Cybersecurity Black Week: A Torrent of Critical Vulnerabilities and Supply Chain Attacks
ESET's analysis of 'Cybersecurity Black Week' reveals a concentrated period of critical vulnerabilities in PHP, Linux kernel, and a compromised LiteLLM release, demanding urgent attention from security teams.
The week leading up to October 25, 2026, proved to be an exceptionally challenging period for cybersecurity professionals, characterized by an unprecedented convergence of critical vulnerabilities and security incidents. ESET's "Cybersecurity Black Week" recap highlights a deluge of severe threats, including memory-safety flaws in PHP core, unpatched Linux kernel vulnerabilities, a compromised LiteLLM release, a high-severity flaw in GitLab, a Node.js Brotli bug, and an incident affecting certificate authorities.
This concentrated period of disclosures, occurring within a single "Black Week" amid an already turbulent "Black October," underscores the accelerating pace of vulnerability discovery, partly fueled by AI-assisted research. The analysis aims to provide clarity by distinguishing between immediate, high-priority threats and those that may generate undue alarm, offering actionable insights for businesses navigating this complex threat landscape. The sheer volume and variety of issues demanded diverse responses, ranging from emergency patching and runtime upgrades to containment, credential rotation, and the replacement of trust bundles.
The most prominent headline-grabber was PHP2Shell, a pair of memory-safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP versions 5.4 through 8.5.11. With CVSS v4.0 scores of 9.2, these flaws could enable unauthenticated remote code execution (RCE) on vulnerable PHP servers. In critical configurations, exploitation could occur before application code execution, bypassing authentication. Given PHP's prevalence, powering an estimated 69% of known websites, government agencies worldwide urged immediate patching, with some recommending isolation or takedown of affected internet-facing systems. Fixes were released on October 21, but the rollout was complicated by a premature public leak, forcing an accelerated disclosure timeline.
Despite the severity and widespread calls for patching, early indications suggested that PHP2Shell was harder to weaponize than initially feared. Exploitation required specific conditions and target knowledge, and initial proof-of-concept exploits did not work against default PHP installations. While over 200 proof-of-concept exploits circulated, security firms reported no confirmed successful attacks. The remediation challenge is further complicated by PHP's embedded use in appliances and network devices, and the lack of standard binary releases for end-of-life branches.
Simultaneously, on October 21, Trend Micro's Zero Day Initiative (ZDI) disclosed unpatched Linux kernel vulnerabilities, some of which were sent to public mailing lists before fixes were ready. The most severe issues, rated CVSS 9.0, affected KSMBD, the Linux kernel's SMB server, with two vulnerabilities (ZDI-CAN-33549 and ZDI-CAN-33774) potentially leading to RCE. Exploiting ZDI-CAN-33549 required specific conditions like RDMA-capable interfaces and SMB Direct negotiation. Other reported issues included local privilege escalation and information disclosure vulnerabilities. Remediation required careful tracking of individual reports, consulting distribution advisories, and restricting exposed services while awaiting verified fixes, often necessitating system reboots.
Adding to the chaos, a malicious version of LiteLLM (1.107.0) was published to PyPI and its container registries on October 21. Attackers breached the project's release pipeline using stolen GitHub CLI credentials, disabling branch protections and altering the release workflow. LiteLLM, a popular Python proxy for LLM providers with approximately 23 million weekly downloads, had its compromised version available for about two hours before being quarantined. This marked the project's second supply-chain compromise in 2026, highlighting the persistent risks in software development pipelines.
Beyond these major incidents, the week also saw critical vulnerabilities in GitLab, Node.js Brotli, and issues with certificate authorities. The sheer volume of critical disclosures during this "Cybersecurity Black Week" served as a stark reminder of the evolving threat landscape, the impact of AI on vulnerability discovery, and the critical need for agile and prioritized security responses. Organizations must remain vigilant, continuously assess their risk posture, and implement robust patching and incident response strategies to mitigate the impact of such concentrated threat events.