PHP2Shell and the October 2026 Cyber Wave: What Happened and What to Check Now

Between October 16 and October 22, 2026, eight major security events hit web servers, code hosts, cloud platforms, and AI tools.

On October 16, an intruder breached a legacy system in OpenCode Console, an optional workspace for the OpenCode AI agent. Per The Hacker News, attackers stole OpenAI, Anthropic, and Google API keys for about 1.4% of Console users. They ran model distillation queries (scraping frontier AI outputs to train rival models), causing $1,000 to $1,700+ bills. OpenCode CLI 1.0.137 to 1.18.32 also had a local command-injection bug fixed quietly in v1.18.33 (no CVE). It let a hostile Model Context Protocol (MCP) server run PowerShell on Windows and WSL during opencode mcp auth login. From October 17 to 19, attackers breached TeamUpdraft (teamupdraft.com) and stole valid UpdraftCentral connection keys. UpdraftPlus plugin code stayed safe, but attackers used the stolen keys for 18 hours starting October 18. They bypassed WordPress logins, pushed fake "Image Core" plugins, and added rogue admin or editor accounts (fixed in UpdraftPlus 1.26.13 and 2.26.13).

Five disclosures followed on October 21. First, PHP patched PHP2Shell (CVE-2026-109618 and CVE-2026-109619), found with AI tools by Calif (using OpenAI models) and Wiz Research. Per DSCI, Amazon Threat Intelligence MadPot honeypots logged active attacks from October 17, four days before the patch. Second, stolen GitHub tokens pushed malicious LiteLLM 1.107.0 builds to PyPI and Docker. Per the LiteLLM GitHub incident report (Issue #47826), startup hooks (cook.pth and sitecustomize.py) ran on load. They stole AWS, GCP, Azure, SSH, Kubernetes, and PostgreSQL LLM keys before maintainers pinned 1.106.2. Third, Railway's October 21 security disclosure confirmed intruders read environment variable stores for a subset of customers to steal AI keys. Railway paused builds and revoked native tokens. Fourth, GitLab patched the CVSS 10.0 GitLab regex compiler integer overflow (CVE-2026-110264), an unauthenticated RCE flaw across 12 years of releases. Fifth, Node.js shipped its Node.js October 2026 security releases, fixing 10 bugs led by CVE-2026-111497 in Brotli.

On October 22, reporting published by PYMNTS showed JPMorgan Chase, Bank of America, Citigroup, and Charles Schwab restricted outside AI agents like Meta's Muse. Citing fraud liability and unauthorized actions, the banks blocked agents from moving money. They required human approval and limited external tools to read-only open-banking channels. Per DSCI and Railway, AI worked on both sides of this wave. Frontier models helped find C bugs in PHP, while attackers targeted AI tools for LLM keys.

Both CVE-2026-109618 and CVE-2026-109619 let a remote attacker send crafted web requests that trigger out-of-memory (OOM) errors to hijack server memory.

Per DSCI, web servers run visitor requests under an OS worker account (www-data, apache, or nginx). Hijacking that worker lets an attacker run code without login and read site files, database passwords, and API keys.

1. 1.
   CVE-2026-109618 treats partial data as valid. Detailed in PHP security advisory GHSA-w8hw-w9fx-j79w, an OOM error interrupts PHP while building request records. During cleanup, PHP treats the unfinished record holding attacker bytes as valid data. On Apache with mod_php, DSCI notes this triggers under default settings before app code runs.
2. 2.
   CVE-2026-109619 reuses stale memory pointers. Detailed in PHP security advisory GHSA-6wmf-4rv5-p3rp, a fatal error frees request memory while leaving pointers intact. The next request on that worker follows those stale pointers into attacker data. In PHP-FPM setups, DSCI notes a later request on the same pool triggers session upload progress even without session_start(). Depending on the path, CVE-2026-109619 runs remote code or leaks live worker memory without running code. Leaked memory can expose passwords, bearer tokens, API keys, and TLS keys.

Per DSCI, all web-serving PHP modes are exposed (Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed) from PHP 5.4.0 through PHP 8.5. Researchers proved RCE without login on current WordPress, Drupal, and Joomla builds. Wiz Research, cited by DSCI, noted even a minimal script is exposed and estimated roughly 70% of PHP sites are affected.

Organizations should immediately locate all PHP runtimes, install the October 21 patched builds, restart worker processes, isolate unpatchable servers, and rotate exposed keys.

