixes

Two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB file server, were posted to public mailing lists by Trend Micro's Zero Day Initiative before fixes existed, tracked as ZDI-CAN-33774 and ZDI-CAN-33549. That drew a pointed response from kernel maintainer Greg Kroah-Hartman. One needs no authentication and is reachable on port 445. As of the weekend, a fix for one was in a development branch and the other was awaiting testing, with no CVEs assigned. The public proof-of-concept code shows crashes, not working code execution.

Good news: KSMBD is not enabled by default on most distributions. Red Hat doesn't include it, and on Debian or Ubuntu it only runs if someone installed ksmbd-tools. Check with lsmod | grep ksmbd. If it's running and you don't need it, turn it off. If you do, keep port 445 off the internet.

Tailscale SSH: the "Tailworm" report

Researcher Erica Windisch's Tailworm report describes how, in a lab, one compromised device could use Tailscale SSH port forwarding to reach root on other servers. No patch or CVE exists yet, and Tailscale says it is working on fixes. Our Tailscale SSH vulnerability guide covers the configuration changes to make now.

What did CISA add to its exploited vulnerabilities list?

Beyond the four Plex2Shell CVEs, on October 23 CISA added two critical, actively exploited flaws:

• CVE-2026-110447 (CVSS 9.2): OS command injection in Collabora Online's built-in CODE server for Nextcloud. Fixed in 26.4.303.

• CVE-2026-114625 (CVSS 9.9): SQL injection in on-premise Arista VeloCloud Orchestrator. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12.

Also under attack this week, per the weekly roundup:

• MeshCentral: the developer urged users to update the remote-access tool to 1.3.1, warning of an active attack taking control of servers and their clients.

• Redis: attackers have been trying to exploit CVE-2026-25243 in the RESTORE command since around October 16. It needs command access, so never expose Redis without authentication.

How are attackers using AI agents now?

One theme ran through this whole cybersecurity weekly recap: AI agents are now part of real attacks, not just research demos.

• CrowdStrike documented four previously unreported threat actors using Claude Code-based agentic tooling in intrusions between May and August. They range from an operator who compromised at least 15 Argentine healthcare organisations to a Russian-speaking group that stole data from a US CRM vendor. CrowdStrike's assessment: agentic AI is "commoditizing baseline offensive cyber operations" and lowering the skill needed to attack.

• Banks told Axios they're seeing unauthorised third-party AI agents operating inside customer accounts, sometimes taking actions that appear independent of the user's instructions. Some banks are restricting agents to read-only access.

• Johns Hopkins Bayview Medical Center notified 3,182 patients after a staff member uploaded a patient spreadsheet to an unapproved AI platform. It's a reminder that "shadow AI" is a data-leak risk, not just a policy issue.

For the bigger picture on AI agents behaving badly, see our breakdown of the AI agent insider threat.

What else happened in cybersecurity this week?

A few more stories worth knowing for this cybersecurity weekly recap:

• Ransomware is up: Nord Security counted 2,894 ransomware attacks in Q3 2026, nearly 50% more than a year earlier. It was led by The Gentlemen (383) and Qilin (363), both of which commonly break in through stolen credentials and exposed VPNs.

• Phishing goes modular: Abnormal AI detailed Athena StealthRoute, a phishing-as-a-service platform with AI content tools and scanner-evasion features, linked to 89,700 flagged messages across about 2,280 organisations.

• Legitimate tools as malware: one phishing campaign delivered a signed remote-management agent (Zecurit) via a fake DocuSign flow. There was no custom malware, which is exactly the living off the land approach defenders struggle to spot.

• Android banking malware: Cyble reported a new GhostBat RAT variant that uses Android Accessibility Services to capture PINs typed into Google Pay, MobiKwik and around 60 banking, UPI and wallet apps used in India. Only install apps from official stores, and be suspicious of SMS links.

• Crypto laundering: blockchain investigator ZachXBT said a Chinese organised crime syndicate laundered more than $1 billion for North Korea's Lazarus Group.

What should you patch first this week?

Here's the prioritised checklist from this cybersecurity weekly recap, most urgent first:

1. Internet-facing PHP: update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

2. Self-managed GitLab: upgrade to the fixed release for your branch (CVSS 10).

3. KEV items: Plex Media Server (1.43.3.10861 or later), Collabora CODE (26.4.303), Arista VCO.

4. Brotli everywhere: Node.js, Bun, Python Brotli/brotlicffi, Envoy and OS packages. Then rebuild containers.

5. Supply chain: check for LiteLLM 1.107.0 (pin 1.106.2) and ci-sync branches (Gheist), and rotate Railway environment variables.

6. Runtimes and libraries: Ruby 4.0.9 / 3.4.12 / 3.3.13, Pillow 13.0.0, MeshCentral 1.3.1.

7. Trust stores: update browsers, OS and CA bundles (certifi, pip, uv) to drop eMudhra.

8. Unpatched, so mitigate: disable KSMBD if you don't use it, and tighten Tailscale SSH rules.

The takeaway from this cybersecurity weekly recap

Two patterns stood out. First, critical bugs are landing in shared building blocks, such as PHP, Brotli and Ruby's regex engine, so one flaw ripples into thousands of products. Keep an inventory of what your software is built on, not just what you installed. Second, stolen credentials and tokens drove a lot of the damage: LiteLLM, Railway and Gheist all came down to keys in the wrong hands. Rotate secrets quickly, prefer short-lived tokens, and treat a leaked key as an incident, not a to-do item.

We'll be back next week with another cybersecurity weekly recap. In the meantime: patch the internet-facing stuff first.

Sources: The Hacker News weekly recap · Malwarebytes on PHP2Shell · BleepingComputer on Plex2Shell · SecurityOnline on GitLab CVE-2026-110264 · Ruby security release · Help Net Security on eMudhra · The Hacker News on LiteLLM · Railway security disclosure · The Hacker News on KSMBD · The Hacker News on CISA KEV · CrowdStrike on agentic AI campaigns · Wiz on Gheist