CVE
CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
CWE
CWE-416, CWE-908, CWE-843, CWE-532, CWE-522
Affected Surface
- Internet-facing PHP applications, container images, and older end-of-life PHP branches that still run vulnerable 8.2 to 8.5 or legacy 5.4 to 8.1 builds
- Python environments and container images that installed compromised LiteLLM 1.107.0 wheels or Docker tags on 21 October 2026
- GitHub repositories, private CI workflows, and self-hosted runners exposed to the Gheist branch-seeding and log-exfiltration campaign
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Wednesday, 21 October through Tuesday, 27 October 2026, following the prior 20 October briefing. No later interim briefing landed between those Tuesday editions, so the 34 English-language research posts below are all new to this roundup. To keep the mailer readable, the lead sections focus on the three incidents with the widest operational impact and the list below groups the rest by theme.
Top Article
PHP2Shell: how PHP’s longjmp() out-of-memory path became pre-auth RCE
Wiz Research deserves the public technical-disclosure credit for PHP2Shell, and the PHP security team deserves the fix-coordination credit. It leads this week’s briefing because the bug sits below application code and moved from early leak to confirmed exploitation and KEV status in less than a week. An out-of-memory bailout during multipart parsing can leave request state or worker globals pointing at freed memory, which let researchers reach pre-auth RCE and cross-request memory disclosure on stock WordPress, Drupal, and Joomla builds. For subscribers, the important point is breadth: any unpatched PHP host, container image, or older end-of-life branch inherits the risk even if the application itself never wrote unsafe PHP.
Read it beside Corgea’s research on Next.js and @sentry/nextjs, Ruby’s Onigmo fixes for GitLab RCE, Node.js’s October security release, and Pillow 13.0.0’s parser fixes. The stacks differ, but the lesson is the same: routine parsing paths in widely deployed runtime plumbing can still become the shortest path to remote code execution.
More news
LiteLLM 1.107.0: a lookalike repo, a maturin data directive, and two Python startup hooks
LiteLLM deserves credit for publishing the incident timeline, while Wiz, StepSecurity, Aikido, and Microsoft Security Research provided the clearest independent artifact analysis. This story belongs near the top because the clean source tag was not the safe artifact. The malicious release hid in compiled wheels and container images, using one maturin data directive to plant cook.pth, cook.py, and sitecustomize.py into site-packages. That turned every Python start into a credential-collection point and gave the attacker a second-stage foothold on gateway hosts that often hold upstream model keys.
It is worth reading with Corgea’s research on Apex Accelerator’s npm tools, OpenCode and MCP Inspector’s OAuth URL RCE, the MCP TypeScript SDK advisory cluster, and vLLM, OpenHands, and Google Cloud MCP. Together they show how quickly AI tooling inherits ordinary package, OAuth, and shared-state failures, then turns them into higher-value credential and control-plane exposure.
Gheist plants 13,500 ci-sync-* GitHub Actions secret-dumping branches as Wiz maps 2026 pull_request_target bypasses
Wiz Research deserves the discovery and public reporting credit for Gheist. It belongs in the top tier because it shows how stolen GitHub tokens, quiet branch creation, and log-based exfiltration can still beat many organizations’ mental model of CI compromise. Instead of piping secrets to an obvious command-and-control server, Gheist base32-encoded env and toJSON(secrets) into the workflow’s own logs, then deleted the run. In private repositories and on self-hosted runners, the campaign escalated into environment-secret theft, Docker socket abuse, and AWS role assumption through GitHub Actions OIDC.
For adjacent context, read it with Corgea’s research on GhostAction’s fake-font stage and AWS-role theft, the OVHcloud CLI release-asset swap, testmetest and @iobandamwer/*, and the Tailwind and Animate.css private-scope bait packages. The common thread is that attackers no longer need a noisy registry blast radius if they can hijack the workflows, editors, and repository trust that developers already use every day.
Other news:
- Elastic Security Labs exposed Apex Accelerator’s npm tools rerouting AI agent traffic and dropping CloudSyncD and a Telegram stealer. In the same package-risk lane, Corgea also covered 29 fake-interview Tailwind and Animate.css plugins that hid their payload in private scopes unlocked by a committed
.npmrctoken, npm’s 19-package takedown ofappit-onlineafterinsta-api-wrapperandionic-insta-api-wrapperexfiltrated Instagram credentials, and thetestmetestplus@iobandamwer/*worm that shifted frombinding.gyphooks to native addons and armed 42 GitHub repositories. The discovery credit across that cluster sits with Elastic, GitHub’s malware-advisory pipeline, JFrog, and SafeDep. - OpenSourceMalware’s reporting remains the best public guide to GhostAction’s fake-font stage, cron persistence, and GitHub Actions OIDC AWS-role abuse, while Corgea’s OVHcloud CLI release-asset swap shows a different but related lesson: a familiar repository or release page can still deliver hostile binaries after trust in the publisher path breaks.
- Astral deserves the disclosure credit for
uvtrusting the compromised emSign root until0.13.4. Read that one with Corgea’s write-up on Node.js 26.12.1, 24.22.1, and 22.23.4, because both pieces remind teams that package delivery can fail before application code runs, either through stale trust roots or through parser and transport flaws in the runtime itself. - Pillar Security disclosed OpenCode and MCP Inspector’s OAuth URL PowerShell RCE. The rest of the week’s AI-tooling stack stayed just as busy: the MCP TypeScript SDK advisory batch, Strands Agents SDK, LangGraph, FastMCP, and MLflow, and vLLM, OpenHands, and Google Cloud MCP all matter for teams that expose OAuth, shared agent state, Docker sandboxes, or prompt-reachable tool servers.
- Vercel, Sentry, and Cure53 maintainers led one of the busiest JavaScript application-security weeks of the month. Corgea covered Next.js and
@sentry/nextjs, Storybook dev-server preview injection, DOMPurify 3.4.17, and Happy DOM, Undici, body-parser, and multer. - Python API and notebook surfaces were also crowded. Corgea published a combined read on Django REST framework, PyJWT, and Black, plus a second roundup on GitPython, Jupyter Server, and nbconvert. Those articles are the ones to hand to teams that own developer platforms, notebook gateways, or auth-heavy Python APIs.
- CISA supplied the urgency for Collabora Online’s
richdocumentscodecommand injection entering KEV. In the same application tier, Corgea also covered Laravel TokenGuard and Livewire authorization bypasses and Postiz’s unrestricted dashboard calls, media traversal, and JWT signing bug. Anthropic deserves the discovery credit named in the Postiz advisory trail. - Runtime and framework maintainers spent the week shipping “update now” releases. Corgea’s coverage includes Ruby’s Onigmo fixes behind four GitLab RCE CVEs, Twisted
26.10.0rc1, Go Echov4.16.1andv5.4.1, and Pillow 13.0.0. - Lower-level sandbox, network, and artifact-handling code rounded out the week. Corgea published details on Wasmtime and Cranelift sandbox escapes, Rust
zipand Cloudflarepingora-core, Nettynetty-tcnative, Goklauspost/compress,go-jose, andrclone, Mistral Vibe, Datadogddtrace,rembg, Airflow SSH, andsysteminformation, and the larger RustSec cluster forcargo-nextest,rustpython-vm,rustls-ffi, andzstd-rs.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.