Security news.
Critical remote code execution vulnerabilities dominate today's briefing, led by widespread in-the-wild exploitation of the 'PHP2Shell' flaws and a maximum-severity GitLab bug. Software supply chains and PaaS environments are also under heavy strain, highlighted by backdoored LiteLLM packages and a data exposure incident at Railway. Administrators and developers should prioritize emergency patches for web runtime and collaboration infrastructure.
PHP2Shell Under Active Exploitation Prior to Patches
Threat actors began exploiting critical RCE flaws in PHP core (CVE-2026-109618, CVE-2026-109619) days before patches were published, prompting urgent remediation calls from vendors and CISA.
GitLab Issues Emergency Patch for CVSS 10.0 RCE Flaw
A maximum-severity Regular Expression Compiler vulnerability in self-managed GitLab instances allows remote, unauthenticated attackers to execute arbitrary code across releases spanning over a decade.
LiteLLM Pipeline Compromised to Deploy Stealer and Backdoor
Attackers breached release pipelines for popular open-source AI gateway LiteLLM to push poisoned version 1.107.0 containing a backdoor and credential stealer to PyPI and Docker Hub.
Railway Urges Credential Rotation Following Secrets Breach
PaaS provider Railway disclosed that an unauthorized third party accessed systems storing encrypted customer environment variables and may have obtained decrypted secrets for a subset of users.
Node.js Bundled Brotli Decoder Flaw Enables Remote Code Execution
Node.js released updates across all supported branches (22.x, 24.x, and 26.x) to address 10 security bugs, headlined by a critical decompression flaw that permits remote code execution.
CISA Warns of Active Plex Media Server Exploitation Chains
Threat actors are actively chaining four known vulnerabilities in Plex Media Server to gain remote code execution, prompting additions to the CISA Known Exploited Vulnerabilities catalog.
ConnectWise Cloud Backup Hit by Storm-0940 Using Agentic AI
Microsoft disclosed a supply chain breach of ConnectWise Cloud Backup by China-linked actors leveraging the ARTEX agentic AI framework to automate cross-tenant Entra and M365 credential theft.
QPACK Bugs Enable 4,000x Memory Amplification DoS on HTTP/3 Servers
Researchers released proof-of-concept exploits demonstrating how unauthenticated remote attackers can crash default HTTP/3 implementations using small batches of compressed headers.