IT News Roundup: PHP2Shell, Kimi K3.1 Pro, and the LiteLLM Supply-Chain Compromise — Week of Oct 19 – Oct 25, 2026

This week in IT was defined by a collision between the speed of AI discovery and the pace at which the internet's foundations can be patched. Two critical flaws in PHP — discovered with the help of frontier AI models, leaked before coordinated disclosure, and exploited within hours of the fix — sent government and commercial websites around the world offline in what security teams are already calling "Black October." In the same week, a poisoned release of the LiteLLM AI gateway sat on PyPI for about 94 minutes attempting to steal cloud and AI credentials, a China-linked espionage group's BeyondTrust zero-day exploitation was confirmed after seven weeks in the wild, and eight certificate-authority keys proved recoverable by anyone. On the AI side, Moonshot AI's Kimi K3.1 Pro arrived at the frontier of the Artificial Analysis Intelligence Index with open weights promised by November 4, DeepSeek refreshed its MIT-licensed Flash model, and Anthropic's draft IPO prospectus revealed an $80 billion first-half loss and plans for up to $750 billion in compute spending.

Deep Dive: PHP2Shell — AI-Discovered Flaws Put Roughly 70% of the Web at Risk

On October 20, the PHP project announced an emergency security release for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (the security firm watchTowr rated them a full 10.0). The announcement came a day ahead of the planned coordinated disclosure after technical details leaked — a Hacker News post, a watchTowr X post, and a proof-of-concept exploit video that researcher firm Calif accidentally published. Fixed releases shipped the next day at 13:30 UTC: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, plus minimal source backports for the end-of-life 7.4, 8.0, and 8.1 branches. Both flaws allow unauthenticated remote code execution, and every PHP installation that serves web requests is in scope — mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed — with the PHP team rating mod_php the highest-risk configuration. The vulnerabilities reach back to PHP 5.4, released in 2012.

Technically, CVE-2026-109618 is memory corruption during out-of-memory handling. PHP enforces its user-configurable memory_limit by using longjmp() to abort any request that exceeds the limit, which can interrupt a request mid-parse of a multipart file upload. Request cleanup may then treat partially initialized internal data as valid and free memory that was never initialized — memory that can still hold attacker-controlled residue from earlier allocations. CVE-2026-109619 is stale global state: internal state owned by a request can survive after its backing memory has been freed, for example after a fatal error, and a later request handled by the same worker can use that stale state before normal initialization resets it. A demonstrated exploit shows that on mod_php a single unauthenticated request can trigger the attack before any application code runs, so web application firewalls and application-level defenses cannot be the only line of defense. A PHP core developer had found the OOM bug during an audit in 2024, but the project never fixed it: maintainers could not reach consensus on an approach, and no working exploit was known at the time.

The discovery is as significant as the flaws. The two vulnerabilities were found independently in August 2026: by Ryan Austin, a researcher at the California-based security firm Calif, working with OpenAI's GPT-5.6 Sol model as part of OpenAI's "Patch the Planet" project, and by Wiz, the Google Cloud cybersecurity subsidiary, which used Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tooling. Wiz researchers have compared the incident to Heartbleed, the 2014 OpenSSL flaw that affected roughly two-thirds of the web. The contrast drew attention: The Guardian noted that the PHP Foundation, which maintains the language, employs 13 full- and part-time staff and runs on donations, while the AI systems credited with finding the flaws sit on top of billions of dollars of investment.

Attackers did not wait for the disclosure. Amazon Threat Intelligence's MadPot honeypot telemetry logged a PHP2Shell exploitation attempt on October 17 — four days before public disclosure, while the flaws were still under embargo. Cloudflare reported early attack traffic at 07:43 UTC on October 21, hours before the 14:00 UTC release, and deployed temporary WAF rules for the known exploit vectors to all customers, including the free tier. watchTowr observed active exploitation attempts against both flaws at 14:19 UTC on October 21 and has since confirmed in-the-wild exploitation. CISA, by contrast, said it had not observed exploitation as of the same day, and the flaws are not yet in the KEV catalog. Researchers estimate more than 1.3 million internet-exposed hosts may be vulnerable. Chainguard's early release of patched builds also leaked the fix diff before the embargo ended, giving attackers a head start on exactly what had changed.

The impact has been global and, for a language, personal. W3Techs data puts PHP at roughly 69% of websites with a known server-side language, and the fallout was visible within hours: the Dutch government portal Overheid.nl, Denmark's national school communication platform, all Finnish public-facing government web services, the websites of the French Interior Ministry, and Canadian and Australian government sites — including cyber.gov.au — were taken offline as a precaution, following guidance from CERT-EU, the UK NCSC, and the US NSA, which advised taking sites offline if they could not be patched immediately. Wikimedia disabled supporting services including its Phabricator instance, 4chan and Something Awful went dark, the Internet Archive briefly shut down, and Japanese games and e-commerce platforms followed. On October 23, PHP disclosed a third RCE, CVE-2026-115560, which affects only web applications configured in an unusual way; PHP considers it an unlikely risk and will not ship an out-of-band release, advising operators to disable session.upload_progress and restart all workers — the same control that also reduces exposure to the other two flaws.

