Black October 2026 — How PHP2Shell and LiteLLM Exposed the AI Open-Source Crisis

On October 21, 2026, the global internet experienced a visceral, physical-grade panic unseen in over a decade. The UK government abruptly took 32 public services offline, Finland's Government ICT Centre (Valtori) severed public access to all state web portals, and maintenance banners went up across Wikimedia's code collaboration platform, the Internet Archive, All Nippon Airways (ANA), and even the game servers for Uma Musume Pretty Derby. The trigger behind this worldwide wave of pulled network cables was PHP2Shell (CVE-2026-109618 and CVE-2026-109619)—a pair of remote code execution vulnerabilities that had lain dormant at the core of the PHP interpreter for 14 years.

Zoom out from a single language runtime, however, and it becomes clear this was never an isolated accident. Across the fourteen days between October 17 and October 30, six foundational layers of the internet detonated in rapid succession: an out-of-bounds write in Google's Brotli decoder (Node2Shell), a 16-year-old pre-boot flaw in TianoCore UEFI firmware, a 12-year-old maximum-severity remote code execution bug in GitLab, an entropy failure at Indian certificate authority eMudhra that generated an intermediate CA private key equal to the single-byte integer 4, and a supply-chain poisoning attack against the ubiquitous AI gateway LiteLLM.

Dubbed "Black October" by the security community, this crisis marks a watershed in offensive and defensive engineering. When frontier models like GPT-5.6 Sol and Gemini 4 Argon compress the time required to uncover decade-old state-machine flaws from "months for a world-class team" to "one week for a single researcher," raw compute does more than breach C memory boundaries—it overwhelms an open-source governance model where 13 funded developers and unpaid volunteers shoulder 70% of the web.

The October Blackouts and Six Concurrent Infrastructure Crises

For the past decade, security teams operated under the assumption that mega-vulnerabilities arrive one protagonist at a time—Heartbleed in 2014, Log4Shell in 2021. What made late October 2026 so disorienting was that six core layers of the stack—server firmware, cryptographic trust anchors, compression libraries, web interpreters, DevOps platforms, and AI supply chains—failed simultaneously within two weeks.

Placing the technical parameters of all six crises side by side illustrates why incident response teams were pushed to the breaking point:

Beyond those six pillars, the very same week saw Trend Micro's Zero Day Initiative (ZDI) accidentally CC an unpatched Linux kernel KSMBD remote code execution report (ZDI-CAN-33549, ZDI-CAN-33774, CVSS 9.0) to a public mailing list on October 21, followed days later by a $6.3 billion crypto heist at Binance and a breach exposing 27.26 million customer records at MUJI.

Yet among all concurrent emergencies, PHP2Shell was the one that forced national governments to pull the plug. According to W3Techs, PHP still powers 69.2% to 70% of all websites whose server-side language is known; Wiz Research cloud telemetry shows 65% of enterprise organizations run PHP in production, while Palo Alto Networks Cortex Xpanse identified more than 22.6 million internet-facing PHP instances worldwide.

Making matters worse, the coordinated disclosure originally scheduled for October 22 unraveled through a cascade of embargo failures:

• In-the-wild exploitation four days before disclosure: Amazon Threat Intelligence confirmed via its global MadPot honeypot network that threat actors were routing PHP2Shell exploitation payloads through commercial anonymization proxies as early as October 17.
• Forum leaks and an accidentally public demo video: As documented in Andreas Scherzer's minute-by-minute timeline, an anonymous Hacker News post (item?id=50167754) at 15:00 UTC on October 20 leaked the "PHP2Shell" moniker alongside both CVE identifiers, forcing PHP maintainers to advance the release by 24 hours. Around 20:00 UTC that evening, researchers at Calif preparing disclosure materials inadvertently set a YouTube demonstration video to public—showing unauthenticated RCE sweeping across 10 major platforms including WordPress 7.1.3, MediaWiki 1.46.2, Magento 2.4.9, Laravel 13.36.0, and Drupal 11.4.10.
• Container images pushed six hours early: At 06:07 UTC on October 21, container vendor Chainguard broke the embargo by pushing patched PHP container images to public registries more than six hours ahead of schedule, handing external attackers everything needed to pinpoint the vulnerable functions via binary diffing.

