Issue 1 · Sunday 1 November 2026 · 6 min read
PHP2Shell patch day, a backdoored Claude Code extension, and nine breached AI platforms
In this issue: Act on this first · Under attack (2) · AI security (4) · Breaches (3) · Patches worth knowing (4) · One thing to do
Act on this first
PHP2Shell — PHP shipped emergency releases closing a pair of unauthenticated remote-code-execution bugs that researchers are calling PHP2Shell. Every release from 5.4 onward carries at least one of them, and by Censys's count that touches roughly 2.58 million internet-facing hosts. Attacks are live — Cloudflare switched on WAF rules the same morning the fixes landed — so move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for your branch, then sweep web roots for dropped shells.
Any PHP in your stack — WordPress, Drupal, Magento, Joomla or your own app, including container base images you have not rebuilt in months — needs a version check today. Wiz puts the blast radius in Log4Shell territory and expects the pair to be mass-exploited for web shells. Wiz, which found the flaws alongside OpenAI and Calif, says frontier AI models collapsed an exploit chain too complex for practical human exploitation; tracked as CVE-2026-109618 and CVE-2026-109619. Krebs on Security
Affected: PHP 5.4 and later · Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35 · We had it 1 Nov, 18:59 UTC
“given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory”
Under attack
Drupal Commerce Core — before 3.3.13 (or 8.x-2.41): missing authorization exposes order routes and fields to anyone; exploited in the wild — upgrade and audit orders; CVE-2026-118539.
Affected: 3.x before 3.3.13 and earlier releases before 8.x-2.41 · Fixed in: 3.3.13 (3.x) or 8.x-2.41 (earlier branches) · We had it 30 Oct, 23:04 UTC
GitLab CE/EE — before 19.4.2, 19.3.5 and 19.2.8: a crafted CI/CD regex gives unauthenticated code execution; CISA lists it as exploited — patch (CVE-2026-97229, CVSS 10).
Affected: CE and EE releases before 19.4.2, 19.3.5 and 19.2.8 · Fixed in: 19.4.2, 19.3.5, 19.2.8 · We had it 1 Nov, 18:54 UTC
AI security
Claude Code 2.1.313 — A tampered build of Anthropic's Claude Code extension, carrying the real publisher ID and the next version number, auto-installed on Cursor machines with no click. For about eleven hours it planted an attacker SSH key, installed persistence that retried a reverse tunnel roughly every minute, and posted host details to 134.209.82.225. Coding errors blocked the SSH login on most hosts, but the key and persistence still landed.
If anyone here runs Cursor with Claude Code, grep ~/.ssh/authorized_keys for svc-telemetry and treat a hit as compromised — uninstalling alone leaves the dropped persistence. Cursor capped impact at 5,000 users and asks affected users to move to 2.1.314. A 66-line loader prepended to extension.js ran before any Claude conversation, so no user action was required; Microsoft and Socket confirm the official VS Code Marketplace, npm and Open VSX never served it. Cursor
LiteLLM Enterprise proxy — On a proxy running with an Enterprise license, a request with no credentials can steer the server to read any local file and deliver its bytes to a web address the attacker picks. Aiming it at /proc/self/environ hands over LITELLM_MASTER_KEY and the provider keys — total control of the proxy — and some configurations turn that into arbitrary Python running as root. Open-source deployments without a license are not affected.
If you run a licensed LiteLLM proxy reachable from the network, treat this as an emergency upgrade and assume the master key is burned. Also egress-limit the proxy to known provider endpoints: the exploit has to POST the stolen file out, so allowlisting breaks it even if the code path is reached. Rated Critical, CVSS 10.0, with no CVE assigned; fixed in 1.103.10, 1.104.8, 1.105.6 and 1.106.5. GitHub Advisory Database
Affected: Enterprise-licensed deployments before 1.103.10, 1.104.8, 1.105.6 and 1.106.5 · Fixed in: 1.103.10, 1.104.8, 1.105.6, 1.106.5 · Disclosed 27 Oct · We had it 1 Nov, 18:54 UTC
PraisonAI — PraisonAI executes inline Python from YAML workflow steps behind an AST sandbox whose module allowlist includes 'os'. A step containing import os; os.system(...) passes every validation check and runs OS commands with the privileges of the calling process. Upgrade to 4.6.78, which removes 'os' from the allowlist.
