Cyber Threat Brief — October 22 2026
⚠️ This report is AI-generated. Always validate findings.
1. LiteLLM-1.107.0-2026-10 — malicious 1.107.0 release
TL;DR: PyPI litellm==1.107.0 and four Docker tags were malicious for about two hours on 21 October. Pin 1.106.2. Treat any environment that started Python on that build as compromised, then rotate the secrets it could read.
What’s New:
- LiteLLM’s incident report says all seven
litellm==1.107.0wheels were on PyPI from 11:39:51 to 13:23 UTC on 21 October. Docker Hub tagsv1.107.0,latest,main-latest, andmain-stablepointed at image indexsha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339efrom 11:46:56 to 14:20 UTC. The same four tags on GHCR (litellm,litellm-database,litellm-non_root) were compromised from 11:46:56 UTC and unavailable by 13:51 UTC. The official GitHub source tag does not contain the malicious files. - The wheels drop
cook.pth,cook.py, andsitecustomize.pyintosite-packages. Python runs them on every start, includingpip. Datadog sayscook.pyposts stolen secrets towww.litellm.dev/healthcheckwith headerX-Token: XWiA8gZNa7NcX2XRoAEb, andsitecustomize.pychecksraw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txthourly. Datadog says that file only ever held test values. - LiteLLM says customers on the private enterprise registry were not affected. A missing marker file does not clear a host. If
1.107.0was installed on a machine with outbound internet, assume the steal ran. - The build used lookalike source
Berri-AI/litellm(hyphen) instead ofBerriAI/litellm. JFrog says this payload and infrastructure differ from the earlier TeamPCP incident. There is no CVE. This is a package compromise, not exploitation of a vulnerability.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
litellm==1.107.0 | Malicious PyPI release | T1195.002 | pip show litellm / package inventory / image SBOM | Remove litellm==1.107.0 anywhere it is installed. Do not run pip or any other Python in that environment until cook.pth, cook.py, and sitecustomize.py are gone. |
litellm==1.106.2 | Safe pin | T1195.002 | Package inventory / lockfile | Pin LiteLLM to litellm==1.106.2, or to another explicit release published before 21 October 11:39 UTC. Do not float latest. |
SHA-256 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e | Compromised image index | T1195.002 | Container runtime / registry audit | Treat any container that started image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e as compromised. Rebuild from litellm==1.106.2. |
Docker Hub LiteLLM tag v1.107.0 | Compromised tag | T1195.002 | Registry pull logs | Find pulls of v1.107.0 between 11:46 and 14:20 UTC on 21 October. Those pulls are in the malicious window. |
Docker Hub LiteLLM tag latest | Compromised tag | T1195.002 | Registry pull logs | Find pulls of LiteLLM latest between 11:46 and 14:20 UTC on 21 October. That tag pointed at the malicious index during the window. |
Docker Hub LiteLLM tag main-latest | Compromised tag | T1195.002 | Registry pull logs | Find pulls of main-latest between 11:46 and 14:20 UTC on 21 October. That tag pointed at the malicious index during the window. |
Docker Hub LiteLLM tag main-stable | Compromised tag | T1195.002 | Registry pull logs | Find pulls of main-stable between 11:46 and 14:20 UTC on 21 October. That tag pointed at the malicious index during the window. |
ghcr.io/berriai/litellm | Compromised GHCR image | T1195.002 | GHCR pull logs / container runtime | Find pulls of ghcr.io/berriai/litellm tags v1.107.0, latest, main-latest, or main-stable from 11:46:56 UTC until 13:51 UTC on 21 October. That image pointed at index sha256:1bbcb1443bc9…, the same index as Docker Hub. |
ghcr.io/berriai/litellm-database | Compromised GHCR image | T1195.002 | GHCR pull logs / container runtime | Find pulls of ghcr.io/berriai/litellm-database tags v1.107.0, latest, main-latest, or main-stable from 11:46:56 UTC until 13:51 UTC on 21 October. LiteLLM gives only the index prefix sha256:c00f9d92c427, so use it as a lead and confirm the full digest before you act on it. |
ghcr.io/berriai/litellm-non_root | Compromised GHCR image | T1195.002 | GHCR pull logs / container runtime | Find pulls of ghcr.io/berriai/litellm-non_root tags v1.107.0, latest, main-latest, or main-stable from 11:46:56 UTC until 13:51 UTC on 21 October. LiteLLM gives only the index prefix sha256:7b00e91cd2fe, so use it as a lead and confirm the full digest before you act on it. |
cook.pth | Python startup hook | T1546.018 | File integrity / EDR file create | Delete cook.pth from every site-packages directory, plus __pycache__/cook*.pyc. Finding it confirms exposure. Not finding it does not clear the host. |
cook.py | Credential stealer | T1041 | File integrity / EDR file create | Delete cook.py and its bytecode from site-packages. It collects credentials and posts them to www.litellm.dev. |