For IT professionals and homelab operators, the practical list is short and urgent. Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 — or the vendor backports from cPanel, CloudLinux, and Linux distributions — and confirm the CVE IDs in the package changelog, because version numbers are moving fast. Inventory embedded PHP: appliances, management interfaces, and vendor products that bundle the runtime, using the NCSC-NL php2shell tracker, which is logging vendor status for products such as HPE ClearPass, NetApp ONTAP, Cisco Expressway, and Symantec SEPM. The published mitigations — memory_limit=-1 set outside application control, a low post_max_size, session.upload_progress.enabled=0 plus a full worker restart — reduce exposure but are not complete fixes, and the PHP team says only updating makes an installation safe. The UK NCSC also warned operators to be wary of backdoors planted during the exploitation window, and anyone tempted to test circulating proof-of-concept code should do so in an isolated environment only; unverified exploit code is itself a malware vector. See the CERT-EU advisory, the CISA alert, the PHP project announcement, and Reuters' coverage of the government shutdowns.

AI Models & Weights

Moonshot's Kimi K3.1 Pro Lands at the Frontier, With Open Weights Promised by November 4

Moonshot AI released Kimi K3.1 Pro on October 23, the first model in its new K3.1 series, alongside a faster companion, Kimi K3.1 Pro Highspeed, that delivers two to three times the throughput at twice the price (except for cached input tokens). The model is a 3T-class mixture-of-experts — 2.8 trillion total parameters with roughly 104 billion active — with a one-million-token context window and multimodal input (image and video). It is thinking-mode only and accepts reasoning_effort settings of low, high, or max. API pricing is $2.00 per million input tokens and $10 per million output, the same as GPT-6.1 Sol and half the price of Claude Opus 5.5, with Zero Data Retention available for API customers.

The benchmark results are the story. Artificial Analysis scored K3.1 Pro at 55 on its Intelligence Index, ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon (all at 53) and behind only Claude Opus 5.5 (58) — the first time a soon-to-be open-weight model has scored this close to the proprietary frontier, according to Simon Willison. On Moonshot's own numbers, K3.1 Pro took 65.7% on Terminal-Bench 4.0 (Claude Opus 5.5: 66.4%, GPT-6 Astra: 58.2%), and the claim-level hallucination rate on the internal Kimi Hallu Bench Hard fell from 23.4% on K3 to 8.3%. See the Artificial Analysis launch analysis and the Kimi blog post.

Full model weights are promised by November 4. Moonshot says it removed cyber-related data from both mid-training and reinforcement learning before the open release: on the internal xdev-bench-hard vulnerability-discovery benchmark, a checkpoint trained without that mitigation scores 90.5% at pass@3, versus 81.0% for the final model, which the company frames as evidence that data removal meaningfully reduces cyber capability. For local use, the honest picture is that 2.8 trillion total parameters is datacenter-scale even at 4-bit quantization, so the near-term local story is the 104B active-parameter footprint — a workable MoE offload target for large-RAM systems — and the GGUF quantizations the community is likely to produce once the weights land. Unite.AI has a fuller spec rundown.

DeepSeek Ships V4.1-Flash-1017, an MIT-Licensed Refresh of Its 552B Flash Model

On October 17, DeepSeek published DeepSeek-V4.1-Flash-1017, a minor update to the 552B-parameter Flash model (8B active for prefill, 16B for output) with a one-million-token context window and multimodal input. The snapshot improves reasoning, coding, and agentic benchmarks while reducing task execution time and output length, and it ships at the same API price — a performance-cost Pareto update. Terminal-Bench 4.0 jumped from 31.2 to 42.3, and DeepSWE v1.1 rose from 74.2 to 77.0. The weights are MIT-licensed, as with the rest of the V4.1-Flash family.

The release is also a tooling release. Rather than a Jinja chat template, DeepSeek shipped a self-contained Python reference implementation (encoding.py) plus deepseek-recipe, a Rust library with Python bindings that converts Messages, Chat Completions, and Responses API requests into V4/V4.1 prompts and parses output back into complete or streamed responses. For local inference, the 552B backbone is a big-RAM MoE story — roughly 300GB at 4-bit — but with only 16B active parameters, quantized GGUF builds on 128GB-plus memory systems with CPU offload are a realistic target. See the Hugging Face model card and DeepSeek's release notes.

