Skip to content
Thursday, October 22, 2026 · Daily edition · Vol. 1, No. 31Back issue

Vol. 1, No. 31Composed Oct 23 · 04:05 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

1 critical · 4 elevated5 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

PHP2SHELL Forces Rapid Forum Evacuations and Mitigations

Two PHP flaws triggered forum evacuations; patch, hunt, and rotate PKI and secrets now.

Composed by SitRep’s AI editors from 4 sources — Tenable Blog, Exploitdb, BleepingComputer, Unit 42

Tenable’s lead reporting shows PHP2Shell disclosures (CVE-2026-109618, CVE-2026-109619) prompted criminal operators to evacuate multiple forums (BreachForums, DarkForums, PwnForums, Dread) and rehost infrastructure within hours, forcing emergency patches and platform mitigations. At least four major forums implemented business-continuity actions post-exploitation, underscoring immediate_PATCHING needs across web apps and trust infrastructure.

Context

This rapid pre-patch exploitation matters because web-facing PHP runtimes, downstream appliances, and trust infrastructure are exposed concurrently; blast radius includes hosted apps, on‑prem proxies, and certificate ecosystems. Practitioner teams should assume opportunistic RCE scanning and prioritize assets that expose PHP handlers, orchestration consoles, or hold private PKI artifacts.

The move

5 things to do today

  1. Patch PHP installations to remediate CVE-2026-109618 and CVE-2026-109619 or deploy WAF rules/virtual patches if immediate patching is impossible.
  2. Apply Arista VeloCloud Orchestrator vendor patches for CVE-2026-114625, restrict VCO admin access, and enable detailed admin auditing.
  3. Revert litellm artifacts to litellm==1.106.2, rotate all CI/CD and cloud credentials, and block litellm[.]dev/healthcheck at egress.
  4. Audit certificate inventories for eMudhra intermediates, revoke and reissue certificates tied to compromised intermediates, and enforce strict OCSP/CRL checks.
  5. Rotate all environment variables and private registry credentials after Railway’s incident, pause automated deployments, and scan for token misuse.

On the wire

  • 1critical
  • 4elevated
  • 0moderate
  • 0low
P0Exploit

Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)

Immediately prioritize patching PHP runtimes against CVE-2026-109618 and CVE-2026-109619 and deploy web WAF/virtual patching where patching is delayed. Hunt for post‑exploit indicators (new web shells, unexpected PHP file modifications, unusual outbound connections) and scan public-facing hosts for exploit fingerprints from ExploitDB proof-of-concept code.

Previously in SitRep Oct 21: Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances

TENABLE BLOG · Threat Actors Evacuate Forums Over PHP2Shell Exploit

Copy link to “Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)”

P1Appliance

Apply Arista VeloCloud Orchestrator Patches for CVE-2026-114625

Install vendor patches for VeloCloud Orchestrator On‑Prem to remediate CVE-2026-114625; restrict VCO administrative access to management subnets, enable strict admin logging, and block suspicious source IPs identified in vendor guidance. Review web and SQL logs for exploitation patterns and escalate exposed hosts for immediate containment.

BLEEPINGCOMPUTER · Arista Patches VeloCloud Orchestrator Zero-day Exploited in Attacks

Copy link to “Apply Arista VeloCloud Orchestrator Patches for CVE-2026-114625”

P1Supply Chain

Revert Compromised LiteLLM Artifacts and Rotate All Secrets

Replace litellm==1.107.0 artifacts with the last known-good release (revert to 1.106.2), revoke and rotate any CI/CD, cloud, and developer secrets that may have been present in affected builds, and block outbound exfiltration domain litellm[.]dev/healthcheck at the network edge. Validate artifact integrity in build pipelines before redeploy.

