CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution, with AWS telemetry reportedly detecting an exploitation attempt four days before public disclosure. Active malicious exploitation and precautionary service shutdowns have since been reported.
Public proofs of concept raise the prospect of broader attacks against affected PHP deployments, including PHP-FPM, php-cgi, Apache mod_php, FrankenPHP and LiteSpeed. Administrators should apply the emergency fixes rather than rely on configuration assumptions or wait for further evidence of targeting.
Pre-disclosure activity, reported malicious use and available exploit code leave little margin for delay. Internet-facing PHP systems warrant immediate patching and investigation for compromise, particularly where exposed services could provide direct server access.
Editorial: Recommended Actions
01
PRIORITY
Patch internet-facing PHP systems immediately and investigate them for compromise. Upgrade PHP 8.2 to 8.2.35 or later, PHP 8.3 to 8.3.36 or later, and PHP 8.4 to 8.4.27 or later where applicable. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution; AWS telemetry reportedly detected an exploitation attempt before disclosure, active malicious exploitation has been reported, and a working exploit is available.
02
PRIORITY
Remediate vulnerable Arista VeloCloud Orchestrator deployments and investigate encoded requests, internal-service access, unusual request volume, and activity involving 38.54.50.151 or 74.82.197.86. Prioritize on-premises deployments, which are vulnerable by default; affected hosted and dedicated versions have been patched. The actively exploited SQL injection flaw lets an Enterprise Read Only user escalate privileges and impersonate a local superuser operator.
03
PRIORITY
Upgrade Collabora Online’s Nextcloud Built-in CODE Server to version 26.4.303 or later and examine affected servers for PHP web shells and access to stored credentials or cryptocurrency wallets. CVE-2026-110447 is in CISA’s KEV catalog and enables unauthenticated remote command execution when the local CODE server is stopped; observed attacks have already deployed web shells and searched compromised systems for valuable secrets.
04
PRIORITY
Deploy Microsoft’s patch for Windows Shell CVE-2026-96951 across affected Windows systems without delay. CISA added the flaw to its KEV catalog after exploitation in the wild. The vulnerability bypasses Mark of the Web protections and weakens warnings from SmartScreen and Microsoft Office Protected View, reducing safeguards that users and security teams rely on when handling downloaded content.
05
PRIORITY
Remove LiteLLM 1.107.0 packages and affected container images, rotate potentially exposed credentials, and investigate deployments for suspicious activity. The compromised release includes all seven 1.107.0 PyPI wheels and Docker Hub tags v1.107.0, latest, main-latest, and main-stable, as well as affected GHCR images. An attacker used an exposed, unrevoked Agent Platform master key to obtain privileged GitHub tokens and hijack LiteLLM’s release pipeline.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents19Messages27mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_