When the PHP release team pushed emergency patches 8.5.12, 8.4.27, 8.3.36, and 8.2.35 at 13:31 UTC on October 21 (alongside rare minimal source backports for end-of-life branches PHP 7.4, 8.0, and 8.1), the UK National Cyber Security Centre (NCSC) dispatched 50,000 urgent alerts across British institutions with a blunt warning: "If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated." Japanese Prime Minister Sanae Takaichi likewise urged enterprises on social media to suspend services if necessary. Within 48 hours, 32 UK government services, Finland's public state portals, the Dutch House of Representatives (Tweede Kamer), and the DigiD authentication system, the Wikimedia Foundation's Phabricator and Toolforge platforms, and web properties belonging to All Nippon Airways (ANA), JR West, and MUFG Bank were preemptively taken offline.

Turning a 14-Year Bug into SKILL.md — How LLMs Shattered PHP Memory Boundaries

Why could two vulnerabilities buried deep inside the PHP interpreter bypass application-layer logic altogether, compromising everything from stock WordPress installations to bespoke enterprise frameworks?

The answer lies in how the Zend Engine bails out of out-of-memory (OOM) conditions, combined with how long-lived worker processes manage global state across consecutive HTTP requests.

Inside the PHP runtime, whenever a single request's heap allocations breach memory_limit (defaulting to 128M), the engine invokes zend_bailout()—a wrapper around C's non-local jump longjmp()—to unwind the stack immediately and abort execution. That architecture implicitly assumes every underlying C routine leaves global and heap data structures in a crash-consistent state before requesting memory. Research by Ryan Austin at Calif Research and the Wiz Research team exposed two fatal flaws in that assumption:

1. The Pre-Condition Bypass (Exhausting 128MB of RAM with a Sub-8MB Payload): Many administrators initially assumed PHP's default post_max_size = 8M would block memory exhaustion before it began. In practice, attackers had two clean bypasses. First, sending an HTTP/1.1 request with Transfer-Encoding: chunked (omitting Content-Length) or an HTTP/2 stream without a content-length pseudo-header causes PHP to buffer incoming chunks continuously until hitting the 128MB ceiling. Second, during multipart/form-data upload parsing (main/rfc1867.c), supplying deeply nested empty array variable names (such as files[a][b][c]...) forces PHP to initialize five separate HashTable subtrees (name, type, tmp_name, error, and size) inside $_FILES for every nested level—inflating a raw POST body smaller than 8MB into well over 100MB of internal heap structures.
2. CVE-2026-109618 (Uninitialized Memory Corruption via OOM Interruption): Inside _zend_hash_str_add_or_update_i in Zend/zend_hash.c, the engine increments the hash table's active element counter (ht->nNumUsed++) before calling zend_string_init to allocate memory for the key. If zend_string_init hits memory_limit and fires longjmp(), the slot count remains incremented while the corresponding Bucket.val contains uninitialized garbage. Seconds later, when request teardown invokes zend_hash_destroy to walk and free the table, the engine treats that uninitialized wild pointer as a valid zval and calls its destructor—handing attackers direct control-flow hijacking.
3. CVE-2026-109619 (Cross-Request Stale Global State UAF and "PHPBleed"): Under multi-request worker architectures such as Apache mod_php or PHP-FPM, several global variables temporarily point to request-scoped heap memory. When a request includes a PHP_SESSION_UPLOAD_PROGRESS field (session.upload_progress.enabled=1 by default), PHP points the global PS(mod_data) structure at request-allocated memory during early request initialization—while PG(modules_activated) is still 0. If an OOM bailout occurs at that exact window, PHP skips all module RSHUTDOWN cleanup hooks because modules were never marked active, leaving a dangling pointer in PS(mod_data) after the request heap is freed. Similarly, in ext/standard/var_unserializer.re, an OOM inside unserialize() causes RSHUTDOWN to decrement BG(unserialize).level to -1, triggering a used_slots integer overflow and cross-request use-after-free (UAF) on the next request handled by that worker. Worse still, when an OOM during php_session_start() leaves the session ID pointer PS(id) uncleared, the subsequent request's Set-Cookie: PHPSESSID=... response header bleeds raw worker heap memory—leaking environment variables, database passwords, API keys, and shared-library base addresses needed to defeat ASLR ("PHPBleed"). Patrick Fussell, Global Head of Adversary Simulation at IBM, captured the bug with a vivid analogy: "Think of a hotel room where you check out, but your key still works. And so you can just go back into that hotel room later, and now somebody else’s stuff is there."

