LiteLLM supply-chain attack and critical PHP CVEs drive widespread exploitation

1. Executive summary

LiteLLM, an open-source AI gateway, confirmed on 21 October 2026 that stolen developer tokens were used to publish a malicious release, version 1.107.0, and matching Docker images built to steal cloud credentials and AI service secrets; the attackers were subsequently observed testing stolen AWS credentials. In the same week, exploitation attempts against PHP use-after-free flaws CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2, both EPSS 100%, neither in CISA KEV) rose from thousands to millions per day, and roughly 97.5% of publicly visible PHP instances showed no patched version as of 23 October. Separately, CVE-2026-114625 in on-premises Arista VeloCloud Orchestrator (CVSS 9.4, CWE-89, in CISA KEV since 2026-10-23) has been exploited to let read-only authenticated users reach operator-level permissions. For EMEA financial services the immediate exposure is credential theft from AI gateway deployments that hold cloud and model-provider keys, and internet-facing PHP estates that have not been patched.

2. Regulatory framing

3. Technical analysis & attack chain

The LiteLLM compromise is the only item in this report with a documented intrusion sequence. The PHP and VeloCloud items are vulnerability exploitation at scale, and the report gives no post-exploitation detail for either.

LiteLLM supply-chain compromise, confirmed steps:

1. Attackers obtained developer tokens with publish rights to the LiteLLM project.
2. On 21 October 2026 they used those tokens to publish malicious packages and Docker images, including version 1.107.0.
3. The malicious 1.107.0 release was built to steal cloud credentials and AI service secrets from the environment in which the gateway runs.
4. Attackers then tested the stolen AWS credentials.

The report does not name the registry paths, the malicious package filenames, the Docker image tags beyond the 1.107.0 version, the exfiltration endpoint, or the persistence mechanism. It does not say whether the malicious release was yanked, how long it was available, or whether the project rotated its tokens. Those gaps matter: a firm that pulled 1.107.0 needs the image digest and the package hash to confirm what it actually ran, and neither is in this report. Treat the LiteLLM item as single-sourced to Check Point's weekly bulletin until the LiteLLM project's own advisory is obtained.

PHP CVE-2026-109618 and CVE-2026-109619:

Both are rated CVSS 9.2 critical, both are classified CWE-416 (use after free) with CWE-755, both carry an EPSS of 100%, and neither is in CISA KEV. The report describes them as enabling remote code execution and records exploitation attempts climbing from thousands to millions after disclosure. It gives no affected PHP version range, no vulnerable function or extension, and no proof-of-concept detail. The 97.5% unpatched figure covers publicly visible PHP instances as of 23 October and is a scan of internet-facing systems, not an estimate of enterprise estate exposure. Check Point IPS carries a signature covering both CVEs; the report also lists a third identifier, CVE-2026-115560, inside the same IPS signature name, and that CVE does not appear anywhere else in the report or in NVD data supplied here. Do not treat CVE-2026-115560 as a confirmed separate vulnerability.

GitLab CVE-2026-110264:

CVSS 10.0 critical, CWE-190 integer overflow, EPSS 1%, not in CISA KEV. The report says an unauthenticated attacker can execute arbitrary code remotely on affected GitLab Community and Enterprise servers, and that versions before 18.11.13 plus several 19.x releases are affected. It does not enumerate which 19.x releases. The EPSS of 1% against a CVSS of 10.0 is the notable feature here: the flaw is severe but there is no evidence of exploitation in the wild, so it belongs in the normal patch cycle rather than an emergency.

Arista VeloCloud Orchestrator CVE-2026-114625:

CVSS 9.4 critical, CWE-89 SQL injection, EPSS 1%, in CISA KEV since 2026-10-23. The report describes it as a privilege-escalation flaw in on-premises deployments in which an authenticated user, including one holding only read-only access, can obtain operator-level permissions and reach restricted management functions. It states the vulnerability has been exploited in attacks without naming the exploiting party. The CWE-89 classification and the privilege-escalation description are consistent: a SQL injection in an authorization path would let a low-privileged session reach operator records. The report does not identify the vulnerable endpoint or parameter.

Unconfirmed and single-sourced material:

The report attributes an AI-agent-assisted campaign against 62 organisations to affiliates of INC and The Gentlemen. Neither group has a MITRE ATT&CK profile, so the attribution is unconfirmed. The same applies to k0t, described as running a campaign against Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices that exposed more than 70,000 credentials with possible links to ransomware groups; k0t has no MITRE profile and the claim is single-sourced. The ShinyHunters item (MITRE G1057) concerns a US federal investigation into whether an executive at a ransomware negotiation firm helped operate the group's disclosure site, which listed nearly 100 organisations between May and October 2026; that is an investigative allegation, not a confirmed charge. The Lazarus Group (MITRE G0032) Operation FlashHole item describes espionage against South Korean software, construction and telecommunications equipment sectors using tailored phishing and fraudulent portfolio websites. None of these four items names EMEA victims or provides indicators.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every LiteLLM deployment and container image. Identify any running 1.107.0 by version tag and image digest. Where 1.107.0 is found, take the instance out of service, preserve the filesystem and container image for forensics, and treat every cloud credential and AI provider key reachable from that environment as disclosed. Rotate AWS access keys, session tokens and model-provider API keys, and review CloudTrail for the credential-testing activity the report describes.
• Pin LiteLLM to a version other than 1.107.0 and pull only from a registry you control, with digest pinning in the deployment manifest. Do not rely on the version tag alone.
• Patch Arista VeloCloud Orchestrator against CVE-2026-114625. It is in CISA KEV with a 2026-10-23 addition date, so it is the one item here with confirmed in-the-wild exploitation and a known remediation clock. Where patching cannot complete inside 24 hours, restrict orchestrator management access to a named administrative network and audit all read-only accounts for recent permission changes.
• Patch PHP against CVE-2026-109618 and CVE-2026-109619 on every internet-facing instance. The report gives no version numbers, so take the fixed release from the PHP project's own advisory rather than from this bulletin. Where a WAF or IPS sits in front of PHP, confirm the Check Point IPS signature for both CVEs is enabled and in blocking mode.

