Afternoon Review in IT Security — October 26, 2026

The cybersecurity landscape continues to face mounting pressure from supply-chain vulnerabilities and active exploitation campaigns. Today's threat intelligence reveals critical developments in AI tool security, PHP application vulnerabilities, and GitHub Actions attack surfaces that demand immediate attention from organizations across the technology sector.

LiteLLM Supply-Chain Attack Impacts Tens of Thousands of Users

LiteLLM, a widely adopted open-source tool used by artificial intelligence developers, has disclosed a significant supply-chain attack stemming from an accidentally exposed API key. The unrevoked key, which was exposed in May 2026, enabled attackers to conduct a supply-chain attack affecting tens of thousands of users in the previous week. The compromised LiteLLM v1.107.0 package represents a critical vector for malware distribution within the AI development community. Source: Popular AI tool LiteLLM says unrevoked key allowed hackers to target users

This incident underscores the persistent risk of credential management failures in open-source ecosystems. Organizations relying on LiteLLM should audit their deployment versions and assess whether they have received updates addressing this vulnerability.

PHP2Shell Critical Vulnerabilities Actively Exploited in the Wild

Two critical remote code execution vulnerabilities affecting PHP applications have entered active exploitation. CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, represent a severe threat to Apache and PHP-based infrastructure. Source: PHP2Shell security flaws now sucessfully exploited in the wild

The threat has escalated beyond reconnaissance activities, with attackers successfully establishing working shells against target systems. On October 24, 2026, attackers leveraged the PHP2Shell vulnerabilities to launch 35 successful shells from two distinct IP addresses during honeypot operations. Source: PHP2Shell Exploitation Moves From Probes to Working Shells

The progression from probing attempts to fully functional remote shells indicates attackers have matured their exploitation techniques and are actively targeting production environments. Organizations operating PHP-based applications must prioritize patching these vulnerabilities immediately to prevent unauthorized system access.

GitHub Actions Remains Vulnerable to Pull Request Target Attacks

GitHub's 2026 security improvements to Actions have reduced the attack surface for pull_request_target exploits, yet residual vulnerabilities persist. Source: The Pwn Request Reckoning: What Still Works Against GitHub Actions

Despite platform-level mitigations, attackers continue to identify and exploit weaknesses in workflow configurations. Organizations utilizing GitHub Actions must conduct thorough audits of their CI/CD pipelines to identify and remediate remaining attack vectors that could be leveraged through malicious pull requests.

As threats continue to evolve across open-source ecosystems, cloud platforms, and application frameworks, organizations must maintain vigilant monitoring and rapid patching practices to defend against active exploitation campaigns.