https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: Critical. en https://vanemmerik.ai/supply-chain/2026-10-25/#php2shell-unit42-agentic-intrusion vea-sc-2026-10-25-php2shell-unit42-agentic-intrusion Sun, 25 Oct 2026 21:57:00 +0000 Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief (Oct 23, 12:30 PT) with a case in which attackers, apparently driven by an agentic AI platform, ran recon through a web shell at a European government body and obtained password hashes and MFA secrets within two hours of initial exploitation, then tried NTLM relay into Active Directory. The brief does not name the exact CVE used in that case, so treat it as strong but not definitive evidence that PHP2Shell has moved from attempts to real break-ins; our Oct 24 entry said none had been confirmed. Evening update: The Hacker News also reports that CYFIRMA tied a scanning campaign, with moderate confidence, to a suspected North Korea-linked actor probing 216 unpatched hosts in 12 countries (single source so far), and that ReliaQuest has published log artifacts for detection. Fixed PHP releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); a third flaw, CVE-2026-115560, still awaits a regular release, and neither main CVE was in CISA KEV as of this watch. What to do: Assume unpatched internet-facing PHP may already be compromised: patch, then hunt for web shells and unexpected outbound connections from PHP hosts since Oct 17, and rotate credentials those hosts could reach. https://vanemmerik.ai/supply-chain/2026-10-24/#brotli-http2shell-python-bun-envoy vea-sc-2026-10-24-brotli-http2shell-python-bun-envoy Sat, 24 Oct 2026 21:53:00 +0000 CVE-2026-111497 sits in Google's Brotli C decoder (versions 1.0.3 to 1.2.0), not only in Node.js, so anything that decodes untrusted Brotli data with a bundled or linked copy is exposed. On Oct 23-24 researchers confirmed the PyPI packages Brotli (fixed in 1.2.1) and brotlicffi (fixed in 1.2.1.0) are affected; urllib3/requests, httpx, aiohttp and Scrapy load them automatically when installed and will decode br responses. Bun 1.4.4, Envoy 1.40.0/1.39.3/1.38.6/1.37.8 and Istio 1.29.9/1.30.6/1.31.2 carry the fix; libcurl and Git for Windows builds linking Brotli 1.2.0 are also in scope. Bundled copies in the .NET runtime, the PHP brotli extension, the Ruby brotli gem, DuckDB, ClickHouse and Apache Arrow were still listed as unpatched on Oct 24. Upstream Brotli fixes are 1.0.10, 1.1.1 and 1.2.1, Debian 13 ships 1.1.0-2+deb13u1, and the cdxgen SBOM tool is fixed in 12.8.9 and 13.5.0. Public proof-of-concept code reportedly crashes stock builds; code execution has only been shown in Imperva's lab on an official Node.js 24.22.0 arm64 build and that exploit is unreleased. No in-the-wild exploitation is confirmed, and GitHub's advisory did not list the PyPI packages on Oct 23, so Dependabot may not flag them. What to do: Upgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0 in every Python environment and image, update Bun, Envoy/Istio and OS libbrotli packages, then rebuild images and bundled binaries. Where you cannot patch yet, reject Content-Encoding: br at the edge. https://vanemmerik.ai/supply-chain/2026-10-24/#php2shell-no-confirmed-compromise-aslr-bypass vea-sc-2026-10-24-php2shell-no-confirmed-compromise-aslr-bypass Sat, 24 Oct 2026 21:53:00 +0000 Two days into mass scanning for CVE-2026-109618 and CVE-2026-109619, no successful in-the-wild compromise has been confirmed: Sophos withdrew an earlier report of one, Wordfence and Hunt.io saw only failed attempts, and Sansec now says public exploits fail on default PHP settings. That window may not last. VulnCheck reports a working exploit for CVE-2026-109618 that leaks memory to defeat ASLR on x86-64 with error display off, the usual production setup; it is limited to its paying customers for now. Amazon's honeypots logged an