If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. If anything in your estate installed LiteLLM 1.107.0, treat that machine as compromised and rotate every credential it could reach. Exploit attempts against PHP were seen before the patches were public, so a clean scan today is the start of an investigation, not the end of one.
What happened
PHP2Shell is a pair of critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and reported on 21 October, according to Business Today’s round-up of October’s security alerts. The UK’s National Cyber Security Centre says they can allow unauthenticated code execution on all PHP installations serving web requests. Researchers from Wiz, Calif and OpenAI found them using AI. Wiz’s write-up describes them as affecting 70% of the internet, and The State of AI’s explainer reports that every version back to PHP 5.4 is affected. Wiz Research says the bugs had been in the code for more than a decade.
The disclosure did not go cleanly. As 404 Media’s reporting on PHP2Shell details, Cloudflare CEO Matthew Prince posted that his network saw thousands of exploit attempts in the 10 hours before the announcement, rising to millions afterwards. Amazon said it saw exploit attempts before disclosure. Chainguard was criticised, including by the PHP Foundation, for posting fixes hours ahead of the official disclosure, and its CEO Dan Lorenc said his team found the same bugs independently by asking a frontier model to find bad vulnerabilities in PHP.
The same day, LiteLLM reported that its release pipeline had been compromised and a malicious version published to public package registries. SecurityToday reports that all 1.107.0 wheel packages on PyPI contained a credential stealer and a loader for external code; the project’s GitHub advisory notes the Docker latest and main-stable tags were also removed. The State of AI says the release stole passwords, cloud logins and AI account keys, was live for about two hours, and was LiteLLM’s second compromise this year. For a gateway library that sits between your applications and your model providers, that is close to the worst possible target: it holds the keys by design.
The “Black October” label comes from an X post by the AISafetyMemes account at 03:42 UTC on 22 October, calling the preceding 48 hours the worst in cybersecurity history. SecurityToday’s reading is more sober: the surge was mainly in disclosures, and many of the underlying attacks on that list began weeks or months earlier.
What it means
Separate the noise from the signal. 404 Media notes that most PHP2Shell impact so far has been proactive patching and sites going offline rather than widespread exploitation, and that many LLM-written exploits circulating online do not work. Trail of Bits’ Dan Guido said a colleague built a working exploit in a day with Codex, drawing on about ten years of security research. Expertise still matters; AI makes it go further.
The signal is timing. Rapid7, cited by SecurityToday, recorded an average of three days between disclosure and exploitation of severe vulnerabilities in the third quarter. Prince’s figures put exploitation attempts in hours. A monthly patch window plus a change board was built for a slower threat model. Defenders have the same models, but attackers have no release calendar. As The State of AI puts it, AI is shortening the time to find a hole and write a fix, not the time it takes an organisation to install it.
Why it matters for Irish, UK and EU businesses
The UK NCSC has advised organisations since 1 May to prepare for a “patch wave”, and its 21 October PHP2Shell warning recommends taking unpatched systems offline if necessary. Business Today, citing Reuters, reports that government, educational and hospital websites in several European countries went offline as a precaution, and SecurityToday reports that authorities in Germany, Austria and the Netherlands responded too. If regulators are telling you to pull systems rather than leave them exposed, your continuity plan should already name who can make that call out of hours. Our AI security and compliance guide for EU firms covers how to fold this into governance.
What to do now
- Inventory every PHP runtime: servers, containers, base images, managed hosting, forgotten campaign sites. Upgrade to a fixed version or get your host to confirm in writing. Anything you cannot patch, take offline.
- Search lockfiles, requirements files, container images and CI caches for litellm 1.107.0, including images pulled from the latest or main-stable Docker tags around 21 October. Include developer laptops and notebooks.
- For any hit, rotate everything that machine could reach: cloud credentials, model-provider keys, Git tokens, database passwords, environment secrets. Then review provider logs for use of those keys.
- Pin critical dependencies by hash, hold new releases briefly before they reach production, and put expiry dates on secrets. Zeabur’s admin tokens, per SecurityToday, never expired.
If LiteLLM sits in your stack, it is also worth revisiting how much it can see. Our guide to LLM integration in production covers scoping gateway credentials so one poisoned package cannot empty every account. The useful question for your team this week is not whether you were hit, but how many hours it would take you to find out.
Frequently Asked Questions
Which PHP versions fix PHP2Shell?
According to SecurityToday and The State of AI, versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the flaws. If you are on something older, contact your host or take the system offline, as the UK NCSC recommends for unpatched systems.
What should I do if we installed LiteLLM 1.107.0?
Assume everything on that machine was taken. The State of AI advises changing every password and key the machine could reach; in practice that means cloud credentials, AI provider keys, Git tokens and stored secrets, followed by a review of provider logs.
Was PHP2Shell widely exploited?
404 Media reported that most impact so far has come from proactive patching and sites going offline, not widespread exploitation, though Cloudflare and Amazon both saw exploit attempts before disclosure.
Want this working in your business?
D3X Solutions LABS builds AI agents and automation that pay back fast. Set up a free 30-minute call and we will map your first win together.
Get in touch
