# KLM Innovation Security Monitor
**Date:** October 23, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
PHP2Shell got worse in two ways today. Palo Alto Networks Unit 42 says it saw an attacker using an agentic AI attack platform after exploitation, reaching password hashes and MFA secrets at a European government entity within two hours. PHP also published a third, configuration-dependent RCE issue, CVE-2026-115560, with a mitigation and no patch yet. Railway's preliminary report puts its exposure at up to about 100,000 workspaces and says the attacker wanted AI provider keys for distillation. CISA added Arista VeloCloud Orchestrator and the Collabora CODE Server app for Nextcloud to KEV with a Monday, October 26th deadline. Imperva showed that the Node.js Brotli bug, CVE-2026-111497, can run code on an official Node.js build. Also today: ransomware affiliates who ran their intrusions through OpenCode and commercial models, an infostealer built to grab AI tool sessions, and a batch of agent framework bugs in PraisonAI, Google ADK for Java, Aider and AWS MCP Server.

## Headline Developments

### 1. PHP2Shell: Unit 42 reports an agentic attacker after exploitation, and PHP flags a third RCE path (CRITICAL)
**Source:** [Unit 42: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) (October 23rd)
- We covered the PHP2Shell releases on October 21st. New today: Unit 42 says it observed attackers using agentic AI attack platforms for post-exploitation. In one case, it says the attackers targeted a government entity in Europe and, within two hours of the initial exploitation, had accessed password hashes and multi-factor authentication secrets, opened an NTLM-relay tunnel into Active Directory and tried to escalate to Domain Admin. Unit 42 points to machine-parseable section delimiters around each command batch and short, quick pivots after failures as signs of an agentic attacker. It also counts more than 22.6 million exposed instances that may be vulnerable.
- Other researchers still describe mostly failed attempts. The Hacker News reports that Sophos saw unsuccessful attempts to install a Mirai variant called Potassium, that Cloudflare counted millions of exploit attempts by early October 22nd, and that Previdian has seen no successful remote code execution, an assessment Wordfence and others echo. It also reports that VulnCheck built a chain that uses a memory leak to bypass ASLR on x86-64, even with PHP's recommended production error-display setting ([The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware](https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html), October 23rd). Treat Unit 42's case as a single-vendor report until others confirm successful exploitation.
- PHP published an informational advisory on October 23rd for CVE-2026-115560, an "unlikely RCE vector" in session upload progress. It needs an application that sets `session.serialize_handler` to `php_binary` or `php_serialize` and switches it to `php` at runtime before `session_start()`, with upload progress still on. PHP says to set `session.upload_progress.enabled=0` until the next regular release, and notes that's the same mitigation it listed for CVE-2026-109619 ([PHP: Informational advisory: Session upload progress](https://www.php.net/archive/2026.php#2026-10-23-1); [oss-security: PHP Informational advisory (CVE-2026-115560)](https://www.openwall.com/lists/oss-security/2026/10/23/23)). The CVE isn't on NVD yet.
- NVD has now analyzed both original CVEs: CVE-2026-109618 at CVSS 3.1 9.8 and CVE-2026-109619 at 8.1 ([NVD: CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618); [NVD: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619)). Neither is on CISA's KEV catalog yet.

**Why this matters:** It's CRITICAL because the fix has been out for two days and the clock is now measured in hours. Unit 42's case shows what happens after a web shell when an agent drives it: credential theft and an Active Directory pivot in under two hours. If you can't update every PHP worker today, turn off session upload progress in `php.ini` or the FPM pool and restart.