attempt on Oct 17, four days before disclosure, so log reviews should start there. Fixed releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); PHP 8.1 and older get no fix, and neither CVE was in CISA KEV as of Oct 23. What to do: Keep patching to the fixed PHP releases and rebuild PHP base images; for end-of-life PHP, block multipart uploads at the edge if you can, and hunt for POST bodies containing PHP_SESSION_UPLOAD_PROGRESS from Oct 17 onward. https://vanemmerik.ai/supply-chain/2026-10-23/#nodejs-oct-2026-security-release vea-sc-2026-10-23-nodejs-oct-2026-security-release Sat, 24 Oct 2026 03:05:00 +0000 Node's Oct 21 security release fixed 10 CVEs across the 22.x, 24.x and 26.x lines. The worst, an out-of-bounds write in the bundled Brotli decoder, is no longer theoretical: on Oct 23 Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 build, including through Express 5.0-5.3 and body-parser 2.0-2.3 request handling, though not on every attempt. Three high-severity TLS and DNS bugs in the same release let certificates match the wrong host or let a NUL byte truncate a hostname. No in-the-wild exploitation reported yet; Node 20.x and older are end-of-life and get no fix. What to do: Move to 26.12.1, 24.22.1 or 22.23.4 everywhere, including base images, CI runners and serverless runtimes; replace any Node 20.x. Until then, limit untrusted Brotli traffic at the edge. https://vanemmerik.ai/supply-chain/2026-10-23/#php2shell-cve-2026-109618 vea-sc-2026-10-23-php2shell-cve-2026-109618 Sat, 24 Oct 2026 03:05:00 +0000 PHP shipped emergency releases on Oct 21 for two critical flaws that let an attacker without an account run code on a server. Exploit attempts reported since then number in the millions, with attackers trying to install Mirai botnet malware. On Oct 23 PHP flagged a separate, lower-risk session issue that the emergency builds do not fix; it only affects unusual session-handler configurations. What to do: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, including container base images. As a stopgap (and to cover the Oct 23 issue), set session.upload_progress.enabled=0. https://vanemmerik.ai/supply-chain/2026-10-23/#litellm-1-107-0-compromise vea-sc-2026-10-23-litellm-1-107-0-compromise Sat, 24 Oct 2026 02:45:00 +0000 On Oct 21 a release built from a lookalike repository pushed backdoored litellm 1.107.0 wheels to PyPI and matching images to GHCR and Docker Hub. The payload runs on every Python start via a .pth file, harvests cloud, CI, SSH and AI-tool credentials (and proxy provider keys when DATABASE_URL is set), and polls for remote code hourly. PyPI pulled the release in under two hours; the latest and main-stable Docker tags pointed at the bad image for roughly 2.5 hours. Researchers report the 1.106.x line as clean. What to do: Search lockfiles, image digests and mirrors for 1.107.0. If it ran anywhere with network access, rebuild that environment, pin litellm==1.106.2, block litellm.dev, and rotate every credential the host could reach. https://vanemmerik.ai/supply-chain/2026-10-23/#gitlab-onigmo-rce-cve-2026-110264 vea-sc-2026-10-23-gitlab-onigmo-rce-cve-2026-110264 Sat, 24 Oct 2026 02:45:00 +0000 GitLab's Oct 21 critical patch release fixes an unauthenticated remote code execution bug triggered by a crafted Org-mode file, rooted in an integer overflow in Onigmo, the regex engine inside Ruby. Fixed GitLab versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already patched. On Oct 23 the Ruby team released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying regex bugs. It is not in CISA KEV yet, but public repositories claiming proofs of concept have appeared. What to do: Upgrade self-managed GitLab now (older than 18.11 means following upgrade stops to 18.11.13 or later). Update Ruby on self-compiled installs and on any service that compiles regexes from untrusted input.