PHP: WordPress also needs a patched runtime
Fixes for CVE-2026-109618 and CVE-2026-109619 have been available since October 21, 2026. Both PHP vulnerabilities can allow unauthenticated code execution with the web worker's privileges. PHP installations serving web requests are affected, including PHP-FPM and Apache with mod_php. Keeping WordPress, Drupal or Joomla current does not replace the PHP update.
The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For distribution or hosting packages, verify the vendor's backport. PHP 8.1 and earlier no longer receive regular security releases from the PHP project; these require a confirmed vendor fix or migration to a supported version.
Restart all affected workers after updating and verify the PHP version actually used by the web server. For managed hosting, obtain confirmation of the fix from the provider. Configuration changes do not provide complete protection. Temporarily take publicly accessible PHP services offline if they cannot be secured in time.
GitLab: update self-managed instances immediately
CVE-2026-110264 affects GitLab CE and EE from version 7.0 until the applicable fix. An integer overflow in the regular expression compiler can allow unauthenticated code execution under certain conditions. GitLab rates the vulnerability CVSS 3.1: 10.0.
Fixed versions are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Update self-managed instances to a fixed release, following the required upgrade path. GitLab.com is already patched. Also review server logs for unusual worker crashes and bursts of Org-mode rendering errors; installing an update does not rule out an earlier compromise.
LiteLLM: treat version 1.107.0 as a security incident
On October 21, malicious LiteLLM 1.107.0 wheels were distributed through PyPI, with affected container images on Docker Hub and GHCR. Mutable tags including latest, main-latest and main-stable temporarily pointed to affected images. Check the actual installed artifact and the image digest used.
The malware steals credentials and includes a backdoor loader. It can execute when Python starts, even if the application never imports LiteLLM. Do not start Python or pip on affected systems as the first diagnostic or update step.
Isolate affected environments and preserve evidence. If Python ran with the malicious package or an affected image was executed, treat the environment as compromised and rebuild it from trusted artifacts. From a clean system, revoke or rotate the cloud, CI/CD, database and model-provider credentials it could access. A package downgrade alone does not address stolen secrets or possible persistence.