AnythingLLM Swaps Its Built-in Engine From Ollama to llama.cpp and AMD's Lemonade

AnythingLLM announced that the desktop app's built-in local engine now runs llama.cpp, managed by Lemonade, AMD's open-source local AI server, replacing the bundled Ollama that has been part of the product since launch. The company — home to one of the largest installed bases of Ollama — cited llama.cpp's pace of performance work, a year of Ollama upgrades that were "as likely to break something as to fix it," and Ollama's shifting focus toward cloud models and services.

The ecosystem context matters: in February, ggml.ai, the team behind llama.cpp, joined Hugging Face, and in September NVIDIA agreed to acquire Hugging Face — so the largest hardware and open-model players are now investing in llama.cpp as the default runtime, including for NPUs. The new engine installs only what the machine can use: about 137 MB on a typical Windows PC without an NVIDIA GPU, versus about 1.8 GB for the old Ollama bundle. Existing AnythingLLM setups keep working, and self-hosted Ollama instances remain supported as an external backend. For homelabbers, the week's other notable open release was IQuest-Q1, a 320B MoE (15B active) agentic foundation model that has been trending on Hugging Face since October 21 — a size class that fits a 24GB GPU with offloading. See the AnythingLLM announcement.

The Rest of the Week

LiteLLM 1.107.0 Poisoned on PyPI and Docker in a Credential-Stealing Supply-Chain Attack

In the early morning of October 21, LiteLLM's release pipeline was compromised and v1.107.0 — a widely used open-source LLM gateway and proxy — was pushed to PyPI and Docker with compiled malware that steals credentials and loads remote code execution tooling. All seven PyPI wheels were live for about 94 minutes (11:39–13:23 UTC), and the compromised Docker images (v1.107.0, latest, main-latest, main-stable) for roughly two and a half hours. The payload included cook.pth and sitecustomize.py, which run at every Python start in an affected environment — so the stealer executed without anyone importing LiteLLM — and it collected browser passwords, SSH and cloud keys, CI credentials, AI coding tool configurations, and the provider keys stored in the LiteLLM proxy database. A second-stage loader polled a GitHub dead drop (a /codepy path on litellm.dev) hourly for code to run.

LiteLLM's investigation points to a chain that began with GitHub CLI OAuth tokens embedded in an AI coding tool's response bodies (Claude Code) and logged into an internal LiteLLM deployment that was exposed to the public internet. The attacker used three sets of developer credentials, one belonging to a GitHub organization owner, to disable branch protections and force-push a change pointing the release workflow at a lookalike repository — Berri-AI/litellm, with a hyphen — which signed and published the poisoned artifacts. The official 1.107.0 source tag on GitHub was clean; the malicious code existed only in the built packages. A clean git tag, it turns out, proves nothing about what actually reached the registry. See the LiteLLM incident report and Datadog's analysis.

The remediation guidance is explicit: pin to 1.106.2 or any earlier explicit version, delete cook.pth, cook.py, and sitecustomize.py (plus matching .pyc files) from site-packages, kill the detached daemon holding /tmp/remote_code_loader.lock, and rotate every credential the host could reach — IAM roles, provider keys, and the proxy's database password. Chainguard's scanner flagged the release 16 minutes after the first wheel appeared, and neither Chainguard nor Socket has found evidence linking the attack to TeamPCP, the group behind LiteLLM's March compromise, even though the technique is similar. The broader lesson for anyone running an LLM gateway: pin package versions and image digests, slow-roll brand-new releases, and verify that provenance names the repository you expect.

Armory Castle Ran a BeyondTrust Zero-Day for Seven Weeks Before Disclosure

BeyondTrust disclosed CVE-2026-102764 (CVSS 9.3), a critical authentication bypass in Remote Support (formerly Bomgar) that allows an unauthenticated attacker to perform file operations on an appliance, affecting all versions through 26.2.3. The disclosure followed a joint analysis with Mandiant and Google Threat Intelligence: the suspected China-nexus espionage group Armory Castle (formerly UNC5221, also tracked as Warp Panda) had been exploiting the flaw as a zero-day since August 29, against at least two appliances — one BeyondTrust-hosted and one self-hosted. BeyondTrust shipped a patch on October 8, with SaaS customers updated by October 9, and CISA added the flaw to the KEV catalog on October 16 with a federal remediation deadline of October 19.

Mandiant's incident-response findings describe a full intrusion: root access on the appliances, deployment of the Sawfly web shell and the Bareclaw tunneler, deletion of local logs, and lateral movement using compromised Administrator credentials. The group has previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure, and Mandiant noted that exploitation widened after public disclosure, so further attempts against unpatched appliances are likely. The Shadowserver Foundation tracks more than 1,400 BeyondTrust remote-support instances exposed to the internet. See the BeyondTrust advisory, SecurityWeek, and the Google Cloud threat-intel analysis.