This matters if you run PraisonAI jobs over untrusted or AI-generated workflow files, especially in CI — the advisory specifically calls out downloaded templates and agent-produced YAML. Exploitation needs a workflow to actually run, so it is a local foothold, not a network attack. CVE-2026-61438, rated High with CVSS 7.3; every release before 4.6.78 is affected. GitHub Advisory Database
Affected: < 4.6.78 · Fixed in: 4.6.78 · Disclosed 29 Oct · We had it 1 Nov, 18:54 UTC
Cloudflare Workers AI — Knostic found that requests of roughly 700,000 tokens or more to the GLM-5.3 model returned content from other customers' inference sessions instead of answers: names, invoice numbers, payment dates, code and filesystem paths. Black-box analysis ruled out hallucination by correlating one response with a repository being actively developed minutes after the affected inference. Cloudflare validated and fixed the issue, and confirmed the advertised 1,310,720-token window was itself a bug, with 1,048,576 actually enforced.
As you route more traffic through managed inference, treat context-window handling as a tenant-isolation boundary — the leaked material looked exactly like another team's agent session. Nothing to patch on your side. Sibling models GLM-5.3-flash, GLM-5.2 and GLM-4.7-flash either answered oversized requests correctly or rejected them outright. Knostic Research
Breaches
Black October — Northflank is the ninth AI developer platform to disclose an October breach, after customers saw stored AI provider keys used without permission; it told every customer to rotate all secrets, starting with AI keys. Wiz links the nine incidents by intent, not by one bug: intruders hunting the environment variables that grant AI access, then reselling the keys. If your provider keys sit in a platform's env-var store, they are the prize — prefer short-lived scoped credentials and watch AI billing. One stolen key drew roughly 800,000 Bedrock calls in thirty hours; Zeabur is shutting down over its incident. Wiz blog
LiteLLM — Secret-stealing GitHub Actions workflows ran in the BerriAI/litellm repository eleven days before the malicious litellm 1.107.0 release, pushed to short-lived branches that vanished within minutes. LiteLLM traces the foothold to a master key accidentally committed in May and never revoked — one stale committed secret quietly owned the release pipeline. Rotate committed secrets and watch for workflow runs on branches that no longer exist. The first exfiltration run alone took six organization-level secrets, including a GitHub App private key. Socket
OVHcloud CLI — Release binaries of five published OVHcloud CLI versions were swapped for a secret-stealing build, uploaded through a contributor's GitHub account that had been hijacked for about seven months. A downstream CI job that pins a SHA-256 caught the swap within 94 minutes; source code and the Go module proxy were untouched, so only unpinned downloads got malware — checksum-pinning every binary dependency earns its keep. The malware was a plain laptop build: its Go metadata showed an uncommitted, dirty checkout rather than a pipeline artifact. OpenSourceMalware
Patches worth knowing
MLflow — 3.12.0rc0 up to (not including) 3.17.0: unauthenticated code execution on default no-auth servers via third-party scorer deserialization; fixed in 3.17.0; CVE-2026-116692, critical (CVSS 9.8).
Affected: unconfirmed, see the advisory · Fixed in: 3.17.0 · We had it 1 Nov, 18:54 UTC
Beta9 worker — before 0.1.756: a sandbox tenant reads and writes files on the hosting worker as root, including its cluster-admin token; fixed in 0.1.756; CVE-2026-120307, CVSS 9.9.
Affected: worker < 0.1.756 · Fixed in: 0.1.756 · We had it 1 Nov, 18:54 UTC
vLLM — 0.14.0rc1 and later, before 0.31.0: unauthenticated clients can obtain a live heap address through PIL error output; fixed in 0.31.0; GHSA-m9fg-w9qh-67pc, moderate (CVSS 5.3).
Affected: unconfirmed, see the advisory · Fixed in: 0.31.0 · We had it 1 Nov, 18:59 UTC
certifi — still ships emSign roots whose intermediates were revoked after a certificate-authority key compromise, enabling man-in-the-middle attacks; upgrade to 2026.10.19 and rebuild container images; GHSA-6q48-6c7w-9gw2, critical.
Fixed in: 2026.10.19 · We had it 1 Nov, 18:59 UTC
One thing to do
Refresh the CA bundle inside your container images. Upgrade certifi to 2026.10.19 in every Python image and rebuild: a certificate-authority key compromise means stale CA bundles may still trust attacker-issued certificates for HTTPS interception. Run `python -c 'import certifi; print(certifi.__version__)'` inside your deployed images to find any still carrying the old bundle, and check OS-level ca-certificates packages too, since certifi pins its own copy. python.org security-announce
How this issue was made. Researched and written by an agent, produced on 1 November 2026, 20:14. 292 sources read, 0 unreachable. Every link above goes to the primary source. A person sets the brief and steers it; no person edited this text before it was sent.