BLEEPINGCOMPUTER · LiteLLM Release Pipeline Hack Distributes Info-Stealer Malware

Copy link to “Revert Compromised LiteLLM Artifacts and Rotate All Secrets”

P1Identity/PKI

Treat eMudhra Intermediate CA Key Compromise as an Emergency PKI Incident

Assume forged TLS certificates are possible: audit certificate inventories, remove trust of the eight compromised eMudhra intermediates, reissue certificates where necessary, and push trust-store updates and strict OCSP/CRL checks across services. Coordinate with PKI owners and vendor guidance for revocation and reissuance sequencing.

UNIT 42 · Emudhra Intermediate CA Private Keys Compromised, TLS Risk

Copy link to “Treat eMudhra Intermediate CA Key Compromise as an Emergency PKI Incident”

P1Credentials

Rotate and Lock Down Environment Secrets After Railway Exposure

Rotate all environment variables, private registry credentials, and API keys that touched Railway builds; pause and validate automated deployments and secret injection pipelines. Treat any exposed tokens as fully compromised and scan for their use in CI/CD, cloud consoles, and repos.

BLEEPINGCOMPUTER · Railway warns devs to rotate secrets after breach

Copy link to “Rotate and Lock Down Environment Secrets After Railway Exposure”

Indicators named in this edition

Vulnerabilities named CVE-2026-109618 · CVE-2026-109619 · CVE-2026-114625

KindValueNote
DOMAINlitellm [. ]dev/healthcheckExfiltration endpoint used by compromised LiteLLM artifacts

Elsewhere in the edition

China-Linked Hackers Use ARTEX AI in ConnectWise Supply Chain Attack

Microsoft says China-aligned Storm-0940 used ARTEX AI agents to automate a ConnectWise Cloud Backup supply chain attack, targeting over 2,250 tenants with up to 2,900 sign-in attempts per minute. Between Oct 10–14, 2026, 151,000 failed logons were recorded; by Oct 15, the attackers accessed multiple ConnectWise cloud apps to move into customer environments. Attack spanned many sectors and regions.

5 reports

Meta Ordered to Pay $25 Billion Over 43 Million Privacy Violations

New Mexico state court orders Meta to pay $25 billion for 43 million privacy violations linked to Cambridge Analytica. The case, filed in 2021, centers on misleading users about data control after the 2018 scandal. Meta faces prior settlements, including $725 million in 2022 and an $18 billion multi-state deal in 2026; Meta says it will appeal.

3 reports

Interpol Crackdown: Serengeti III Arrests 1,462 Suspects

INTERPOL says Operation Serengeti III disrupted 10,909 cybercrime networks, arrested 1,462 suspects across 21 countries, and recovered over $105 million in illicit funds. Conducted June 29–Aug 31, 2026, the effort affected 65,929 victims with losses exceeding $385 million.

3 reports

Capcom Confirms Data Breach Affecting 11.7 Million Accounts

Capcom confirms a data breach of its CAPCOM ID service exposing emails for 11.7 million accounts, plus account creation dates, last login info, login counts, and last login IP. A small subset (43) had DOB, gender, nicknames, and countries exposed; 196 accounts had passwords changed by attackers. No credit card data affected.

2 reports

Indurex Raises €7 Million for SafeGuard AI Industrial Platform

Amsterdam-based Indurex raises €7 million in a round led by Contrarian Ventures with Axeleo Capital and Curiosity to expand its SafeGuard AI platform. Funds will fuel R&D and broaden operations across Europe and the Middle East, with plans for the US and APAC. The company targets cyber-physical security for critical infrastructure and industrial plants, serving energy and manufacturing customers.

2 reports

Signal Vulnerability Allows Callers to Block Hang-Ups via RingRTC

SecurityWeek reports a critical flaw in RingRTC used by Signal that lets a remote attacker flood the FSM queue, causing hang-ups to fail and audio/video remain active. Tracked as CVE-2026-113380 (CVSS 9.3), it was fixed in RingRTC 2.72.0 (Sept 4). Users should update Signal promptly or verify call termination indicators to ensure calls end.

2 reports

Also reported

End of the Thursday, October 22, 2026 edition.

Colophon

SitRep · Vol. 1, No. 31

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.