sitecustomize.py in site-packages | Hourly remote loader | T1546.018 | File integrity / EDR file create | Delete sitecustomize.py that arrived with litellm==1.107.0. A sitecustomize.py you placed yourself is a separate file. Compare contents before you delete a copy you expect to own. |
www.litellm.dev | Exfil domain | T1071.001 | DNS / proxy | Block www.litellm.dev and search for HTTP requests to www.litellm.dev/healthcheck. The legitimate project is not that domain. |
X-Token: XWiA8gZNa7NcX2XRoAEb | Exfil header | T1041 | Proxy / Zeek HTTP | Alert on outbound requests that send header X-Token with value XWiA8gZNa7NcX2XRoAEb. |
raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt | Dead-drop URL | T1102 | Proxy | Search for requests to raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt. Datadog says the repository is removed and only held test values. |
/tmp/.pc_once_72129118c59f5636c0bb | Exfil marker | N/A | File integrity / container filesystem | If /tmp/.pc_once_72129118c59f5636c0bb exists, the exfil step ran. If it is absent, that proves nothing. |
/tmp/remote_code_loader.lock | Loader lock | T1546.018 | File integrity / process list | Find the process holding /tmp/remote_code_loader.lock and kill it before you reinstall. LiteLLM says that process is the detached Python loader. |
SHA-256 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | Malicious wheel digest | T1195.002 | Package download logs / JFrog Xray | Block and search for 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d. Datadog lists it among the seven litellm==1.107.0 wheel digests. |
SHA-256 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a | Malicious wheel digest | T1195.002 | Package download logs | Block and search for 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a. Datadog lists it among the seven wheel digests. |
SHA-256 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 | Malicious wheel digest | T1195.002 | Package download logs | Block and search for 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7. Datadog lists it among the seven wheel digests. |
SHA-256 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 | Malicious wheel digest | T1195.002 | Package download logs | Block and search for 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6. Datadog lists it among the seven wheel digests. |
SHA-256 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 | Malicious wheel digest | T1195.002 | Package download logs | Block and search for 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00. Datadog lists it among the seven wheel digests. Do not confuse it with the image index, which starts 1bbcb144. |
SHA-256 c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 | Malicious wheel digest | T1195.002 | Package download logs | Block and search for c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054. Datadog lists it among the seven wheel digests. |
SHA-256 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 | Malicious wheel digest | T1195.002 | Package download logs | Block and search for 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484. Datadog lists it among the seven wheel digests. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Python PTH File Creation During Package Installation | Windows Sysmon. Needs python.exe plus a created *.pth during an install command. Linux hosts, Docker layers that already contain cook.pth, and a later Python start with no new file event all miss. Python Site Hooks Creation During Package Installation is the same Windows shape for sitecustomize.py under a *-packages\ path. |
| Elastic | Partial — Python Path File (pth) Creation | Linux file-create of .pth under site-packages or dist-packages. A container that starts with the file already in the image does not create it. Python Site or User Customize File Creation does not list site-packages/sitecustomize.py. It looks at dist-packages/sitecustomize.py and a few other paths. |
| Sigma | Partial — Python Initiated Connection | Windows only. Any python.exe network connection. It does not name www.litellm.dev. Linux and container traffic miss. No Sigma rule in this index creates .pth files. |
Detection index: ESCU 678e76c (2026-10-21) · elastic detection-rules 9431b80 (2026-10-21) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Search image and package inventories for litellm version 1.107.0 and for image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e. On a hit, do not start Python. From a shell, delete cook.pth, cook.py, and the package’s sitecustomize.py, kill whatever holds /tmp/remote_code_loader.lock, and rebuild the venv or image pinned to 1.106.2. Then rotate cloud keys, source-control tokens, and LLM provider keys that were on that host. Proxy logs for www.litellm.dev and the letters9813 raw URL tell you the steal or the loader ran. A clean marker file does not.
