GoKawiilPHP, Node.js, GitLab, LiteLLM Patch Critical Flaws in Same Week
Between October 16 and 23, 2026, PHP, Node.js, GitLab, LiteLLM, OpenCode and the eMudhra certificate authority each disclosed serious security incidents. PHP, Node.js and GitLab all shipped fixes on October 21, the same day a bad LiteLLM release was pushed out. Amazon's MadPot honeypots recorded attempts to exploit the PHP flaws four days before they were publicly disclosed.
GoKawiil's interpretation of the reporting above, not reported fact.
The clustering of critical fixes in a single week means organizations must simultaneously locate every affected PHP, Node.js and GitLab instance across their infrastructure before attackers reach them, which can take far longer than applying the patch itself. Teams without a reliable asset inventory may spend a week tracing ownership and exposure through ad hoc coordination, a delay that matters given evidence of pre-disclosure exploitation attempts against the PHP bugs.
- PHP, Node.js and GitLab released fixes for critical flaws on the same day, October 21, 2026
- Amazon's MadPot honeypots detected PHP exploit attempts before the vulnerabilities were disclosed
- The GitLab flaw, rated CVSS 10.0, affects self-managed instances back to GitLab 7.0 with no workaround available
Source: cloudsleuth.io — Cloud Sleuth, 2026-10-27
Published there as: “PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.