This week in security: k0t edge attacks, PHP2Shell and LiteLLM
Edge devices, developer tooling and exploited vulnerabilities dominated the week: a k0t campaign hit exposed Fortinet and Palo Alto devices, two PHP remote code execution flaws have public proof of concept, and a leaked key led to a malicious LiteLLM release. CISA also added eight entries to its Known Exploited Vulnerabilities (KEV) catalog, several with deadlines that have already passed or fall on 26 October.
Top stories
- k0t campaign breaches Fortinet and Palo Alto edge devices: a Group-IB and NyxLab report details attacks on exposed firewalls and VPNs, so check edge devices for the listed flaws and tools. Our second write-up covers the attack chain and the 70,000+ credentials involved.
- PHP2Shell: CVE-2026-109618 and CVE-2026-109619: two critical PHP RCE flaws with a public proof of concept and live attacks. Check PHP and PAN-OS exposure.
- LiteLLM supply chain attack traced to leaked master key: a key committed to a public GitHub repo in May was never revoked, letting an attacker publish a malicious release to PyPI. Check your installs.
- Palo Alto PAN-OS GlobalProtect flaw exploited by ransomware (CVE-2026-0257): ransomware groups use it to bypass MFA, and it is in CISA KEV. Hunt for rogue VPN sessions.
- Node.js Brotli RCE demonstrated on standard build (CVE-2026-111497): Imperva showed code execution on an official build via a crafted Brotli stream. Container images with bundled Node are easy to forget.
- Cisco Snort 3 hardening update fixes critical CVE-2026-20043: a CVSS 9.0 out-of-bounds write affecting FTD, Meraki MX and more.
- Railway breach and OpenCode Console breach: both involve stored secrets (environment variables and saved AI provider keys), so rotate credentials and review logs and billing.
- Capcom data breach exposes 11.7 million CAPCOM ID accounts: Capcom confirmed the exposure of emails; expect credential-stuffing and phishing follow-ups.
- Quest Diagnostics breach hits Quanum lab platform: the company says attackers accessed some patient records.
Newly exploited vulnerabilities
CISA added these entries to KEV this week. Due dates are the federal remediation deadlines.
| CVE | Vendor and product | Issue | Due |
|---|---|---|---|
| CVE-2026-114625 | Arista VeloCloud Orchestrator | SQL injection | 2026-10-26 |
| CVE-2026-110447 | Collabora Online built-in CODE Server | OS command injection | 2026-10-26 |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | OS command injection | 2026-10-23 |
| CVE-2026-96656 | Plex Media Server | External control of file name or path | 2026-10-23 |
| CVE-2026-96655 | Plex Media Server | Server-side request forgery | 2026-11-03 |
| CVE-2026-96654 | Plex Media Server | Improper neutralization of encoded URI schemes | 2026-10-23 |
| CVE-2026-96652 | Plex Media Server | Server-side request forgery | 2026-11-03 |
| CVE-2026-110936 | Siemens Software Center | Uncontrolled search path element | 2026-11-03 |
Details are in our posts on Arista VeloCloud, Collabora CODE Server, SiteGuard, Plex Media Server and Siemens Software Center. Source: CISA KEV catalog.
Why this matters
This is our analysis, not new reporting. Firewalls, VPN gateways and orchestration software sit at the network edge and hold privileged access, so one exploited flaw there can expose credentials and internal systems. The week’s secret-related incidents (a leaked master key, stored environment variables and saved provider keys) point to the same lesson: exposed credentials stay useful until someone revokes them.
What to prioritise next week
- Treat anything in CISA KEV as patch-within-hours work. The Arista and Collabora deadlines fall on 26 October, and the Plex and SiteGuard deadlines have already passed.
- Check exposed FortiGate and GlobalProtect devices against the k0t report, and hunt for rogue VPN sessions related to CVE-2026-0257.
- Inventory PHP and Node.js, including copies bundled in container images, then apply the fixes for CVE-2026-109618, CVE-2026-109619 and CVE-2026-111497.
- Audit LiteLLM installs and revoke any long-lived keys that were ever committed to a repository.
- Rotate secrets held on Railway and OpenCode Console, and review logs and provider billing for unexpected use.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
All stories this week
- Microsoft Teams adds AI phishing detection for external chats
- State Bank of India customer PII leak reported by Dark Reading
- SBOMs explained: what a software bill of materials is and how to use one
- CenterPoint Energy and Burger King Japan data breaches: what to check
- ETS SFTP breach exposes California student data via stolen logins
- Ransomware gangs now threaten employees’ families, survey finds