Sources: LiteLLM incident · Datadog · JFrog · Wiz
2. CVE-2026-110264 — GitLab regex-compiler RCE
TL;DR: CVE-2026-110264 is an unauthenticated remote code execution in self-managed GitLab, CVSS 10.0. Upgrade to the fixed build for your branch. Exploitation is not confirmed, and the CVE is not in KEV. Builds that fixed CVE-2026-97229 are still vulnerable.
What’s New:
- GitLab’s 21 October patch release fixes an integer overflow in the regular-expression compiler. An unauthenticated user can run code by making GitLab render a crafted Org-mode file. Fixed builds: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Versions from 7.0 before 18.11.13 have no patch on the old branch. Upgrade them.
- GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 (or later) already include this fix. Self-managed 19.4.2, 19.3.5, and 19.2.8 do not. Those three builds fixed CVE-2026-97229 and still need this release. CVE-2026-110264 is a separate Org-mode bug, not a bypass of CVE-2026-97229.
- CERT-EU advisory 2026-019 restates the GitLab advisory and points at GitLab’s two detection rules. No exploitation has been confirmed. The CVE is not in CISA KEV.
- The same release also fixes other issues, including CVE-2026-105777 (internal credential exposure, CVSS 4.3). Patch for CVE-2026-110264 and you pick those up on the current branches.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-110264 | Unauthenticated RCE | T1190 | GitLab version inventory | Upgrade every self-managed GitLab CE/EE instance. GitLab.com needs no action. Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 or later need no action. |
| GitLab 19.5.1 | Fixed build | T1190 | Package / Omnibus version | On the 19.5 branch, install 19.5.1 or later. 19.5.0 is vulnerable. |
| GitLab 19.4.3 | Fixed build | T1190 | Package / Omnibus version | On the 19.4 branch, install 19.4.3 or later. 19.4.2 fixed CVE-2026-97229 and is still vulnerable to CVE-2026-110264. |
| GitLab 19.3.6 | Fixed build | T1190 | Package / Omnibus version | On the 19.3 branch, install 19.3.6 or later. 19.3.5 fixed CVE-2026-97229 and is still vulnerable to CVE-2026-110264. |
| GitLab 19.2.9 | Fixed build | T1190 | Package / Omnibus version | On the 19.2 branch, install 19.2.9 or later. 19.2.8 fixed CVE-2026-97229 and is still vulnerable to CVE-2026-110264. |
| GitLab 19.1.9 | Fixed build | T1190 | Package / Omnibus version | On the 19.1 branch, install 19.1.9 or later. There is no 19.1 build that fixes CVE-2026-110264 below 19.1.9. |
| GitLab 19.0.10 | Fixed build | T1190 | Package / Omnibus version | On the 19.0 branch, install 19.0.10 or later. |
| GitLab 18.11.13 | Fixed build | T1190 | Package / Omnibus version | On the 18.11 branch, install 18.11.13 or later. This is the oldest fixed release. |
| GitLab 18.10 and older | No fix on that branch | T1190 | Package / Omnibus version | GitLab 7.0 through 18.10 has no fixed package. Upgrade to 18.11.13 or to a later fixed release (19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1). |
exceptions_json.log Timeout::Error + OtherMarkup + .org | Render-timeout burst | T1190 | /var/log/gitlab/gitlab-rails/exceptions_json.log | Alert when one meta.client_id causes five or more Timeout::Error events with extra.class_name OtherMarkup and extra.file_name ending in .org within 30 minutes. GitLab’s rule name is GitLab Org-mode render timeout burst. |
puma_stderr.log [BUG] with org-ruby or onig_search_gpos | Worker crash | T1190 | /var/log/gitlab/puma/puma_stderr.log | Alert when a [BUG] report also contains org-ruby, headline.rb, or onig_search_gpos. A quiet success does not crash. Absence of this line does not clear the host. |
Parent process puma or sidekiq spawning a shell | Child process | T1059 | Linux EDR / auditd | Alert when a puma or sidekiq process on a GitLab host spawns sh, bash, curl, or wget. The Org-mode path runs as the git user. |
Detection
| Source | Rule | Gap |
|---|---|---|
| GitLab (vendor) | Present — GitLab Org-mode render timeout burst | Five or more Timeout::Error / OtherMarkup / .org events from one client in 30 minutes in exceptions_json.log. A single timeout is not the rule. The request that crashes the worker is a Workhorse 502 and is missing from Rails logs. |
| GitLab (vendor) | Present — GitLab org-ruby or Onigmo native worker crash (CVE-2026-110264 / CVE-2026-93577 / CVE-2026-97229) | [BUG] plus an org-ruby or Onigmo frame in puma_stderr.log. A successful Org-mode exploit can be quiet. |
