Weekly Security Recap: Multiple RCEs, Supply Chain Chaos, and AI Agent Risks
A tumultuous week in cybersecurity saw critical remote code execution vulnerabilities disclosed in PHP and Brotli, a supply chain attack via LiteLLM, and concerns over AI agent security.
The past week has been marked by a barrage of critical vulnerabilities, with attackers actively scanning for and exploiting systems. The sheer volume of disclosed flaws, particularly those enabling remote code execution (RCE), has overwhelmed security teams struggling to keep pace with patching.
Among the most significant disclosures were two critical vulnerabilities in PHP, codenamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These flaws allow unauthenticated RCE and have triggered widespread scanning efforts, with millions of exploitation attempts detected. While no successful exploitation has been confirmed yet, the ubiquity of PHP on the web prompted some organizations to temporarily take their sites offline as a precautionary measure.
Adding to the chaos, a critical vulnerability in Google's Brotli decoder library (CVE-2026-111497), also known as Node2Shell and HTTP2Shell, was fixed. This flaw could lead to unauthenticated RCE and affected numerous libraries that depend on Brotli, including Node.js, Python, and Envoy. The disclosure coincided with patches for several RCE-enabling bugs in Ruby's regular expression engine, Onigmo.
The supply chain was also a major target. LiteLLM, a tool simplifying LLM API calls, suffered a supply chain attack after a master key was accidentally exposed on GitHub. This allowed a threat actor to push a malicious version of the Python package (1.107.0) that automatically executed upon Python startup, featuring credential harvesting and a backdoor for arbitrary code execution.
In parallel, four vulnerabilities in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656), chained as Plex2Shell, are being actively exploited in the wild to distribute cryptocurrency miners and proxy software. CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog.
Beyond direct software flaws, concerns about AI agent security surfaced. Railway warned of a targeted campaign aiming to steal AI provider API keys for distillation attacks, indicating sophisticated actors are leveraging AI infrastructure. Separately, a leaked master key for LiteLLM enabled a supply chain attack that stole cloud and AI API keys, highlighting the interconnected risks in the AI ecosystem.
Other notable disclosures include two critical RCE flaws in Linux's KSMBD server (ZDI-CAN-33774 and ZDI-CAN-33549) and a privilege escalation flaw (ZDI-CAN-33367), though these have not yet received CVE IDs. Meanwhile, Indian digital security firm eMudhra exited the certificate-issuing business after its intermediate CA certificates were found to use weak private keys, leading major browsers to block them.
This confluence of widespread RCE vulnerabilities, sophisticated supply chain attacks, and emerging threats targeting AI infrastructure paints a grim picture of the current threat landscape, demanding immediate attention and robust security practices from organizations worldwide.
PHP has released updated Windows builds (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) to address CVE-2026-111497, a critical HTTP2Shell vulnerability in the Brotli compression library. This out-of-bounds write flaw, rated CVSS v4.0 9.2, can lead to crashes, memory exposure, or remote code execution. The vulnerability is reachable in PHP on Windows via the cURL extension when automatic HTTP response decompression is enabled and untrusted Brotli data is decoded.