P2, within 72 hours:

• Patch GitLab Community and Enterprise to 18.11.13 or later, and confirm the fixed release for any 19.x deployment. The report does not list the affected 19.x versions; check GitLab's advisory.
• Search proxy and egress logs for outbound connections from LiteLLM hosts to unfamiliar endpoints in the 21 October onward window, and for AWS API calls from those hosts that do not match their normal role.
• Review WordPress estates for UpdraftCentral connection keys. TeamUpdraft's website was accessed and keys were abused to install backdoors during an 18-hour campaign on 18 and 19 October. Rotate any UpdraftCentral key held by your organisation and audit WordPress sites for unauthorised administrator accounts and modified plugin files.

P3, within 7 days:

• Apply the Oracle October 2026 Critical Patch Update to Fusion Middleware, E-Business Suite, MySQL and Java SE where deployed. The cycle covers 1,209 vulnerabilities across 33 product families, 95 of them critical; prioritise by which of those products face the internet.
• Add package and image provenance checks to the build pipeline for AI and developer tooling, so a registry-side publish with stolen tokens is caught before deployment rather than after.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The report names a malicious version, LiteLLM 1.107.0, and a campaign window, but gives no registry path, image digest, package hash or network indicator.

Behavioural indicators:

6. Detection

The sources give no file artefacts, command lines, mutexes or registry keys for any item, so a YARA rule built from this material would detect reporting rather than the threat. Behavioural detection is possible for the LiteLLM credential-theft pattern.

title: LiteLLM Host Retrieving Cloud Credentials Followed by AWS API Use
id: 7c1e4a92-3b6d-4f18-9a2e-5d0c8b1f6e34
status: experimental
description: Detects a process on a LiteLLM gateway host reaching the EC2 instance metadata service or AWS credential files, followed by AWS API calls from the same host. Built from the Check Point description of the LiteLLM 1.107.0 credential-theft behaviour; no atomic indicators were available.
author: Adverse Trace
date: 2026-10-26
references:

  - https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/
logsource:
  category: process_creation
  product: linux
detection:
  selection_metadata:
    CommandLine|contains:

      - '169.254.169.254'
      - '/latest/meta-data/iam/security-credentials'
  selection_credfile:
    CommandLine|contains:

      - '.aws/credentials'
      - '.aws/config'
  condition: selection_metadata or selection_credfile
falsepositives:

  - Legitimate AWS tooling and instance-profile bootstrap scripts on hosts that are not LiteLLM gateways
level: medium

Scope this rule to hosts identified as LiteLLM gateways in the P1 inventory. On a general Linux estate it will fire on ordinary AWS tooling.

CVE assessment

4 referenced CVEs — 1 actively exploited (CISA KEV), 4 critical (CVSS ≥ 9.0)

Could not resolve: CVE-2026-115560.

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

No MITRE ATT&CK profile for: INC, The Gentlemen, k0t.

7. Sources

• Check Point Research, "26th October – Threat Intelligence Report", 2026-10-26. https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/
• Check Point Research, "24th August – Threat Intelligence Report", 2026. https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/ (context on GitLab out-of-band critical releases)
• Check Point Research, "5th October – Threat Intelligence Report", 2026. https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/ (context on internet-facing appliance exploitation patterns)
• Check Point Research, "25th May – Threat Intelligence Report", 2026. https://research.checkpoint.com/2026/25th-may-threat-intelligence-report/ (context on ShinyHunters extortion activity)

8. Adverse Trace position

Adverse Trace assesses the LiteLLM 1.107.0 compromise as the highest-priority item in this report for EMEA financial services, because the payload targets cloud credentials and AI provider secrets that are frequently over-privileged in exactly the environments that deploy an AI gateway. The severity rests on the credential exposure, not on any confirmed victim count, and the technical detail is single-sourced to Check Point's weekly bulletin; we will obtain the LiteLLM project's own advisory and the image digest before advising clients to hunt on specific artefacts. CVE-2026-114625 is the only item here with confirmed exploitation and a CISA KEV listing, so it carries a defined remediation clock and should be closed first where VeloCloud Orchestrator is internet-adjacent. The PHP pair carries an EPSS of 100% and a 97.5% unpatched rate on visible instances, which makes opportunistic scanning near-certain even without a named actor. We will re-issue this advisory if the LiteLLM project publishes indicators, and we will not attribute the VeloCloud exploitation or the k0t campaign to any actor until a second source corroborates it.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.