What sent chills through the engineering community was not merely the elegance of the exploit chain, but how it was discovered.

The theoretical concept of abusing memory_limit interruptions to desynchronize internal state was first presented in 2004 by PHP security pioneer Stefan Esser, and in 2020 security researcher jr@coredu.mp filed Bug #78876 demonstrating that multipart/form-data requests could bypass size limits to trigger OOM conditions. Yet for over a decade, manually tracing the combinatorial explosion of cross-module macro expansions, reference counts, heap layouts, and non-local jumps across millions of lines of C remained at the outer boundary of human stamina.

In the summer of 2026, the rules changed. On June 22, OpenAI and Trail of Bits launched the "Patch the Planet" open-source security audit initiative; on July 30, security firm Calif joined the program to audit php-src. Using OpenAI's GPT-5.6 Sol model, Calif researcher Ryan Austin (@lcfr_hax) pinpointed the _zend_hash_str_add_or_update_i OOM interruption primitive on August 1—just two days into the engagement. Crucially, rather than stopping at a single bug, Austin instructed the model to abstract the root cause into a reusable SKILL.md hunting pattern for autonomous security agents:

publish or destroy state
  -> perform fallible work
  -> nonlocal fatal
  -> commit/rollback skipped
  -> surviving consumer trusts false state

Armed with that SKILL.md specification, AI agents systematically swept the multi-million-line C codebase and rapidly surfaced an entire family of identical primitives across session.upload_progress and var_unserializer. Almost simultaneously (between August 19 and August 24), the Wiz Research team—completely unaware of Calif's work—deployed their internal security agent Wiz Atlas alongside Google's Gemini 4 Argon and GPT-5.6 Sol. Within a single week, one researcher independently rediscovered the vulnerability class and weaponized four distinct end-to-end exploit chains spanning both mod_php and PHP-FPM:

"The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit. With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work."

That exact pattern repeated across the entirety of Black October. The Google Brotli heap out-of-bounds write (CVE-2026-111497)—which forced emergency out-of-band updates across Node.js, .NET, Bun, and Microsoft's entire enterprise portfolio—had actually been fixed in commit 0ed4268a on February 27, 2026 without anyone realizing its security implications, until OpenAI Codex Security researchers Khai Tran and Sylvie Mayer used frontier models to prove its exploitability. Likewise, the 16-year-old PXE pre-boot vulnerability in TianoCore EDK II firmware (CVE-2026-97631) was uncovered jointly by Anthropic researcher Alex Matrosov and Google researcher Dan Holmes-Mitra (before firmware vendor AMI prematurely submitted a public pull request that blew the January 2027 embargo, as detailed by Ars Technica).

When the AI Toolchain Bites Back — Inside LiteLLM's 101-Minute Supply-Chain Heist

If PHP2Shell and Brotli demonstrated what happens when frontier AI compute is aimed at legacy C foundations, the LiteLLM supply-chain poisoning attack that erupted on the exact same "Black Wednesday" (October 21, 2026) exposed the glaring blind spots inside modern AI infrastructure itself.

LiteLLM is one of the most widely deployed open-source Python gateways used by enterprises and developers to route traffic across more than 100 large language providers, including OpenAI, Anthropic, and AWS Bedrock. At 11:39 UTC on October 21—at the exact moment operations teams worldwide were scrambling for PHP patches—attackers published a trojanized litellm==1.107.0 package to PyPI, and between 11:46 UTC and 14:20 UTC poisoned the v1.107.0, latest, main-latest, and main-stable container tags across Docker Hub and GitHub Container Registry (GHCR).

According to the official post-mortem published by BerriAI (LiteLLM's parent company) and reverse-engineering analysis from Wiz Research, every stage of the intrusion bore the unmistakable fingerprints of the AI era:

