Critical PHP, Node.js, and LiteLLM flaws let attackers breach systems

Key Takeaways

• Multiple critical vulnerabilities were disclosed across widely used web platforms including PHP, Node.js, Next.js, and Apache Tomcat.
• A significant supply chain attack impacted LiteLLM, distributing a credential stealer and remote code loader.
• A compromise of the eMudhra Certificate Authority exposed eight intermediate signing keys, risking forged certificates.
• Urgent patching, system rebuilds, and credential rotations are required across affected environments to mitigate active threats and potential breaches.

Emergency Patches Across Web Platforms

The cybersecurity landscape on October 21, 2026, was dominated by a flurry of critical security disclosures, emergency software updates, and warnings regarding active exploitation. System administrators faced the immediate challenge of identifying vulnerable services, applying patches, and investigating potential compromises across their infrastructure. A successful patch, while closing a vulnerability, might not address existing backdoors or stolen credentials, emphasizing the need for thorough post-patch investigations.

PHP Vulnerabilities Demand Immediate Attention

PHP servers required immediate patching due to two critical flaws, collectively dubbed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a CVSS score of 9.2 and enable unauthenticated remote code execution under specific configurations. One flaw triggers memory corruption during out-of-memory operations, while the other allows subsequent requests to access invalid data left by prior requests. Researchers successfully demonstrated code execution against Apache mod_php even before application code initiated. While Cloudflare reported early attack attempts, successful compromises have not been confirmed. Administrators must deploy PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart affected services, and verify that web workers are utilizing the updated build.

Node.js and Next.js Address Multiple Flaws

Node.js released security updates addressing ten vulnerabilities, four of which are rated as high severity. CVE-2026-111497, affecting Brotli decompression, could lead to code execution by writing memory outside its designated area. Other issues include weakened TLS hostname checks and improper handling of DNS names. Patched Node.js releases are 26.12.1, 24.22.1, and 22.23.4. These updates also incorporate certificate trust refreshes in response to the eMudhra incident. Organizations should rebuild container images to ensure deployments include the updated runtime.

This followed two critical Next.js RCE fixes released on October 14, which addressed specific caching behaviors in React Server Components and SVG image processing on Linux systems leveraging glibc. Affected Next.js deployments should be updated to versions 16.4.1 or 15.5.28, as appropriate. It’s crucial to note that updating Node.js alone does not update these application-level dependencies.

Apache Tomcat Patches Critical Authentication Bypass

Apache Tomcat also released eight security fixes, including a critical vulnerability, CVE-2026-101296. This flaw permits authentication without a correct password when JNDIRealm uses non-GSSAPI SASL mechanisms. Other issues include potential mixing of responses between users and data leakage through AJP processing. An HTTP/2 vulnerability involves errors during asynchronous processing, leaving internal objects vulnerable to reuse. Apache disclosed these flaws on October 20. Fixed releases are 11.0.27, 10.1.61, and 9.0.123, with exposure depending on specific configurations.

Supply Chain Attacks

LiteLLM Compromise Steals Credentials

A significant supply chain compromise directly targeted cloud and AI environments through LiteLLM. Version 1.107.0, distributed via PyPI and container registries, contained a credential stealer and a remote code loader. All seven Python wheels and container tags, including “latest” and “main-stable,” were affected. The vendor attributed the breach to stolen GitHub credentials, which allowed attackers to redirect a release workflow to a malicious lookalike repository.

Malicious Python startup hooks could execute when any unrelated Python command initiated, even without explicit LiteLLM import. Targets included cloud credentials, SSH keys, and AI service secrets. Wiz observed stolen AWS credentials being utilized approximately four and a half hours after the data exfiltration. The vendor recommended pinning to version 1.106.2. Affected teams must perform clean rebuilds and rotate all potentially compromised credentials. Simply downgrading within a contaminated environment is insufficient, as running `pip` can re-trigger the malicious hooks.