### 2. Railway's preliminary report: up to about 100,000 workspaces exposed, and the attacker wanted AI keys for distillation (HIGH)
**Source:** [Railway: Preliminary Report: Oct 21st Security Incident](https://blog.railway.com/p/preliminary-report-october-security-incident) (October 22nd)
- We covered Railway's rotate-everything notice on October 22nd. New today: Railway says at most 1.85% of all workspaces, about 100,000, had some environment variables potentially compromised. Because the keys were envelope encrypted, Railway says it can't tell which specific variables were decrypted, so it's also reaching out to users it considers high risk based on the attack pattern.
- Railway now dates the attack from October 20th at 13:58 UTC to October 22nd at 03:32 UTC. Its timeline says the attacker escalated privilege in build infrastructure, pulled encrypted secrets, then used credentials for Railway's CI environment to decrypt artifacts holding more API access, and ran an unauthorized query of encrypted environment variables.
- Railway says early evidence shows the attacker was trying to get AI provider API keys "to perform distillation attacks," and that it believes the attacker had access to abliterated models and substantial compute. It says it worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe and others to revoke keys, and that out of caution it notified providers about up to every key it stored, so more than 100,000 users got upstream reset requests. A revocation notice doesn't by itself mean your key was exposed.
- Railway says user accounts weren't accessed, but it isn't ruling out access to user source code until its final report. It moved builds from multi-tenant to single-tenant infrastructure, a rollout it had planned for next week. It recommends that all customers who signed up before October 21st rotate keys stored on Railway, and advises all customers to remove public network access to databases and review GitHub and registry audit logs.

**Why this matters:** It's HIGH because this is the second hosting platform this month to say the attacker was hunting AI keys, after Zeabur. A build system that can reach the store of customer secrets is a single point of failure. Railway's own guidance to take databases off the public network is worth following on any platform.

### 3. CISA adds Arista VeloCloud Orchestrator and Collabora's CODE Server app to KEV, due Monday (HIGH)
**Source:** [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (both added October 23rd, due October 26th)
- **Arista VeloCloud Orchestrator (CVE-2026-114625):** Arista says any authenticated user on an on-prem VCO, down to the lowest built-in role, Enterprise Read Only, can gain operator privileges and pose as a local "superuser operator," reaching internal-only functionality. Arista says it found the issue and that it's known to be actively exploited. It's fixed in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12, and hosted and Dedicated VCO are already patched. Arista says VCO is exposed by default and no configuration prevents it ([Arista: Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199); [NVD: CVE-2026-114625](https://nvd.nist.gov/vuln/detail/CVE-2026-114625), CVSS 3.1 9.9).
- **Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447):** an unauthenticated OS command injection in the `richdocumentscode` app's proxy, reachable when the CODE server isn't running, for example right after a restart. NVD says it was exploited in the wild in September and October. It's fixed in `richdocumentscode` 26.4.303, and standalone Collabora Online servers aren't affected ([GitHub: Collabora advisory GHSA-g3vx-3m76-fghh](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh); [NVD: CVE-2026-110447](https://nvd.nist.gov/vuln/detail/CVE-2026-110447), CVSS 4.0 9.2). Nextcloud forum users report finding web shells in the app directory ([Nextcloud Community: To Collabora Built-in User: Update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516)).
- CISA marks both as requiring forensic triage.

**Why this matters:** It's HIGH because a three-day KEV clock over a weekend is short, and both are management or collaboration planes that hold other people's data. VeloCloud's bug turns the lowest tenant login into operator access on the orchestrator, so every tenant account counts as an admin path until you patch.

### 4. Node2Shell: Imperva runs code on an official Node.js build through the Brotli decoder bug (HIGH)
**Source:** [Imperva: Node2Shell: From Brotli Data to Remote Code Execution](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/) (October 22nd)
- CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js. Node.js says an attacker who can supply Brotli data that an app decompresses with `node:zlib` can crash it, read process memory or run code. It fixed the bug on October 21st in 22.23.4, 24.22.1 and 26.12.1, the same releases that carried the eMudhra certificate fix ([Node.js: Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). Node.js credits OpenAI Codex Security with the report.
- Imperva says its proof of concept ran supplied code on the official Node.js 24.22.0 Linux arm64 image, through both a compressed response read with the built-in `fetch()` and incoming Brotli request bodies parsed by Express 5 and body-parser 2. Imperva says it took multiple attempts, it didn't test every Node.js build or application, and 24.22.1 rejected the same inputs.
- NVD's record, from Google's CNA, describes the bug in Google Brotli 1.0.3 through 1.2.0 and says to update to 1.0.10, 1.1.1 or 1.2.1, so it's not only a Node.js problem ([NVD: CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497), CVSS 4.0 9.2, awaiting analysis). It isn't on KEV. The Hacker News notes that an earlier public proof of concept only reached code execution on a deliberately weakened test build, and that no in-the-wild exploitation had been reported as of October 22nd ([The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data](https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html), October 23rd).