• Initial access via Claude Code response body logging: BerriAI operated an internet-exposed internal LiteLLM proxy configured with verbose response-body logging. Investigators discovered that under specific conditions, Claude Code embeds the user's GitHub CLI OAuth token directly inside the HTTP response body—causing the plaintext GitHub CLI OAuth tokens of three core BerriAI engineers to be recorded verbatim in LiteLLM's logs. Armed with those three tokens, the threat actor triggered and approved the production release pipeline for v1.107.0.
• 49,000 downloads in 101 minutes and a dual-persistence implant: Although PyPI quarantined the malicious release at 13:20 UTC (101 minutes after publication), ClickPy telemetry showed that automated CI/CD pipelines and developers had already pulled the package roughly 49,000 times. Wiz analysts noted that the malware exhibited clear hallmarks of LLM-assisted code generation and pioneered a dual-persistence mechanism combining .pth and sitecustomize.py. Whenever any Python interpreter started on the host, cook.pth automatically imported cook.py, wrote a single-execution lockfile to /tmp/.pc_once_72129118c59f5636c0bb, and executed 16 internal collection modules (privcollect) to harvest browser passwords, AWS/GCP/Azure cloud credentials, OpenAI/Anthropic API keys, and the first 500 rows of the PostgreSQL table "LiteLLM_CredentialsTable". The stolen loot was encrypted with AES-256-CBC and RSA-4096 before exfiltration to the lookalike domain www.litellm.dev/healthcheck. Simultaneously, sitecustomize.py spawned a background daemon on Linux and macOS that polled a GitHub dead-drop (letters9813/pythonclient-test/main/domain.txt) once per hour to fetch second-stage command-and-control payloads.
• Pivoting to LLMjacking in 4.5 hours: Between 16:20 and 17:01 UTC that same afternoon—just 4.5 hours after credential exfiltration began—the attackers were observed running automated sts:GetCallerIdentity and bedrock:ListFoundationModels calls to hijack victims' AWS Bedrock quotas at scale.

On one side of October 21, defenders used frontier LLMs to unearth 14-year-old memory corruption bugs in foundational open-source C code; on the other side, attackers plucked OAuth tokens from AI coding agent logs and used LLM-generated malware to hijack cloud LLM compute. Having both plays unfold on the exact same afternoon captured the defining irony of Black October.

Public Scripts Fizzle While 25 Servers Fall — The Real Baseline of AI Exploit Chains

In the first few days following the PHP2Shell disclosure, the security community split into two polarized camps.

On one hand, Cloudflare CEO Matthew Prince reported observing thousands of exploitation attempts 10 hours prior to official disclosure, surging to tens of thousands within 45 minutes of the advisory and surpassing millions within 24 hours. On the other hand, empirical testing published by Wiz Research on October 27 and responder guidance from Bishop Fox demonstrated that the two dominant open-source PoC families circulating on GitHub—archive/legacy-8m/exploit.py targeting CVE-2026-109618 and pure/mk_a1.py + mk_leak_b.py targeting CVE-2026-109619—failed almost universally outside default Docker lab containers.

The technical reasons were straightforward: legacy-8m required Apache mod_php and was blocked outright by the default 8M POST limit whenever chunked encoding was omitted. Meanwhile, pure/mk_a1.py (targeting modern PHP-FPM) hardcoded heap feng shui offsets specific to exact binary builds and required two consecutive requests to land on the exact same PHP worker process. On high-concurrency production servers behind multi-worker load balancers, organic traffic routinely scrambled the heap layout or crashed the worker before the second request arrived. Opportunistic repositories like WoYinDao/CVE-2026-109618-CVSS-9.2-Critical even masqueraded as PHP2Shell exploits while actually scanning for legacy local file inclusion (LFI) paths—generating massive waves of harmless HTTP 500 noise across the internet.

Yet dismissing PHP2Shell as hype proved a costly mistake. While script kiddies sprayed broken scripts against random web servers, disciplined threat actors demonstrated what engineered, surgical exploitation looks like in practice.

On October 29, 2026, Dream Research and Palo Alto Networks Unit 42 (alongside reporting from Cybersecurity Dive) jointly published forensic findings from the first fully verified advanced intrusion campaign, tracked as CL-UNK-1280. When investigators captured the threat actor's operational infrastructure, they found an active Claude Code installation alongside aiscan—a custom automated exploitation framework configured on October 8 with API integrations for both DeepSeek and Kimi large language models.