| Splunk ESCU | None — verified | Web or Application Server Spawning a Shell parents are httpd, apache2, nginx, java, node, and a few others. puma, sidekiq, and ruby are not in that list. No rule names exceptions_json.log or Org-mode. |
| Elastic | Partial — Suspicious Command Execution via Web Server | Linux. A parent whose name matches ruby* and whose command line contains puma, rails, or passenger, spawning bash or sh with -c and a suspicious argument, matches. A system() call that is not a shell -c misses. sidekiq is not a parent in this rule. |
| Sigma | None — verified | No rule in this index names GitLab puma, exceptions_json.log, or Org-mode render timeouts. Web-server child rules are Windows w3wp.exe and httpd.exe. |
Hunt hint: Read the GitLab version before you hunt. If it is below the fixed build for that branch, upgrade first. Then count Timeout::Error lines in exceptions_json.log that also contain OtherMarkup and a .org file name, grouped by meta.client_id. Five or more in 30 minutes is GitLab’s burst. Check puma_stderr.log for [BUG] next to org-ruby. Preserve those logs before you patch. Do not render a crafted .org file to test the bug.
Sources: GitLab 19.5.1 release · Org mode render error burst · Onigmo native worker crash · CERT-EU 2026-019
3. ConnectWise-CloudBackup-SkyKick-2026-10 — Storm-0940 and ARTEX
TL;DR: Microsoft attributes the ConnectWise Cloud Backup compromise to China-state-aligned Storm-0940, using the agentic framework ARTEX. Keep the ConnectWise apps disabled. Hunt service-principal sign-ins and Global Administrator grants from 15 October, and the password spray from 10 October.
What’s New:
- Microsoft’s 21 October post says Storm-0940 used ARTEX after the ConnectWise access. The actor attempted sign-ins to more than 2,250 tenants at 2,900 attempts per minute. @MsftSecIntel posted the same attribution.
- The password spray is a separate wave. From 10–14 October,
144.172.64.99sprayed 327 accounts across eight organizations. Microsoft counted 151,000+ failed logons, peaking on 11 October at 2,900 failures per minute. Microsoft saw no successful authentication, token, Graph call, or directory change from that spray. - Microsoft’s hunt query names three application IDs: Cloud Backup
506e08f9-6e9a-4da4-942b-a099a03644ae, Teams24205314-2b89-4e07-a2a4-579e898a5640, and Graph0de14c77-b9b0-4137-9360-34878a929827. Defender alerts to turn on are “Unusual Microsoft Graph activity associated with Compromised ConnectWise Application” and “Application self-assigned Global Administrator role”. - Microsoft’s IP table groups
144.172.64.128,144.172.64.99, and144.172.64.60as sign-in and Graph activity. Huntress on 19 October tied application sign-ins only to.128and called.99and.60failed logons. Search all three. VPN addresses187.15.88.186,187.15.90.217, and187.15.89.186matter for 15–16 October only.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
App ID 506e08f9-6e9a-4da4-942b-a099a03644ae | ConnectWise Cloud Backup | T1078.004 | Entra sign-in logs / OAuthAppInfo | Keep app 506e08f9-6e9a-4da4-942b-a099a03644ae disabled. Review service-principal sign-ins and Graph calls from 13 October onward. Microsoft’s 21 October hunt query includes this ID. |
App ID 24205314-2b89-4e07-a2a4-579e898a5640 | ConnectWise MS Teams | T1078.004 | Entra sign-in logs | Keep app 24205314-2b89-4e07-a2a4-579e898a5640 disabled. It is the second ID in Microsoft’s 21 October hunt query. |
App ID 0de14c77-b9b0-4137-9360-34878a929827 | ConnectWise MS Graph | T1078.004 | Entra sign-in logs | Keep app 0de14c77-b9b0-4137-9360-34878a929827 disabled. It is the third ID in Microsoft’s 21 October hunt query. |
App ID b78f6a77-d4e5-46fb-87e5-d1648bd02519 | Cloud Management Exchange | T1078.004 | Entra sign-in logs | Keep app b78f6a77-d4e5-46fb-87e5-d1648bd02519 disabled. ConnectWise disabled it on 17 October. It is not in the new three-ID query. Still review it. |
App ID b2b55f5b-7758-4719-8d8f-88ae172e6bdb | Cloud Management SharePoint | T1078.004 | Entra sign-in logs | Keep app b2b55f5b-7758-4719-8d8f-88ae172e6bdb disabled. It is not in the new three-ID query. Still review it. |
App ID 412dcf96-176d-4b3a-a1b0-4981ad66971e | Cloud Management Partner Center | T1078.004 | Entra sign-in logs | Keep app 412dcf96-176d-4b3a-a1b0-4981ad66971e disabled. It is not in the new three-ID query. Still review it. |
App ID 2399d300-6fca-4e6a-a686-399fefe75b83 | Cloud Management general | T1078.004 | Entra sign-in logs | Keep app 2399d300-6fca-4e6a-a686-399fefe75b83 disabled. It is not in the new three-ID query. Still review it. |
