ThreatScope 

PHP2Shell, NetScaler, VeloCloud and LiteLLM Supply Chain Compromise

Weekly Cybersecurity Intelligence | October 21–27, 2026

Threat Level: HIGH for affected and exposed systems

🎧 Listen to this week’s ThreatScope (audio brief)

Executive Snapshot

Is This Report Relevant to Your Organization?

Executive Summary

The principal development this week is PHP2Shell, two critical PHP vulnerabilities that may allow unauthenticated remote code execution. Amazon observed exploitation attempts beginning October 17, before public disclosure. These observations establish attempted exploitation, not successful compromise in every case.

The risk extends beyond conventional websites. Citrix confirmed exposure in affected NetScaler management interfaces, while a separate PHP vulnerability requires its own mitigation. Alongside these developments, Arista confirmed exploitation of a privilege-escalation vulnerability in VeloCloud Orchestrator, and a compromised LiteLLM release distributed credential-stealing malware through trusted software channels.

Key Vulnerabilities

Vulnerability Analysis

PHP2Shell: Critical Exposure Across Web Applications and Embedded Runtimes

CVE-2026-109618 and CVE-2026-109619 affect PHP request processing and may enable unauthenticated remote code execution. Web-serving deployments using PHP-FPM, Apache mod_php, CGI, FrankenPHP or LiteSpeed may be exposed, with mod_php identified as particularly high risk. Amazon observed exploitation attempts from October 17, making pre-disclosure activity relevant to investigations.

The corrected upstream PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations should verify the PHP runtime actually processing web requests, not only the command-line version. Distribution-specific security backports must also be considered. Restart or redeploy affected processes after updating, and review web files, unexpected child processes, suspicious requests and outbound connections from at least October 17. Observed attack attempts are investigative indicators, not automatic proof of compromise.

A separate issue, CVE-2026-115560, is not addressed by the original PHP2Shell corrections. It requires an uncommon combination of session settings and application behavior. Where applicable, the recommended temporary mitigation is session.upload_progress.enabled=0, followed by restarting the relevant workers.

Citrix NetScaler: PHP2Shell Reaches Management Infrastructure

Citrix confirmed that supported NetScaler ADC and Gateway versions are affected because their management interfaces use PHP. Relevant exposure includes the NSIP management interface, SNIPs with management access enabled and cluster management interfaces. NetScaler Console and SVM are not affected by this issue.

Organizations should immediately restrict management access to approved administrative hosts or dedicated management networks, while preserving necessary operational connectivity. The reviewed Citrix notice scheduled corrections for October 27 but did not establish fixed build numbers or confirmed deployment on customer-managed appliances. Verify the current vendor guidance and actual installation status rather than assuming scheduled availability means protection is in place.

Arista VeloCloud Orchestrator: Confirmed Privilege-Escalation Exploitation

CVE-2026-114625 is an SQL-injection vulnerability that allows an authenticated user to obtain operator privileges and access restricted functionality. Arista confirmed active exploitation. Even an account with the Enterprise Read Only role can meet the initial privilege requirement, provided the attacker can reach the Orchestrator web interface.

Corrected versions include 5.2.3.18, 6.1.3.10 and 6.4.2.12 for their respective branches. Arista reports that hosted services have been patched, while on-premises deployments require customer action. Beyond upgrading, review operator sessions, configuration changes and unusual outbound activity. Because the platform manages network infrastructure, investigations should also validate downstream configuration integrity.

LiteLLM: Malicious Artifacts Distributed Through a Trusted Release Channel

On October 21, LiteLLM version 1.107.0 was distributed through a compromised release process. Affected Python packages and container images contained malware capable of credential theft and remote code execution. The incident involved specific distribution windows and image tags, including latest, main-latest and main-stable. According to the vendor, private enterprise releases were not affected.

Organizations should inspect dependency inventories, build logs, caches and deployed image digests to establish whether affected artifacts were installed or executed. Suspected environments require isolation, evidence preservation and rebuilding from verified sources. Potentially exposed AI-provider, cloud, repository and service credentials must be revoked and rotated, with subsequent use investigated. Developer systems and automated build environments are part of the assessment, not only production workloads.

Other Security Developments

Nextcloud / Collabora: CVE-2026-110447 affects the built-in richdocumentscode application before 26.4.303. It may allow unauthenticated command execution when the built-in CODE server is stopped. Upgrade to 26.4.303 or remove the application; disabling it is insufficient. Standalone Collabora Online servers are not affected.

Node.js and Brotli: CVE-2026-111497 affects Brotli decompression and may lead to crashes, memory disclosure or code execution when applications process attacker-controlled compressed data. Corrected Node.js versions include 22.23.4, 24.22.1 and 26.12.1. Windows PHP packages also received Brotli-related rebuilds on October 26; administrators must verify the installed package build, not just the PHP runtime version.

Oracle: The October Critical Patch Update contains 1,295 new security patches across Oracle product families. This is a patch count, not a count of unique vulnerabilities. Organizations should map the applicable corrections to deployed products and prioritize exposed services and critical databases.

Recommended Actions

Immediate priorities — 0–7 days: Update exposed PHP runtimes, restrict NetScaler management access, remediate affected VeloCloud deployments and identify compromised LiteLLM artifacts. Investigate suspected compromise, preserve evidence and revoke exposed credentials before rotation.

Within 30 days: Verify remaining application and dependency updates, including Collabora, Node.js, Windows PHP packages and applicable Oracle products. Review hosting-provider confirmations, privileged access and the integrity of deployed software artifacts.

Strategic priorities — 90 days: Strengthen software supply-chain verification, maintain visibility into embedded runtimes and dependencies, and ensure incident-response procedures cover credential recovery, clean rebuilding and validation of connected systems.

Conclusion

This week’s findings demonstrate two distinct exposure paths: vulnerable components embedded in trusted infrastructure and malicious code distributed through legitimate software channels. Effective remediation requires verification of the running software, investigation of possible compromise and confirmation that exposed credentials and downstream access have been secured.

DIAMATIX supports organizations through continuous security monitoring, threat investigation and coordinated incident response.

Trusted · Innovative · Vigilant

Sources: PHP Security Advisories, AWS Security Blog, Citrix, Arista, LiteLLM, Nextcloud/GitHub, Node.js Security Releases, Oracle, Red Hat and the Canadian Centre for Cyber Security.

Methodology: Findings are prioritized according to observed exploitation, exposure conditions and operational impact. Exploitation attempts are distinguished from confirmed compromise, and recommended response periods represent operational priorities rather than regulatory deadlines.