Rather than wasting packets on unpredictable public websites, CL-UNK-1280 locked onto Palo Alto Networks PAN-OS perimeter firewalls, whose management plane (appweb) runs a standardized software stack embedding high-memory-limit builds of PHP 8.0.30 and 7.4.33:

1. Funnel Reconnaissance and Firmware Reverse Engineering: The attackers queried FOFA to identify roughly 19,000 internet-exposed PAN-OS management interfaces worldwide (~0.02% of the global install base), ran a 200-thread liveness sweep to isolate 5,000 responsive appliances, and filtered by geography (United States, Japan, Taiwan, and South Korea) and exact version (PHP 8.0.30) down to 240 high-value targets. Prior to launching a single exploit packet, the operators decrypted official PAN-OS firmware images and extracted 11 byte-accurate libphp.so memory offset profiles across minor releases.
2. Four-Stage PHP2Shell + Kernel LPE Fragnesia to Root in 15 Minutes: To break out of the firewall's restrictive SELinux httpd_t sandbox, the attackers engineered a four-stage sequence: request A1 sent a 383MB payload to exhaust memory and leave dangling state; request B1 harvested the libphp.so base address from the Set-Cookie response header to defeat ASLR; request A2 transmitted a 500MB payload to establish stale references; and request B2 forged a HashTable destructor calling zif_system while chaining the Linux kernel XFRM ESP-in-TCP local privilege escalation vulnerability Fragnesia (CVE-2026-46300) inside the exact same HTTP request. The kernel exploit overwrote the 774-byte /etc/pam.d/su file in the page cache with pam_permit.so. From initial packet to passwordless root execution and a 103-byte Webshell drop (/unauth/php/change_password.php), the entire compromise took 15 minutes.
3. Tunneling into a US Government-Affiliated Internal Network: Between 18:14 and 21:55 UTC on October 23, the actor rooted 24 perimeter firewalls. At 10:09 UTC on October 24, the operators focused on two firewalls belonging to a US government-affiliated organization (configured with CAC smart-card authentication), establishing a persistent 8-port reverse SSH tunnel under /usr/local/lib/.panops/. At 11:35 UTC, the attackers pivoted through that tunnel and fired the exact same PHP2Shell exploit chain against a 25th server—an air-gapped internal central firewall management server. After seizing root on the management server, they extracted the master key to decrypt plaintext LDAP service account passwords stored in the configuration database. Taking advantage of an Active Directory domain policy where lockoutThreshold=0 (account lockout disabled), the attackers executed full domain enumeration, password spraying, backdoor machine-account creation, and Keycloak SAML signing key extraction.

That surgical operation—alongside verified compromises of security researcher Adel Karimi's honeypot and UK penetration tester Jaydip Modhwadia (killa) claiming a $2,000 Bitcoin live-server bounty—prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-109618, CVE-2026-109619, Brotli's CVE-2026-111497, and the kernel LPE Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities (KEV) catalog across three consecutive days from October 26 to 28, followed immediately by critical supplemental advisories from JPCERT/CC and Japan's IPA.

Even more sobering is the defender's long-tail remediation curve. Continuous telemetry from Wiz Research revealed that while the total count of internet-exposed vulnerable PHP hosts dropped by 67% between October 22 and October 25, the percentage of enterprise organizations harboring at least one unpatched exposed instance fell to 63.0% on the first day and then stalled—leaving 52.1% of organizations still exposed by October 25 (a cumulative reduction of just 47.9%). Thousands of perimeter gateways, hardware firewall management ports, legacy NAS appliances, and internal systems pinned to end-of-life PHP branches that never advertise a PHP banner remain squarely in the crosshairs of automated exploitation platforms.

Thirteen Foundation Developers and a Sleepless Volunteer — Can Open Source Survive

Stepping back from heap layouts and forensic timelines forces the engineering community to confront its most uncomfortable question: why did a class of memory-exhaustion flaws theorized in 2004 and reported in 2020 survive until frontier AI models weaponized it in 2026?

What few outside the core team knew is that the exact OOM error-handling flaw underlying CVE-2026-109618 had already been flagged by a PHP core developer in June 2024—during a formal security audit funded by Germany's Sovereign Tech Agency and facilitated by OSTIF and Quarkslab.

On October 21, 2026, PHP Foundation Executive Director Roman Pronskiy published a remarkably candid post-mortem on the official PHP Foundation blog, acknowledging that leaving the bug unpatched for two years was a "structural failure":

"In 2024, during the security audit facilitated by OSTIF and Quarkslab and funded by the Sovereign Tech Agency, a PHP core developer identified the out-of-memory error handling issue that forms part of CVE-2026-109618. At the time, no concrete exploit path was known, and the proposed fixes carried trade-offs that delayed consensus. Looking back, failing to resolve this earlier was a structural failure."

