PHP2Shell roots PAN-OS firewalls, LiteLLM poisoned on PyPI, and the Brotli bug is everywhere

PHP2Shell — Two flaws in PHP itself — memory corruption in out-of-memory handling (CVE-2026-109618) and stale state left behind after a request (CVE-2026-109619) — let an unauthenticated web request run code as the web-server account. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is affected, and the PHP team rates both critical at 9.2. Attacks are confirmed and both CVEs sit in CISA's exploited-vulnerabilities catalogue; mod_php is the worst deployment because the hit lands before any of your application code runs. If patching must wait, the only partial mitigation is setting memory_limit=-1.

Inventory the PHP you forgot, not just the PHP you know about: appliances embed it, and PAN-OS firewall management interfaces were rooted through these exact flaws. PHP 8.1 and older get no official release fixes, so those systems need a migration plan, not a patch. Check Docker images, NAS boxes and appliance firmware as well as your web servers. VulnCheck counts 2,608,039 internet-facing PHP hosts and judges 99.998% of them vulnerable or likely vulnerable; about 42% run end-of-life branches with no patch coming. php-src security advisory (GitHub)

Affected: before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 · Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 · Disclosed 21 Oct · Under attack since 21 Oct · We had it 1 Nov, 18:59 UTC

LiteLLM — Attackers used stolen GitHub CLI tokens from three LiteLLM engineers to run the project's own release workflow against a lookalike fork named Berri-AI/litellm — one hyphen off the real repository. The resulting litellm 1.107.0 sat on PyPI and in the official Docker images for about two hours, carrying build provenance that looked legitimate. It dropped three files into site-packages: a credential stealer that runs every time Python starts, and a backdoor that checks a GitHub-hosted file hourly for a second stage.

If anything pulled that release or the latest Docker tags, the malware runs in every Python process in the environment, even if LiteLLM is never imported — and deleting the package does not remove the payload. Manually remove cook.pth, cook.py and sitecustomize.py, revert to 1.106.2, and rotate cloud, developer and AI credentials from a clean machine. This is LiteLLM's second supply-chain compromise this year; the stealer harvests cloud and developer keys, .env files, and Claude, Codex, Gemini, Cursor and Copilot sessions. Datadog Security Labs

Affected: litellm 1.107.0 on PyPI and Docker tags v1.107.0, latest, main-latest, main-stable · Fixed in: 1.106.2 · We had it 1 Nov, 19:54 UTC

OpenCode — Version 1.18.33 silently fixed a critical RCE — Pillar Security rates it 9.8 — where a malicious MCP server could execute commands on a developer's Windows machine during the OAuth handshake. No CVE or advisory was published, so scanners will not flag older installs; update and treat any MCP server URL as untrusted input. Infosecurity Magazine

Affected: OpenCode before 1.18.33 (Windows) · Fixed in: 1.18.33 · We had it 1 Nov, 19:54 UTC

OpenCode Console — Unauthorized access to a legacy system being decommissioned exposed centrally stored OpenAI, Anthropic and Google API keys for 1.4% of Console users. If a key was ever stored there, generate replacements, revoke the old ones, and audit provider usage and billing logs. Infosecurity Magazine

NIK C2 — Cisco Talos documents a Go malware framework whose implant reads the victim's OPENAI_API_KEY environment variable to run AI analysis of stolen data, leaving charges and logs on the victim's account with no attacker trace. Cisco Talos via Infosecurity Magazine