**Why this matters:** It's HIGH because Brotli decoding sits on both sides of ordinary API traffic, in request bodies you accept and in responses you fetch, and Node binaries inside container images don't get host-level package updates. If you updated Node for eMudhra this week, you have this fix too. Check bundled Brotli libraries in other runtimes as well.

### 5. Attackers are building on AI tools: ransomware affiliates ran intrusions through OpenCode, and an infostealer goes after AI sessions (MEDIUM)
**Source:** [SOCRadar: INC and The Gentlemen Ransomware: Exposed AI Infrastructure](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/) (published October 20th, updated October 23rd)
- SOCRadar says exposed servers run by affiliates of the INC and The Gentlemen ransomware groups held AI session logs, a knowledge base and an agent framework the operators call Phantom. It says the operators ran intrusions through OpenCode with commercial models hosted on OpenRouter, logging 8,257 messages across 133 sessions and more than $23,920 in AI spend. A human operator approved each step. SOCRadar says the models were standard commercial ones, and when they refused, the operator rewrote requests as "Authorized Red Team Assessment Request" templates instead of switching models. The servers also held 32 MCP servers labeled WormGPT, and the records name 62 organizations, 36 of them in the US. SOCRadar says its edge-device exploitation figures come from operator records that aren't independently verified. The Hacker News covered the findings on October 23rd ([The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions](https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html)).
- Check Point Research says a newly observed infostealer, Aokigahara, has a module aimed at authentication files, session data and configuration for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant. It also goes after Git credentials, SSH files and AWS, Azure and Google Cloud credentials. Check Point says it hasn't confirmed how the operators use or sell the stolen AI access ([Check Point: Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About the New Developer Attack Surface](https://blog.checkpoint.com/ai-security/infostealers-are-targeting-ai-what-aokigahara-infostealer-reveals-about-the-new-developer-attack-surface/), October 23rd).

**Why this matters:** It's MEDIUM because neither is a new bug to patch, but together they show both directions. Attackers run ordinary coding agents on paid model accounts, and they steal AI sessions from developer laptops. AI tool tokens on an endpoint are credentials, and they belong in your incident scoping.

### 6. More agent framework bugs: PraisonAI's open AgentOS, Google ADK for Java's dev server, Aider's repo config (MEDIUM)
**Source:** [GitHub: PraisonAI advisory GHSA-892r-p3jq-jp24, AgentOS Remains Unauthenticated After GHSA-pm96 and Allows Remote Agent Invocation](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24) (CVE published on NVD October 23rd)
- **PraisonAI:** AgentOS, from 4.2.1 through 4.6.57, still registers `GET /api/agents` and `POST /api/chat` without authentication, so any client that can reach it can drive the deployed agents and whatever tools, memory and paid model calls they hold. It's fixed in 4.6.59. The advisory calls this an incomplete fix of an earlier AgentOS advisory (CVE-2026-57116, CVSS 3.1 9.8; [NVD: CVE-2026-57116](https://nvd.nist.gov/vuln/detail/CVE-2026-57116)). Three more landed the same day: the Slack bot skipped its user and channel allowlists on `app_mention` events (CVE-2026-56835, 8.3; [GHSA-qvpf-j64c-jmhr](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qvpf-j64c-jmhr)), the Linear bot accepted unsigned webhooks when no secret was set (CVE-2026-56837, 8.6; [GHSA-fc26-m9pf-v56q](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q)), and an untrusted recipe could approve `execute_command` for itself, fixed in 4.6.61 (CVE-2026-57142, 7.8; [GHSA-7qw2-w5rc-37x2](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7qw2-w5rc-37x2)).
- **Google ADK for Java:** the ADK Web development server's `/run_live` WebSocket accepted connections from any origin by default, so a malicious web page a developer visits while it's running could control the local agent and read its data. It's fixed in `google-adk-dev` and `google-adk-maven-plugin` 1.13.0 (CVE-2026-107858, CVSS 4.0 7.2; [NVD: CVE-2026-107858](https://nvd.nist.gov/vuln/detail/CVE-2026-107858)).
- **Aider:** through 0.86.2, a `.aider.conf.yml` in a cloned repository is loaded without a trust prompt, and its `notifications-command` or `editor` values run through a shell after a model reply or `/editor` (CVE-2026-115726, CVSS 4.0 8.5; [NVD: CVE-2026-115726](https://nvd.nist.gov/vuln/detail/CVE-2026-115726)). The public report is still open, and we didn't find a fixed release ([GitHub: Aider issue 5885](https://github.com/Aider-AI/aider/issues/5885)).
- **AWS MCP Server:** AWS says an incomplete blocklist in the `run_script` Python validator let an authenticated user run code inside their own isolated session. It's fixed service-side, and no customer action is needed (CVE-2026-115845; [AWS Security Bulletin 2026-149-aws](https://aws.amazon.com/security/security-bulletins/2026-149-aws/)).

