Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started. PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and won’t get an upstream release.

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code. Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.

Two critical remote code execution vulnerabilities have been found in PHP itself. Treat all versions as affected. ‍The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 21, 2026, at 16:00 CEST / 10:00 EDT / 07:00 PT. If you run PHP anywhere in your stack, please stay tuned for workarounds and patches. Be prepared to take action.

On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source proxy that lets developers route requests across dozens of LLM providers) was found to be compromised by an attacker who injected malicious code into its published Python wheels on PyPI. The official Docker image for the same version is also compromised.

Development teams ship faster than ever with AI-assisted coding. Features that previously took weeks can now be delivered in days. But security testing still runs on the old schedule. In Aikido's 2026 State of AI in Pentesting report, we found that 76% of organizations deploy significant production changes weekly or faster, while just 21% validate security on every release. Katie Norton, Senior Research Manager at IDC, summed it up.

Continuous control monitoring and a once-a-year, point-in-time pentest don't sit well together. A manual test means scoping, waiting for a slot, and holding up the audit window for the report. Teams choose Drata to get audit-ready quickly: controls monitored continuously, evidence collected automatically. The pentest is the part that doesn't move at that speed.

Any SCA tool worth its salt has reachability analysis these days. When a dependency has a known vulnerability, these tools can tell you whether your code calls the affected function. This is pretty much non-negotiable because it helps teams focus their security efforts instead of sifting through noise. Every other step in prioritizing dependency CVEs builds on it. But just because the vulnerable function is reachable doesn’t mean it’s exploitable.

Aikido Security is now CREST accredited in the penetration testing discipline. As a member of the CREST community, we are recognized as trusted professionals with proven experience and capability.