CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Attackers are exploiting two critical PHP remote-code-execution flaws and a four-bug Plex Media Server chain, while a compromised LiteLLM release pipeline pushed credential-stealing malware through official package and container channels. The immediate exposure spans internet-facing web servers, media servers, developer systems and CI/CD environments.
PHP2Shell affects PHP 5.4 and later, and administrators must patch PHP itself rather than rely on application or plugin updates. Amazon detected an exploitation attempt four days before planned disclosure; several organizations took websites offline as a precaution, although no successful compromise has been confirmed.
Rapid7 found that attackers exploited high-severity vulnerabilities three days after disclosure on average. That window is tightening further as tools such as ARTEX automate reconnaissance, vulnerability discovery, probing and exploitation; investigators found the framework on infrastructure associated with attacks in Japan and South Korea.
Editorial: Recommended Actions
01
PRIORITY
Upgrade PHP itself immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as appropriate, then restart PHP processes; updating WordPress, Drupal, Joomla, Magento, or plugins alone does not remediate CVE-2026-109618 and CVE-2026-109619. Prioritize internet-facing systems and Apache mod_php deployments, which face the highest demonstrated risk. Attackers are targeting both PHP2Shell flaws, and a public proof of concept can enable unauthenticated remote code execution.
02
PRIORITY
Remove LiteLLM 1.107.0 and affected official container tags, revert to version 1.106.2, and treat every system that installed or ran them as breached. Investigate for the persistent loader and second-stage Python payload, then rotate exposed AWS, Azure, GitHub, and other credentials. The compromised PyPI package and official container images carried an infostealer and remote-access trojan, and attackers were observed testing stolen AWS credentials.
03
PRIORITY
Upgrade every Ivanti Connect Secure appliance running a version before 25.1.3 without delay. UTA0576 is actively exploiting CVE-2026-104935 and has chained the authentication bypass with file-write and privilege-escalation flaws to execute commands as root. Federal agencies must also meet CISA’s three-day remediation deadline for the Known Exploited Vulnerabilities catalog entry.
04
PRIORITY
Update internet-exposed Plex Media Server instances to version 1.43.3.10861 or later and complete CISA-required remediation by October 23 where applicable. Attackers are actively chaining four Plex2Shell vulnerabilities to steal administrator tokens and execute elevated code; observed payloads include cryptocurrency miners and proxy malware. Systems running earlier Plex versions should receive immediate priority.
05
PRIORITY
Remove the affected eMudhra trust chains and update trust stores on endpoints, containers, virtual machines, embedded devices, IoT systems, and applications that maintain independent certificate stores. Eight intermediate CA private keys were generated with only 3–8 bytes of entropy and could be recovered rapidly, creating a risk of fraudulent certificates for arbitrary domains or code-signing abuse even though vendors blocked the certificates and eMudhra revoked them.
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_