**Why this matters:** It's MEDIUM because each needs a reachable server or an opened repo, but it's the same pattern again. Agent servers ship reachable with no login or origin check, and agent tools trust config files they didn't write. Aider is the one to watch, since there's no fix and the trigger is just opening a repo.

## Continuity Footnotes
- **CISA KEV:** the SiteGuard deadline and the first Plex Media Server deadlines, covered October 20th, were due today, Friday, October 23rd. The remaining Plex items and Siemens Software Center are due November 3rd. PHP2Shell, GitLab CVE-2026-110264 and LiteLLM CVE-2026-114612 still aren't on the catalog.
- **Zeabur and Railway:** Zeabur was covered October 16th and 22nd, with nothing new today. Railway's new numbers are in Story 2.

## Pattern Analysis
1. **Agents on the attacker's side, measured in hours (October 21st to 23rd):** Unit 42's agentic post-exploitation (Story 1) and the SOCRadar operators' OpenCode sessions (Story 5) both show attackers handing the busywork to an agent while a human approves. Patch windows and detection windows both shrink.
2. **AI keys are the loot (October 16th to 23rd):** Railway's attacker wanted AI keys for distillation (Story 2), Zeabur's attacker hunted AI keys (October 22nd), and Aokigahara steals AI sessions from laptops (Story 5). Wherever AI keys and sessions sit, they're a target now.
3. **Runtimes under the API (October 21st to 23rd):** PHP2Shell (Story 1) and Node2Shell (Story 4) live in the language runtime, not the app. Your app code can be clean and still exposed.
4. **Agent servers that listen to anyone (October 19th to 23rd):** PraisonAI AgentOS and ADK Web (Story 6) join this week's open agent servers. Bind to loopback, require auth and check origins by default.

## Recommended Actions
**Immediate (this week):**
1. **PHP:** update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker. Set `session.upload_progress.enabled=0` in `php.ini` or the FPM pool until PHP's next regular release. Hunt for web server processes spawning shells or reading credential files.
2. **KEV by Monday, October 26th:** upgrade on-prem VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and restrict its web interface to admin networks. Update `richdocumentscode` to 26.4.303 or remove it, then look for unexpected PHP files in the app directory.
3. **Node.js:** run 22.23.4, 24.22.1 or 26.12.1 everywhere, including inside container images. Update standalone Brotli libraries to 1.0.10, 1.1.1 or 1.2.1.
4. **Railway users who signed up before October 21st:** finish rotating stored keys, revoke old values at the provider and take databases off the public network.
5. **Agent tools:** PraisonAI 4.6.61, ADK for Java 1.13.0. Don't open untrusted repos with Aider until it ships a fix, or check for a repo-root `.aider.conf.yml` first.