IP 144.172.64.99 | Password-spray source | T1110.003 | Entra sign-in logs | Search sign-ins from 144.172.64.99 between 10 and 14 October. Microsoft says that spray had no successful authentication. The same IP is also in the sign-in and Graph table, which conflicts with Huntress. Investigate both readings. |
IP 144.172.64.128 | App sign-in and Graph | T1078.004 | Entra sign-in logs / Graph activity | Alert on service-principal sign-ins and Graph calls from 144.172.64.128 for the ConnectWise app IDs. Huntress and Microsoft both tie application activity to this address. |
IP 144.172.64.60 | Sign-in table entry | T1078.004 | Entra sign-in logs | Search 144.172.64.60. Microsoft lists it with .128 and .99 for sign-ins and Graph. Huntress previously saw failed logons only. |
IP 187.15.88.186 | VPN Graph source | T1078.004 | Entra sign-in logs | Search Graph calls from 187.15.88.186 on 15 and 16 October only. Microsoft says the VPN address is transient. |
IP 187.15.90.217 | VPN Graph source | T1078.004 | Entra sign-in logs | Search Graph calls from 187.15.90.217 on 15 and 16 October only. |
IP 187.15.89.186 | VPN Graph source | T1078.004 | Entra sign-in logs | Search Graph calls from 187.15.89.186 on 15 and 16 October only. |
User-Agent Python-urllib/3.12 | App sign-in agent | T1078.004 | Entra sign-in logs | Alert when a ConnectWise service principal signs in with user agent Python-urllib/3.12. |
User-Agent python-requests/2.31.0 | App sign-in agent | T1078.004 | Entra sign-in logs | Alert when a ConnectWise service principal signs in with user agent python-requests/2.31.0. |
User-Agent python-requests/2.34.2 | App sign-in agent | T1078.004 | Entra sign-in logs | Alert when a ConnectWise service principal signs in with user agent python-requests/2.34.2. This string is new in the 21 October table. |
User-Agent curl/7.88.1 | Spray and app agent | T1110.003 | Entra sign-in logs | Search user agent curl/7.88.1 on the ConnectWise apps and on the October spray. |
User-Agent azure-toolkit/1.0 | App sign-in agent | T1078.004 | Entra sign-in logs | Alert when a ConnectWise service principal signs in with user agent azure-toolkit/1.0. |
Operation Add member to role and role Global Administrator | Role grant | T1098.003 | Entra audit logs | Alert when app 24205314-2b89-4e07-a2a4-579e898a5640 or another ConnectWise app is the actor for Add member to role and the new role is Global Administrator. Remove the grant and the secrets planted in the same window. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — O365 High Privilege Role Granted | Office 365 management activity, operation Add member to role., and the Global Administrator, Exchange Administrator, or SharePoint Administrator role template. It does not name the ConnectWise app IDs. The password spray from 144.172.64.99 does not match. Credential adds are O365 Service Principal New Client Credentials (Update application Certificates and secrets management). |
| Elastic | Partial — Entra ID Service Principal Credentials Created by Unusual User | Azure audit operation Add service principal credentials with outcome success, as a new-terms rule on the app display name and the initiating user. A Global Administrator grant with no new secret misses. The spray IP misses. |
| Sigma | Partial — Added Credentials to Existing Application | Azure audit message Update application - Certificates and secrets management or Update Service principal/Update Application. Role assignment and the spray IP miss. |
| Microsoft Defender | Present — Application self-assigned Global Administrator role | Vendor alert named in the 21 October blog, plus “Unusual Microsoft Graph activity associated with Compromised ConnectWise Application”. These are not in the ESCU, Elastic, or Sigma indexes. |
Hunt hint: In Defender or Entra, list service principals for the seven app IDs above and confirm each one is disabled. Then search sign-in logs from 13 October for those app IDs, the six IP addresses, and the five user agents. Separately, search audit logs for Add member to role where the role name is Global Administrator and the actor is one of those apps. The spray from 144.172.64.99 on 10–14 October had no success in Microsoft’s telemetry. Treat a successful app sign-in from .128 as the incident, and reconcile .99 and .60 against both Microsoft and Huntress before you close them as noise.