Why did a known memory corruption primitive sit unresolved for two years? Investigative reporting by The Next Web and BBC News laid bare the fragile human reality beneath the world's web infrastructure:

• 13 developers carrying 70% of the web: The PHP Foundation, which stewards the runtime powering nearly seven out of ten websites globally, funds a combined total of just 13 full-time and part-time core developers. Until October 2026, the foundation had neither a dedicated security project manager nor a mandatory escalation mechanism to break technical deadlocks. When the OOM issue was raised in 2024, nobody could hand-craft an end-to-end RCE proof of concept, whereas fixing the root cause required invasive engine changes that risked breaking backward compatibility and crashing third-party C extensions. Competing patch proposals stalled in consensus-driven mailing list debates for two full years.
• One Czech volunteer's 48-hour sleepless marathon: Even after upstream PHP released source patches, millions of production servers could not consume raw C tarballs directly. The primary APT package repository for PHP across the global Debian and Ubuntu ecosystem (deb.sury.org) has for years been maintained single-handedly in the spare time of one Czech volunteer developer, Ondřej Surý. When PHP2Shell broke, Surý went nearly 48 hours without sleep, working alone to backport, build, test, and publish binary packages across every active and legacy branch so that millions of Linux administrators worldwide could run apt upgrade.
• "Finding bugs is no longer the expensive part": During the exact same week PHP2Shell detonated, OpenAI CEO Sam Altman publicly conceded, "I no longer think we’re going to be able to patch all bugs." Anthropic Deputy CISO Jason Clinton warned that the industry faces a "vulnerability tsunami" where "there won’t be enough time to patch critical infrastructure." And former CISA Director Chris Krebs estimated in a CNBC interview that "3% of all critical vulnerabilities ever discovered have been found in the last month."

As the Trail of Bits engineering team summarized in their reflection on the "Patch the Planet" initiative:

"If it wasn’t already clear from the last several months of security news, this week makes one thing clear: the expensive part of security work has moved... The advantage is no longer in finding bugs, but everything after: confirming a finding, getting its severity right, writing a patch a maintainer will accept, hardening the surrounding code, making long-term improvements to prevent similar issues in the future, and coordinating a disclosure."

For twenty years, open-source security rested on an unspoken buffer: deep architectural flaws were so difficult to weaponize into reliable exploits that maintainers had years to debate backward compatibility until someone proved a working PoC. Frontier AI models erased that buffer overnight. When an LLM agent can turn a twenty-year-old state-machine crack into a 15-minute automated root weapon in days, expecting a dozen part-time maintainers and solo volunteers to absorb an industrial compute flood out of goodwill is mathematically unsustainable.

For hyperscalers and frontier AI labs, running autonomous models to rack up CVE leaderboards and dumping hundreds of bug reports onto exhausted volunteer maintainers is not a net contribution to global security. Funding full-time security engineering staff inside critical open-source foundations—and using AI to deliver regression-tested, backward-compatible patches rather than just crash reproducers—is the only way to pay down the technical debt now coming due.

For engineering and operations teams defending production infrastructure today, the lessons of Black October translate into three immediate actions:

1. Patch PHP runtimes and lock down request boundaries immediately: Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distribution's corresponding backported security build. Where legacy constraints prevent immediate upgrades, explicitly set session.upload_progress.enabled = 0 in php.ini, eliminate runtime ini_set calls that dynamically switch session.serialize_handler (mitigating the related flaw CVE-2026-115560), enforce strict limits on chunked transfer encoding and request body sizes at the reverse-proxy layer (Nginx / Cloudflare), and lower PHP-FPM pm.max_requests thresholds to recycle worker processes aggressively.
2. Audit cross-language native dependencies and embedded appliances: Update brotli decoding libraries across Node.js (22.23.4 / 24.22.1 / 26.12.1), Bun (1.4.4), .NET (8.0.33 / 9.0.22 / 10.0.14), and Python environments to remediate CVE-2026-111497. Inventory all perimeter firewalls, VPN gateways, and NAS appliances that embed legacy PHP management interfaces, and remove management planes from direct public internet exposure immediately.
3. Sanitize AI toolchains and rotate exposed credentials: Any environment that pulled litellm==1.107.0 (via PyPI or container registries) on October 21, 2026 cannot rely on a simple version downgrade. Inspect host Python site-packages directories for cook.pth, cook.py, sitecustomize.py, and /tmp/.pc_once_* artifacts, rotate every cloud provider credential, LLM API key, and database password accessible from affected hosts, and disable unredacted response-body logging across all AI gateway proxies.