WordPress and OVHcloud CLI Supply Chain Incidents

The WordPress backup developer breach, affecting TeamUpdraft, demonstrated how stolen management keys can bypass standard trust mechanisms. Attackers gained access to TeamUpdraft’s website between October 17–18 and exploited UpdraftCentral connection keys to install malicious plugins on connected WordPress sites. The UpdraftPlus download packages themselves remained untainted. Administrators should verify installations of 1.26.13 Free or 2.26.13 Premium, remove any exposed connection keys, and meticulously inspect their sites for backdoors or unauthorized administrators. Updating the plugin alone will not remove already installed malware.

Similarly, attackers hijacked OVHcloud CLI releases after compromising a developer account. Malicious binaries for versions 0.11.0 through 0.15.0 were replaced during a 94-minute window on October 19. Earlier, clean downloads were unaffected. OVHcloud released version 0.16.0 and urged exposed users to replace any secrets stored on affected machines. This incident underscores that a familiar download location does not guarantee the integrity of a release file.

Certificate Authority Compromise

eMudhra CA Incident and Forged Certificates

The eMudhra certificate authority incident represents a deeper threat to internet trust, involving the compromise of eight intermediate signing keys. An updated disclosure revealed that incorrect key generation made these keys recoverable from public certificates, creating a risk of forged certificates. Mozilla found that all eight affected P-384 private keys were integers below 256, allowing for almost instantaneous recovery.

Browser vendors have implemented blocks, but applications using custom certificate bundles or bypassing revocation checks may remain vulnerable. Organizations must update browsers, operating systems, runtimes, and trust stores. While public evidence of attacks against users leveraging these keys has not yet emerged, the potential for harm is significant.

Palo Alto GlobalProtect and Plex Servers Under Attack

Palo Alto GlobalProtect exploitation highlighted how VPN weaknesses can lead to broader network access. CVE-2026-0257 allows attackers to bypass authentication, including MFA, in specific configurations. Exploitation requires authentication override cookies and a vulnerable certificate setup. Unit 42 reported attackers compromising VMware vCenter, weakening ESXi controls, and extracting credentials directly from a domain controller’s virtual disk. This method of reading the disk outside the guest operating system allowed them to evade endpoint monitoring. Defenders should patch affected gateways and investigate any suspicious successful VPN sessions.

Plex servers were also actively targeted by the Plex2Shell chain, which combines four flaws to achieve unauthenticated code execution. This attack abuses internal requests, exposes an owner token, writes a file, and loads a malicious codec. Attackers deployed cryptocurrency miners and proxy software on compromised servers. Plex stated that versions 1.43.3.10861 and later contain the necessary fixes. Administrators should inspect NAS installations and containers, look for unexpected processes, and rebuild systems where compromise is confirmed or cannot be ruled out.

State Bank of India Data Disclosure

Separately, the State Bank of India (SBI) disclosed that 3,897 customer records containing personal information were identified within approximately 375,000 reviewed dark-web records. The larger figure should not be interpreted as a confirmed count of affected customers. Reported fields included names, mobile numbers, addresses, and loan-related details. SBI confirmed that services remained operational while investigators assessed the data’s authenticity and origin. The disclosure did not indicate a breach of core banking systems or the theft of customer funds.

What You Should Do

• Prioritize patching systems facing active attacks, then address vulnerable runtimes and affected dependencies.
• After applying patches, restart services, verify running versions, and rebuild any environments suspected of compromise.
• Rotate all potentially exposed secrets and credentials, especially after supply chain incidents.
• Review cloud activity, VPN sessions, and administrator changes for any evidence of misuse or unauthorized access.
• For LiteLLM, pin to version 1.106.2 and perform clean rebuilds from trusted sources. Do not simply downgrade within a potentially contaminated environment.
• For WordPress, verify UpdraftPlus 1.26.13 Free or 2.26.13 Premium is installed, remove exposed UpdraftCentral connection keys, and inspect sites for backdoors.
• For OVHcloud CLI, update to version 0.16.0 and replace secrets stored on affected machines.
• Update all browsers, operating systems, runtimes, and trust stores to mitigate risks from the eMudhra CA compromise.
• For Palo Alto GlobalProtect and Plex, apply the latest patches immediately and investigate for signs of compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.