Weekly Threat Intel Report — 2026-W43: 19-25 October 2026

TL;DR

Two critical PHP core remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, leaked before a patch was available. Amazon Threat Intelligence reported in-the-wild exploitation beginning four days before fixes shipped. The pair, nicknamed PHP2Shell, affect roughly 70% of websites that run outdated PHP cores.

Microsoft attributed a ConnectWise supply chain compromise to Storm-0940, a China-linked actor that used an agentic AI penetration-testing tool called ARTEX to sweep OAuth tokens across more than 2,200 Microsoft 365 tenants. Sophos independently documented the ConnectWise Cloud Backup Entra application being abused for cross-tenant Microsoft Graph token requests.

The LiteLLM 1.107.0 PyPI package and Docker images were trojanized to steal credentials and secrets via Python startup hooks. Arista patched an exploited VeloCloud Orchestrator zero-day. HPE patched eight maximum-severity ArubaOS flaws. Qilin and INC Ransom affiliates were observed exploiting PAN-OS CVE-2026-0257. KrebsOnSecurity reported that U.S. federal investigators suspect executives at two ransom negotiation firms maintained operational relationships with ShinyHunters.

Notable Activity by Actor

Storm-0940 and ARTEX (ConnectWise supply chain)

Microsoft Threat Intelligence attributed a large-scale ConnectWise supply chain compromise to Storm-0940, a China-linked actor. The campaign used an agentic AI tool branded ARTEX to automate reconnaissance and action across more than 2,200 downstream Microsoft 365 tenants. Sophos documented the mechanic from the tenant side: the ConnectWise Cloud Backup application identity in Entra ID was used to request Microsoft Graph tokens across consenting tenants in an automated token sweep. ConnectWise disabled the affected Cloud Backup service while investigating downstream impact. The combination of vendor identity abuse and automation is the significant element. Any tenant that previously granted consent to the vendor application was reachable without further interaction.

Qilin and INC Ransom (PAN-OS exploitation)

Unit 42 updated its advisory on CVE-2026-0257 in PAN-OS, naming two ransomware operators observed exploiting the flaw for initial access: Spikey Scorpius (Qilin) and Tarnished Scorpius (INC Ransom). Perimeter firewall exploitation shortens the path to domain compromise and is consistent with both groups' prior reliance on edge-device CVEs.

ShinyHunters (negotiator link investigation)

KrebsOnSecurity reported that U.S. federal investigators pursuing ShinyHunters, following the group's theft of FBI data, have identified executives at two ransom negotiation firms with unusually close operational ties to the actor. Sources indicated one U.S.-based executive may have helped operate aspects of ShinyHunters' extortion infrastructure. If confirmed, the case would show the operational blurring between incident response adjacent businesses and the extortion ecosystem.

GlassWorm (OVHcloud GitHub compromise)

Dark Reading reported that attackers tied to the GlassWorm cluster used a previously compromised developer GitHub account associated with OVHcloud to push malicious code to downstream users. The compromise of the developer identity occurred months before the push, reinforcing the long dwell time attainable through developer account takeovers.

Emerging Threats

PHP2Shell: CVE-2026-109618 and CVE-2026-109619

Two critical remote code execution vulnerabilities in PHP core were disclosed before a patch was available. Multiple vendors issued advisories within hours, including Unit 42, Cisco Talos, Huntress, and the UK NCSC. Amazon Threat Intelligence stated exploitation attempts began four days before patches shipped. Reports described the installed PHP base as roughly 70% of all websites, though CrowdStrike and other researchers argued that weaponization constraints will likely limit the realistic blast radius, and The Record noted analysts walking back some of the earliest severity framing. The PHP project also issued mitigation guidance for a related RCE affecting non-default configurations that remains unpatched. Patch quickly and apply the recommended configuration mitigations; monitor web shell drop locations and outbound connections from PHP-FPM worker processes.

LiteLLM 1.107.0 supply chain compromise

Microsoft Threat Intelligence and BleepingComputer reported that the LiteLLM 1.107.0 release pipeline was compromised. The published PyPI package and Docker images contained Python startup hooks that stole credentials, secrets, and environment variables, and loaded additional code remotely. Any CI/CD system or runtime that pulled 1.107.0 should be considered potentially exposed; rotate secrets accessible to those environments, pin to known-good versions, and audit outbound connections from the affected processes.

BlackX UEFI bootkit

BleepingComputer reported a new UEFI bootkit, BlackX, deployed in an espionage campaign in early 2026. BlackX exploits the old Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and load a driver designed to interfere with Kaspersky and Avast agents. Organizations relying on Secure Boot as a trust anchor should verify revocation lists are current and that firmware updates addressing Baton Drop have been applied.

Arista VeloCloud Orchestrator zero-day

Arista Networks patched a zero-day in VeloCloud Orchestrator On-Prem deployments that was exploited in the wild. SD-WAN control planes are high-value targets because they often reach into branch and site networks. Apply the patch and review orchestrator access logs.