The practical takeaway: remote-support and privileged-access appliances hold the keys to everything they touch, so a compromise is a skeleton key. Patch self-hosted Remote Support and Privileged Remote Access (which shares the affected code), forward appliance logs to a SIEM in near real time because this actor wipes local logs, rotate any credentials the appliance stored, and treat any internet-reachable appliance from the August 29 to October 8 window as potentially compromised until it has been reviewed. The OpenVPN weekly roundup has a good summary of the week's full "foundations failing" theme.

Anthropic's Draft IPO Prospectus Reveals an $80 Billion First-Half Loss

According to the Wall Street Journal, Anthropic recorded a net loss of more than $80 billion in the first half of 2026 as the market anticipates its looming IPO. The main driver was $72 billion in accounting charges related to changes in the value of convertible notes and other financial instruments the company issued to raise funding. Revenue, by contrast, jumped to $16.3 billion in the six months ended June 30 — up from $1.1 billion a year earlier — while AI infrastructure spending nearly quadrupled to almost $9 billion.

The prospectus also indicates the company could spend up to $750 billion in coming years to acquire computing capacity, including potential deals currently under discussion. At an investor day in San Francisco last week, four people familiar with the matter told Reuters that current and prospective investors are weighing a valuation of around $1.5 trillion — a significant step down from the roughly $2 trillion previously expected for the November share sale. The prospectus's risk-factor list includes uncertainty over how to prevent the company's products from doing harm, "whether through sophisticated cyberattacks or blackmail by uncontrolled models." See Al Jazeera's summary of the WSJ report.

eMudhra Certificate-Authority Keys Were So Weak That Browsers Blocked the Certificates

Chrome and Firefox blocked eight eMudhra intermediate CA certificates on October 17, after a researcher reported that their private keys were generated with insufficient randomness. Mozilla's Dennis Jackson described the keys as "effectively all zeroes apart from the last byte," and security researcher Scott Helme recovered all eight from the public certificates in under a second — meaning anyone holding one could forge a certificate that clients trusting the CA would accept for any website. eMudhra says a script error in a key ceremony created a second, weaker set of keys that was used by mistake, that only one of the eight intermediates was deployed in production, and that none issued certificates to end users.

Apple blocked the certificates on October 19, Microsoft on October 20, and Go shipped a fix the same day (CVE-2026-111943). Google says Chrome will remove the emSign ECC Root CA - G3 root, expected to reach users around October 27. Google found no fraudulent certificates in Certificate Transparency logs before the block, but not every client enforces Certificate Transparency, and software that does not check revocation may keep trusting these chains until it is updated. India's CERT-In said on October 21 that the public disclosures do not establish confirmed malicious use, and eMudhra's root-cause investigation remains open. For operators: update operating systems, runtimes, containers, and CA bundles as vendor fixes land, and if any site chains to the emSign root, reissue from a different hierarchy before the October 27 root removal.

METR and Redwood Research Find Flaws in OpenAI's Agent Monitoring System

METR and Redwood Research published the results of a three-week red-team engagement against OpenAI's internal misalignment monitoring system — a pilot review that OpenAI invited the nonprofit evaluators to conduct. The two researchers found several novel vulnerabilities, including an exploit that could conceal hundreds of agent actions from monitoring. The work is notable because it tests the assumption that a frontier lab's own monitoring can be trusted to see what its agents are doing — a premise that matters to anyone deploying agents behind the same kind of guardrails.

OpenAI said it invited the evaluation and has patched the affected safeguards; METR and Redwood have not independently verified the fixes. For teams deploying AI agents in production, the finding is a reminder that agent telemetry is a moving target: monitoring is itself an attack surface that a sufficiently capable agent can learn to game, so controls need to be layered — independent logging, behavioral baselines, human review of high-stakes actions — rather than relying on a single monitoring channel. See the METR report and Reuters.

Week in Numbers

• ~69% of commercial websites with a known server-side language use PHP; researchers estimate more than 1.3 million internet-exposed hosts are vulnerable to PHP2Shell.
• Anthropic's H1 2026 net loss: more than $80 billion on revenue of $16.3 billion (up from $1.1 billion a year earlier), with potential compute spending of up to $750 billion.
• Kimi K3.1 Pro: $2 per million input tokens / $10 per million output — half the price of Claude Opus 5.5 — with a 1M-token context window and full open weights promised by November 4.
• LiteLLM 1.107.0 was live on PyPI for about 94 minutes; Chainguard's scanner flagged the release 16 minutes after the first wheel appeared.
• Armory Castle ran the BeyondTrust zero-day from August 29 until the October 15 disclosure (~7 weeks); Shadowserver tracks more than 1,400 internet-exposed Remote Support instances.