**This month:**
6. **AI sessions as credentials:** add AI tool tokens and session files (coding assistants, desktop chat apps, CLIs) to your endpoint compromise playbook, next to browser cookies and cloud keys.
7. **Model spend monitoring:** alert on unusual usage on your model provider accounts. Stolen keys and distillation both show up there first.

**Ongoing:**
8. Keep an inventory of runtime versions (PHP, Node, bundled libraries) per image, so emergency releases take hours, not weeks.
9. Default every agent server to loopback with auth on, and treat agent config files in repos as untrusted input.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| PHP2Shell (CVE-2026-109618 / 109619) with agentic post-exploitation reported; CVE-2026-115560 unpatched | CRITICAL | Update PHP and restart workers; disable session upload progress; hunt |
| Railway breach, up to about 100,000 workspaces, AI keys targeted | HIGH | Rotate keys, revoke at provider, remove public DB access |
| KEV: VeloCloud Orchestrator CVE-2026-114625 and Collabora CODE Server CVE-2026-110447 (due October 26th) | HIGH | VCO 5.2.3.18 / 6.1.3.10 / 6.4.2.12; `richdocumentscode` 26.4.303; check for web shells |
| Node2Shell, Brotli CVE-2026-111497 | HIGH | Node 22.23.4 / 24.22.1 / 26.12.1; Brotli 1.0.10 / 1.1.1 / 1.2.1 |
| AI-run ransomware operations and AI session theft | MEDIUM | Treat AI sessions as credentials; monitor model spend |
| PraisonAI, ADK for Java, Aider and AWS MCP Server bugs | MEDIUM | Upgrade; loopback and auth by default; distrust repo config |

## Sources
- [Unit 42: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/)
- [The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware](https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html)
- [PHP: Informational advisory: Session upload progress](https://www.php.net/archive/2026.php#2026-10-23-1)
- [oss-security: PHP Informational advisory: Session upload progress (CVE-2026-115560)](https://www.openwall.com/lists/oss-security/2026/10/23/23)
- [NVD: CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618)
- [NVD: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619)
- [Railway: Preliminary Report: Oct 21st Security Incident](https://blog.railway.com/p/preliminary-report-october-security-incident)
- [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Arista: Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)
- [NVD: CVE-2026-114625](https://nvd.nist.gov/vuln/detail/CVE-2026-114625)
- [GitHub: Collabora advisory GHSA-g3vx-3m76-fghh](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh)
- [NVD: CVE-2026-110447](https://nvd.nist.gov/vuln/detail/CVE-2026-110447)
- [Nextcloud Community: To Collabora Built-in User: Update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516)
- [Imperva: Node2Shell: From Brotli Data to Remote Code Execution](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
- [The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data](https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html)
- [Node.js: Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [NVD: CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497)
- [SOCRadar: INC and The Gentlemen Ransomware: Exposed AI Infrastructure](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/)
- [The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions](https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html)
- [Check Point: Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About the New Developer Attack Surface](https://blog.checkpoint.com/ai-security/infostealers-are-targeting-ai-what-aokigahara-infostealer-reveals-about-the-new-developer-attack-surface/)
- [GitHub: PraisonAI advisory GHSA-892r-p3jq-jp24](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24)
- [NVD: CVE-2026-57116](https://nvd.nist.gov/vuln/detail/CVE-2026-57116)
- [GitHub: PraisonAI advisory GHSA-qvpf-j64c-jmhr](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qvpf-j64c-jmhr)
- [GitHub: PraisonAI advisory GHSA-fc26-m9pf-v56q](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q)
- [GitHub: PraisonAI advisory GHSA-7qw2-w5rc-37x2](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7qw2-w5rc-37x2)
- [NVD: CVE-2026-107858](https://nvd.nist.gov/vuln/detail/CVE-2026-107858)
- [NVD: CVE-2026-115726](https://nvd.nist.gov/vuln/detail/CVE-2026-115726)
- [GitHub: Aider issue 5885](https://github.com/Aider-AI/aider/issues/5885)
- [AWS Security Bulletin 2026-149-aws: AWS MCP Server](https://aws.amazon.com/security/security-bulletins/2026-149-aws/)

*Informational security guidance. Not certification.*