Sources: Microsoft Security Blog · MsftSecIntel · MsftSecIntel follow-up · Huntress · Original brief
Status Updates
- PHP2Shell-CVE-2026-109618 / CVE-2026-109619 (PHP): Fixed builds 8.5.12, 8.4.27, 8.3.36, and 8.2.35 shipped on 21 October. PHP 8.1 and older are end of life and get no fix. Exploitation attempts now have two independent origins: Amazon MadPot saw a pre-disclosure attempt on 17 October from
103.216.220.92, and Cloudflare sees attack traffic against its customers. No one has confirmed a successful compromise: Huntress sees no exploitation on partner systems, and Defused Cyber says the public PoCs it tested mostly fail. Talos Snort SIDs 67359 and 67360 are in the Community Ruleset (Talos). Not in KEV. Amazon’s 21 October source IPs (31.223.184.166,37.19.200.5,134.209.159.64,103.114.163.188,95.217.98.37) and Vega’s64.95.12.7are investigation leads, not a block list. Original brief. - CVE-2026-97229 (GitLab): Self-managed 19.2.8, 19.3.5, and 19.4.2 fixed this CVE and are still vulnerable to CVE-2026-110264. Move to 19.2.9, 19.3.6, or 19.4.3, or to the fixed build for your branch in section 2. No new exploitation report for CVE-2026-97229. Original brief.
- CVE-2026-105192 (LMCache): GHSA-w5f2-9q9c-ff4h now lists the fix as 0.5.6. Affected releases are 0.3.9 through 0.5.5. The unauthenticated ZeroMQ pickle listener defaults to TCP 5555. Not in KEV. No exploitation report. Last mentioned.
- Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 are due 2026-10-23. CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, due 2026-10-23, not yet a full section. OS command injection when statistics are enabled (the default) on SiteGuard Server Edition. Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). Download diagnostic information before you patch. KEV catalog · EG Secure.
- Siemens-Software-Center-CVE-2026-110936: KEV due 2026-11-03. No new build or IOC today. Fixed build remains 4.0.9.8. Original brief.
- CVE-2026-102764 (BeyondTrust Remote Support): KEV due 2026-10-19 remains overdue. No new fixed build or IOC today. Original brief.
- CVE-2025-61624 (FortiOS auto-script path traversal): KEV due 2026-10-19 remains overdue. No new IOC today. Original brief.
- CVE-2026-21589 (Atlassian Data Center): KEV due 2026-10-18 remains overdue. Original brief.
- KEV deadlines already passed, no new fix or IOC: CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco Secure Email Gateway) (brief); CVE-2026-105134 (AhsayCBS) (brief); CVE-2026-104935 (Ivanti) and CVE-2026-96951 (Windows Shell) (brief).
- Retired from watch (last update 2026-10-08): FortiBleed-2026-10, tensorlake-npm-0.5.144. No KEV due date and no new fix, IOC set, or exploitation report in 14 days. Today’s FortiWeb and PAN-OS initial-access relays are not this FortiBleed advisory. Last mentioned.
- Watching (no change): CVE-2026-102255 (10-15); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); GhostAction-2026-10 (10-10); CVE-2026-0257 (10-11); CVE-2026-82077 (10-11); CyberXero-2026-10 (10-12); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); CVE-2026-110447 (10-15); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20).