SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefThursday, October 22, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Critical PHP2Shell Zero-Day Exploited Pre-Disclosure for Unauthenticated RCE | CRITICAL |
|
5 C2 IPs | 52 OTX IOCs | 40 ARTICLES |
|
■ ANALYST TLDR Emergency patches have been released for two critical zero-day vulnerabilities in the PHP core runtime, collectively named PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which enable unauthenticated remote code execution and saw exploitation attempts prior to public disclosure. Simultaneously, GitLab patched a CVSS 10.0 unauthenticated RCE flaw spanning 12 years of software releases, while supply chain attacks compromised both the LiteLLM Python package and ConnectWise environments via nation-state actor Storm-0940. Additional threats include active Plex Media Server exploitation (Plex2Shell), surging ClickFix attacks targeted by Chrome defenses, and post-quantum cryptography adoption by Lazarus Group. |
|
■ CRITICAL STORIES Critical PHP2Shell RCE Flaws (CVE-2026-109618, CVE-2026-109619) Exploited in Wild Pre-disclosure exploitation of core PHP runtime allows unauthenticated RCE, impacting nearly 70% of global web servers and prompting emergency patching or WAF mitigation. |
Critical GitLab Flaw (CVSS 10.0) Enables Unauthenticated RCE Across 12 Years of Releases Allows unauthenticated remote code execution on self-managed GitLab instances dating back to version 7.0 released in 2014. |
LiteLLM Python Package Compromised in Software Supply Chain Attack Compromised updates delivered credential stealers and backdoors to downstream AI applications using the LiteLLM dependency. |
Storm-0940 Abuses ConnectWise and ARTEX Agentic AI in M365 Supply Chain Compromise Nation-state threat actor leveraged agentic AI to accelerate supply chain compromise and steal credentials across Microsoft 365 environments. |
|
■ CVEs IDENTIFIED CVE-2026-109618 PHP Core Runtime — Unauthenticated Remote Code Execution (PHP2Shell) |
CVE-2026-109619 PHP Core Runtime — Unauthenticated Remote Code Execution (PHP2Shell) |
[CVE-TBD] GitLab Self-Managed — Unauthenticated Remote Code Execution (v7.0+) |
[CVE-TBD] Plex Media Server — Vulnerability chain allowing unauthenticated server breach (Plex2Shell) |
|
■ THREAT ACTORS Lazarus Group | APT (North Korea) |
Utilizing post-quantum cryptographic mechanisms to secure malicious payload delivery. |
Used ARTEX agentic AI to execute supply chain attack via ConnectWise to breach Microsoft 365. |
Bronze Sandcastle | APT (China-aligned) |
Abused Sandboxie DLL sideloading to deploy backdoors across Asia and Africa. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | PHP2Shell zero-day exploitation and GitLab unauthenticated RCE targeting web servers. |
| T1195.001 | | Supply Chain Compromise: Compromise Software Dependencies | Compromise of LiteLLM package on PyPI and ConnectWise integration abuse. |
| T1574.002 | | Hijack Execution Flow: DLL Side-Loading | Bronze Sandcastle abusing Sandboxie binaries for payload side-loading. |
| T1204.002 | | User Execution: Malicious Command | ClickFix campaigns tricking users into executing clipboard terminal commands. |
| T1566.002 | | Phishing: Spearphishing Link | Fake Amazon Music x YouTube creator portals trapping Google logins. |
| T1573 | | Encrypted Channel | Lazarus Group using post-quantum cryptography to obfuscate payload delivery. |
|
■ PATCH PRIORITY PHP Core Runtime — CVE-2026-109618 & CVE-2026-109619 allow unauthenticated RCE and are actively exploited in the wild — AWS |
GitLab Self-Managed — CVSS 10.0 unauthenticated RCE flaw impacting all releases since version 7.0 — The Hacker News |
Plex Media Server — Active exploitation chaining four flaws to breach servers (Plex2Shell) — CISA |
LiteLLM Python Package — Supply chain compromise deploying credential stealers and backdoors — The Hacker News |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately upgrade PHP installations to patched versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate PHP2Shell (CVE-2026-109618, CVE-2026-109619), or apply AWS WAF / Cloud Armor rules. |
| 2 | [P1] Apply urgent security patches to all self-managed GitLab servers to eliminate the CVSS 10.0 unauthenticated RCE vulnerability. |
| 3 | [P1] Audit and purge vulnerable LiteLLM package versions from Python environments and rotate potentially exposed credentials. |
| 4 | [P2] Update Google Chrome to the latest build to address 353 memory corruption bugs and enforce Gemini-powered ClickFix protections. |
| 5 | [P2] Patch all deployed instances of Plex Media Server to stop active vulnerability chaining attacks (Plex2Shell). |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |