PHP2Shell exploited, LiteLLM poisoned, Fortinet fixes with no CVEs | Cyber Security News Oct 22
Attackers are now exploiting PHP2Shell, a poisoned LiteLLM release carried a stealer for AI and cloud keys, and Fortinet shipped critical fixes while holding the CVEs until November 10. Every version number and every fix in this episode was checked against the vendor's own advisory or the researchers' report before it aired. Today's question: How do you check that your security alerts still reach a person? Reply in the comments or at feedback@defensivesecurity.org.
1. Update: PHP2Shell is now being exploited - CVE-2026-109618, CVE-2026-109619 - Do: Patch PHP on every internet-facing server -…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.