Threat Alerts

A software supply chain attack compromised LiteLLM, a widely used Python package for integrating large language models (LLMs), resulting in the distribution of malicious PyPI packages and Docker images. The compromised release contained a credential stealer and a persistent backdoor capable of harvesting sensitive information and executing attacker-controlled Python code. The attack reportedly involved compromised GitHub CLI OAuth tokens belonging to three LiteLLM engineers, which were used to trigger and approve the malicious release.

The malicious package executes automatically when the Python interpreter starts through a cook.pth file, without requiring LiteLLM to be imported. The credential-stealing component, identified as privcollect, targets cloud credentials, private keys, browser data, environment variables, AI development tools, and LiteLLM proxy configurations. Stolen information is compressed and exfiltrated through HTTP POST requests. Additionally, the backdoor periodically retrieves instructions from an attacker-controlled GitHub repository and can download and execute arbitrary Python code from a remotely specified domain.

The affected PyPI package has been quarantined, and the malicious Docker images have been removed. LiteLLM has also revoked the identified compromised tokens and restricted access to its GitHub organization while the investigation into the initial compromise remains ongoing.

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), enable unauthenticated remote code execution through crafted HTTP requests that reach PHP internals before application-level controls execute, putting internet-facing PHP deployments at significant risk of web shell installation and full system compromise. The flaws affect common configurations including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed, with emergency fixes available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Active exploitation attempts have been observed, including efforts to deploy Potassium, an expanded Mirai botnet variant supporting 24 DDoS techniques and ENS-based command-and-control resolution, although successful deployment via PHP2Shell has not been confirmed. Additionally, CVE-2026-115560, a separate PHP RCE vulnerability affecting certain session configurations, remains unpatched. With millions of PHP2Shell exploitation attempts and additional automated exploit tools emerging, organizations should prioritize immediate patching, detection, and validation of exposed PHP systems.

A large-scale intrusion campaign attributed to the k0t threat actor is targeting internet-facing network edge devices, particularly Fortinet FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances. The operators identify exposed systems using public attack-surface search engines and gain initial access through a combination of vulnerability exploitation and credential brute-forcing. Observed exploitation includes CVE-2025-64446, affecting FortiWeb, and CVE-2026-0257, affecting certain PAN-OS GlobalProtect configurations.

Following initial compromise, the attackers harvest credentials and configuration data from affected devices, establish VPN access using OpenConnect, and conduct hands-on-keyboard activity inside victim environments. The campaign has also deployed legitimate remote-management tools such as MeshCentral/MeshAgent and Atera, alongside AdaptixC2, to maintain persistent access. More than 70,000 exposed credentials and configuration-related records were identified in the campaign dataset, including network-device and LDAP-related credentials.

Compromised environments have experienced additional credential theft, attempts to escalate toward domain-administrator access, and data exfiltration.

A critical vulnerability, tracked as CVE-2026-110264 (CVSS 10.0 – Critical), affects GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw is caused by an integer overflow in the regular expression compiler and can be triggered when GitLab processes a specially crafted regular expression. Under certain conditions, an unauthenticated remote attacker could exploit the vulnerability to execute arbitrary code on the GitLab server, without requiring user interaction or existing privileges.

The vulnerability affects GitLab CE/EE versions 7.0 through affected 18.x and 19.x releases. Fixed versions include 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab.com has already been patched, while GitLab Dedicated environments running 19.3.5-internal0, 19.4.2-internal0, or later already contain the fixes. GitLab also released detections for potential exploitation attempts involving native worker crashes and bursts of Org-mode rendering errors.

The same security release addresses 11 additional vulnerabilities in GitLab, including two high-severity issues involving account takeover through OmniAuth-to-LDAP auto-linking and OAuth/OIDC discovery cache poisoning, as well as several medium- and low-severity access control, information exposure, and authorization issues.

Oracle released its October 2026 Critical Patch Update, delivering 1,295 security patches addressing approximately 1,209 unique vulnerabilities across 33 product families. Among the most severe is CVE-2026-101809 (CVSS 10.0), a critical vulnerability affecting the Workflow Notification Mailer component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw allows unauthenticated attackers to remotely compromise the affected component over HTTP, potentially gaining complete control of Workflow and compromising its confidentiality, integrity, and availability. Another critical vulnerability, CVE-2026-101767 (CVSS 9.8), affects the Oracle Application Object Library Core component in the same E-Business Suite versions. It can also be exploited remotely without authentication or user interaction, potentially resulting in a complete compromise of the affected component.

Additional critical vulnerabilities include CVE-2026-75803 (CVSS 9.8), affecting the OpenSSL component of Oracle Database Server, which could allow unauthenticated attackers to compromise the affected component through TLS network access, and CVE-2026-101521 (CVSS 9.8), affecting Oracle APEX, which enables unauthenticated takeover through HTTPS. Although active exploitation of these newly disclosed vulnerabilities has not been confirmed, Oracle has warned of successful attacks against customers running unpatched systems. Previous exploitation campaigns targeting Oracle E-Business Suite, including attacks associated with CVE-2025-61882, further emphasize the risks posed by vulnerabilities in enterprise applications.

Cisco released security updates addressing multiple vulnerabilities in its Expressway Series, including a critical remote code execution flaw tracked as CVE-2026-76466 (CVSS 9.8). The vulnerability affects Cisco Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) devices configured in clusters, including both physical and virtual deployments. The flaw originates from the use of persistent cookies and insufficient client certificate validation when TLS verification is enabled for clustering. An unauthenticated remote attacker in possession of the required cookies could connect to the database service and invoke specific remote procedure call (RPC) commands, potentially executing arbitrary operating system commands with root privileges. Successful exploitation could result in complete compromise of affected devices, including unauthorized access to sensitive information and disruption of communication services.

The update also addresses eight additional high-severity vulnerability groups, tracked as CVE-2026-76490 through CVE-2026-76497, with CVSS scores reaching 8.6. These include improper resource permissions, code injection, insecure temporary files, and vulnerabilities that could affect system availability. Unlike the critical RCE flaw, which specifically affects clustered deployments, these additional vulnerabilities affect Expressway-C and Expressway-E devices regardless of their configuration. Cisco has released version X15.5.20 to address the vulnerabilities, while systems running X14 or earlier require migration to a supported fixed release. No workarounds are available, and Cisco has not reported evidence of active exploitation.