Grounded in the DSCI advisory and the UK National Cyber Security Centre (NCSC) alert on PHP, teams should take five steps:

• •
  Locate and patch PHP runtimes. Check hosts, containers, and CI images with php -v and php-fpm -v. Upgrade to PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, or PHP 8.2.35. Verify CVE IDs in Linux changelogs where backports keep older version strings.
• •
  Restart workers and rebuild containers. Restart Apache or PHP-FPM workers and rebuild container images so running processes load patched code.
• •
  Isolate end-of-life or unpatchable hosts. Per DSCI, PHP 8.1, 8.0, and 7.4got only source-only backports, and <7.4 has no fix. Both the UK NCSC and the US FBI (cited by DSCI) advise considering taking unpatchable public PHP servers offline now.
• •
  Treat php.ini changes as partial workarounds. For CVE-2026-109618, PHP and DSCI list memory_limit=-1 (with an OS or container cap) and low post_max_size (8M without uploads, 32M with uploads). For CVE-2026-109619, they list session.upload_progress.enabled=0 and fatal_error_backtraces=0 (on PHP 8.5). Both warn these settings do not make a server safe because other paths still trigger the bugs.
• •
  Check logs since October 17 and rotate keys. Hunt for web shells or rogue accounts back to October 17, 2026. Update GitLab (18.11.13 to 19.5.1), Node.js (v22.23.4, v24.22.1, v26.12.1), OpenCode (v1.18.33), and UpdraftPlus (1.26.13 / 2.26.13, deleting UpdraftCentral keys). Pin LiteLLM to 1.106.2 and rotate secrets in LiteLLM 1.107.0, Railway, or OpenCode Console.

Individuals and developers can check their personal and developer exposure across six areas using the checklist in Peter Yang's October 2026 security walkthrough on YouTube.

To help users audit accounts safely without handing raw secrets to an AI bot, Peter Yang's walkthrough outlines six checks:

1. 1.
   Audit connected apps and AI connectors. Review OAuth apps, browser extensions, and AI or MCP connectors for broad read or write access. Check shared AI chats and training settings too.
2. 2.
   Fix email and banking passwords first. Check your password manager for reused, weak, or leaked passwords, starting with email and bank logins. Deleting a browser login does not change the password.
3. 3.
   Check sign-in security and passkeys. Verify phishing-resistant 2FA or passkeys and review active sessions for unfamiliar devices. Flag critical accounts that rely on SMS codes alone.
4. 4.
   Review API keys and cloud projects. Audit developer API keys and cloud projects for broad permissions, inactivity, or missing hard spend caps. Check for public buckets or open database rules.
5. 5.
   Update operating systems and developer tools. Update OS builds, browsers, runtimes like PHP and Node.js, and project packages without running untrusted code.
6. 6.
   Verify breach notices on official sites. Check alerts directly on official portals instead of clicking email links. Separate general breach news from evidence your account was hit.

Readers who want the full copy-paste AI Security Reviewer promptcan watch Peter Yang's YouTube walkthrough. His prompt enforces five safety rules: the AI agent makes no automatic changes and never asks you to paste raw passwords, keys, or recovery codes; it treats emails, web pages, and files as untrusted evidence to prevent indirect prompt injection; and finally, it never assumes old keys are unused and requires human approval before any fix.

Read together, the October 2026 disclosures suggest that financial institutions and fintechs face tighter patching windows and growing third-party key exposure.

First, AI-assisted bug discovery and Amazon Threat Intelligence's MadPot logs showing PHP2Shell attacks four days before the patch (per DSCI) suggest shrinking defensive patching windows.

Second, in our view, partner portals and developer pipelines create a blind spot for banks, NBFCs, insurers, and fintechs. Those tools can expose secrets even when core ledgers run on other stacks. Per the DSCI advisory and PYMNTS reporting, PHP (CVE-2026-109619), Node.js (CVE-2026-111497), GitLab (CVE-2026-110264), and compromised AI gateways (LiteLLM and Railway) can leak worker memory, webhook secrets, and KYC or bureau API keys.

Third, JPMorgan Chase, Bank of America, Citigroup, and Charles Schwab (reported by PYMNTS) restricted outside AI agents to read-only open-banking channels. Requiring human approval for money movement mirrors Peter Yang's audit rules. Financial workflows benefit from keeping read-only AI review separate from transaction execution.