> InfoSec News Nuggets – 10/22/2026

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert PHP pushed out an out-of-cycle security release on October 21 for two critical remote code execution vulnerabilities rated 9.2 on CVSS v4.0, after details of the embargoed flaws leaked online a day early. Researchers have dubbed the pair “PHP2Shell” and are tracking them as CVE-2026-109618 and CVE-2026-109619. Fixes are only available for the supported 8.2 through 8.5 branches, leaving end-of-life installs on 8.1, 8.0, 7.x and 5.x without a vendor patch, and Shodan banner counts suggest roughly 884,000 internet-facing hosts still report PHP 8.1 or older. Defenders are urged to inventory every PHP install, including those bundled in appliances and control panels, patch internet-facing systems first, isolate anything that cannot be updated, and watch for PHP processes spawning shells or download tools.   LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials LiteLLM version 1.107.0, a popular LLM proxy library with roughly 23 million weekly downloads, was published to PyPI and container registries on October 21 carrying malicious Python startup files that run whenever Python launches, even if LiteLLM is never imported. The payload harvests cloud credentials, SSH and GPG keys, browser data, environment variables, and auth files for AI coding tools such as Claude, Codex, Gemini and Cursor, and also queries LiteLLM proxy databases for saved provider credentials before exfiltrating everything in an encrypted archive. A second hook installs an hourly loader that can fetch and execute remote Python code. Build provenance shows the release workflow pulled from a lookalike “Berri-AI/litellm” repository, and floating container tags like latest pointed to the malicious image. Users should block 1.107.0, rebuild from a clean artifact such as 1.106.2, and rotate any secrets the affected environments could reach.   eMudhra security blunder left trusted CA signing keys exposed to anyone Eight intermediate certificates issued by Indian certificate authority eMudhra were found to be protected by private keys so weak, each a number smaller than 256, that anyone could recover them from the public certificates in under a second. The certificates chained to roots trusted by Apple, Google, Microsoft and Mozilla, meaning an attacker could forge HTTPS certificates for any domain or sign code. A researcher reported the issue on October 17, browsers moved to block the certificates within days, and Mozilla has removed trust in the eMudhra root that signed them, with Google following suit. eMudhra blamed a faulty script used during an April 2025 key ceremony and estimates about 30,000 customer certificates need replacing. Devices and apps that do not receive revocation updates may still trust the bad certificates, so administrators are urged to update their trust stores.   Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected GMO Internet’s Onamae Desktop Cloud, a popular Japanese VPS service often used to run automated forex trading platforms, confirmed that an unauthorized third party breached its infrastructure and installed malicious programs on customer servers, potentially affecting up to 26,739 of them. The company began shutting down all customer servers on October 21 and has suspended every Desktop Cloud plan with no estimated restoration date. Data stored on the affected servers may have been exposed, though payment card information is held on separate infrastructure and is not believed to be impacted. Customers are advised to rotate any passwords or secrets stored on their servers and to be wary of phishing attempts exploiting the incident.   ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs ConnectWise has disabled its Cloud Backup product, formerly SkyKick, along with SaaS Security and Cloud Management after discovering unauthorized access to application identities on October 14, leaving backups and restores unavailable for managed service providers and their clients. Researchers at Huntress say a threat actor used a stolen Microsoft 365 API secret belonging to the app to attempt sign-ins against more than 1,000 Entra tenants, with over 300 succeeding, and in two cases the app granted itself Global Administrator and added new credentials for persistence. Todyl warns that all tenants with the app enabled should be presumed compromised, noting the attacker appeared to work from a pre-built list of partner tenants. ConnectWise says it has revoked the affected certificates and has not confirmed downstream customer compromise, while researchers urge admins to disable the apps, review credentials and admin roles, and hunt for persistence. The post InfoSec News Nuggets – 10/22/2026 appeared first on AboutDFIR - The Definitive Compendium Project.