HPE ArubaOS: eight max-severity flaws

HPE released updates for 72 ArubaOS vulnerabilities, including eight maximum-severity authentication bypass and RCE issues. Wireless controller compromise has lateral-movement implications across every attached network segment.

eMudhra intermediate CA compromise

Unit 42 reported that eight eMudhra intermediate CA private keys were compromised, creating risk of unauthorized TLS signing and man-in-the-middle interception. Inventory any PKI dependencies on eMudhra intermediates and follow Unit 42's containment guidance.

ClickFix via Windows finger utility

Dark Reading reported a ClickFix campaign using poisoned Google search results tied to Amazon queries. The chain invokes the decades-old Windows finger utility to launch a CAPTCHA prompt and ultimately install Lumma stealer. Blocking or alerting on finger.exe execution from user sessions is a cheap, high-signal detection.

Infostealer targeting AI developer tooling

Check Point Research described an infostealer with dedicated collection routines for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside standard browser credential and wallet theft. Developer workstations with AI tool credentials now hold access tokens that reach into source code, cloud infrastructure, and model APIs.

Data breaches of note

Quest Diagnostics confirmed a breach of its Quanum LSM system exposing patient records. Capcom confirmed exposure of 11.7 million CAPCOM ID accounts. Railway urged developers to rotate secrets after suspicious activity on systems storing customer environment variables.

Defender Takeaways

• Patch PHP to the fixed versions for CVE-2026-109618 and CVE-2026-109619, and apply the project's configuration mitigation for the unpatched related RCE. Hunt for web shells and anomalous outbound connections from PHP worker processes.
• Review all third-party Entra ID application consents, including administrator-granted scopes to vendor applications. The ConnectWise Cloud Backup case shows the blast radius when a vendor application identity is abused.
• Treat any environment that pulled LiteLLM 1.107.0 as exposed. Rotate credentials and tokens reachable from affected runtimes, and audit outbound traffic from the install window.
• Patch Arista VeloCloud Orchestrator and HPE ArubaOS now. Both affect devices that typically have broad network reach.
• Validate PAN-OS mitigations for CVE-2026-0257. Qilin and INC Ransom are actively exploiting this vector.
• Monitor for finger.exe execution from user sessions and poisoned-search ClickFix patterns delivering Lumma.
• Inventory PKI dependencies on eMudhra intermediates and prepare for pinning or distrust decisions.
• Treat developer AI tool credentials as privileged. Scope and rotate tokens for Copilot, Cursor, Claude, and similar as you would cloud admin credentials.

Sources

• Unit 42, Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20): https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
• Unit 42, Threat Brief: Critical Vulnerabilities in PHP (Updated October 23): https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
• Unit 42, EMudhra Intermediate CA Certificates Compromised: https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/
• Microsoft Threat Intelligence, AI-driven nation-state campaign using ARTEX enables supply chain compromise: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
• Microsoft Threat Intelligence, Inside the LiteLLM 1.107.0 supply chain compromise: https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/
• Sophos, ConnectWise Cloud Backup application abused in cross-tenant token sweep: https://www.sophos.com/en-us/blog/connectwise-cloud-backup-application-abused-in-token-sweep
• Cisco Talos, Two critical RCEs in PHP core: https://blog.talosintelligence.com/two-critical-rces-in-php-core/
• CrowdStrike, Obstacles to Weaponizing PHP2Shell: https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/
• Huntress, Rapid Response: php2shell: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
• UK NCSC, Critical security issue affecting PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
• KrebsOnSecurity, Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site: https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/
• KrebsOnSecurity, Widespread PHP Flaw May Cause Many Site Outages Today: https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/
• BleepingComputer, LiteLLM release pipeline hacked: https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/
• BleepingComputer, Amazon says PHP2Shell exploitation began 4 days before patches: https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
• BleepingComputer, Arista patches new VeloCloud Orchestrator zero-day: https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
• BleepingComputer, HPE patches eight max severity ArubaOS flaws: https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
• BleepingComputer, BlackX UEFI bootkit exploits Baton Drop: https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
• BleepingComputer, Quest Diagnostics confirms data breach: https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/
• BleepingComputer, Capcom confirms data breach affecting 11.7 million accounts: https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/
• BleepingComputer, Railway warns devs to rotate secrets: https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/
• Dark Reading, Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack: https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
• Dark Reading, ConnectWise Disables Cloud Backups: https://www.darkreading.com/identity-access-management-security/connectwise-disables-cloud-backups-downstream-msps
• Dark Reading, OVHcloud GitHub Compromise Tied to GlassWorm: https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-compromise-glassworm-threat-actors
• Dark Reading, Decades-Old Windows Utility Powers Modern ClickFix Attack: https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
• Check Point Research, Infostealer riding the AI Train: https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
• The Record, Reports of PHP bug exploitation attempts grow: https://therecord.media/php-php2shell-exploitation-attempts-pocs
• The Record, Quest Diagnostics warns of potential data theft: https://therecord.media/quest-diagnostics-network-intrusion