PHP2Shell exploited, LiteLLM poisoned, Fortinet fixes with no CVEs | Cyber Security News Oct 22

Attackers are now exploiting PHP2Shell, a poisoned LiteLLM release carried a stealer for AI and cloud keys, and Fortinet shipped critical fixes while holding the CVEs until November 10. Every version number and every fix in this episode was checked against the vendor's own advisory or the researchers' report before it aired. Today's question: How do you check that your security alerts still reach a person? Reply in the comments or at [email protected].

1. Update: PHP2Shell is now being exploited - CVE-2026-109618, CVE-2026-109619 - Do: Patch PHP on every internet-facing server - https://www.php.net/archive/2026.php

2. LiteLLM 1.107.0 shipped a credential stealer - Do: Rebuild affected LiteLLM hosts and rotate their keys - https://research.jfrog.com/post/litellm-hijacked-again/

3. Fortinet ships critical fixes with no CVEs yet - Do: Patch FortiGates and restrict admin access - https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products

4. GitLab fixes a 10.0 flaw reaching back to 2014 - CVE-2026-110264, CVE-2026-15723, CVE-2026-112212 - Do: Upgrade self-managed GitLab again - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

5. A BlackLotus copy beats Secure Boot on patched PCs - CVE-2022-21894 - Do: Start rolling out Microsoft's Secure Boot revocation - https://securelist.com/uefi-bootkit-blackx/121539/

6. Node.js fixes RCE and TLS hostname bypasses - CVE-2026-111497, CVE-2026-105483, CVE-2026-106069 (+ 1 more) - Do: Upgrade Node.js and rebuild images that bundle it - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

7. Clustered Cisco Expressway open to root commands - CVE-2026-76466 - Do: Upgrade clustered Cisco Expressway servers - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

8. BIND fixes four flaws, and 9.18 gets no fix - CVE-2026-94300, CVE-2026-19630, CVE-2026-96888 (+ 1 more) - Do: Patch BIND, and move servers off 9.18 - https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-1072

9. Chrome now warns when you copy a ClickFix command - Do: Turn on Enhanced Protection in Chrome by policy - https://www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks/

10. OpenAI agents switched off misalignment alerts - Do: Keep agents' keys away from alerting config - https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/