Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. INFRASTRUCTURE: Critical PHP RCE & cPanel Mass-Scanning

The "PHP-ocalypse" event has escalated as active exploitation data confirms two dormant vulnerabilities are now being targeted at scale [1, 5]. Shadowserver reports over 550,000 servers remain potentially vulnerable to cPanel/WHM-related RCE [7]. Attackers are utilizing leaked zero-day details to integrate these flaws into automated botnets [5].

Mass Exploitation of PHP-FPM / cPanel Environments — Remote Code Execution

• CVE / severity: CVE-2026-109618 and CVE-2026-41940 / CVSS 9.8 (Critical) [6, 7]
• Affected versions: PHP versions on Windows and specific cPanel/WHM versions (ea-php and alt-php binaries) [6, 9]
• Fixed in: PHP emergency patches (Oct 23/24) and cPanel security releases [7, 9]
• Action now:
  • Run the following check on cPanel servers: for b in /opt/alt/php[0-9]*/usr/bin/php /opt/cpanel/ea-php*/root/usr/bin/php; do [ -e "$b" ] || continue; p=$(rpm -qf "$b"); rpm -q --changelog "$p" | grep -q 'CVE-2026-109618' && echo "$p: FIXED" || echo "$p: NOT FIXED"; done [6]
  • Update via: dnf update or /scripts/upcp [6]
  • Restart services: /scripts/restartsrv_apache_php_fpm and /scripts/restartsrv_httpd --stop && /scripts/restartsrv_httpd --start [6]

2. WORDPRESS & CMS: Object Injection & Supply Chain Risks

A new critical deserialization flaw has been identified in the Paytium plugin, which can lead to PHP Object Injection, while 50,000 sites remain exposed to RCE through an unpatched backup plugin [4, 9].

Paytium Plugin Object Injection — Potential Remote Code Execution

• CVE / severity: CVE-2026-114196 / Severity not disclosed (High/Critical) [4]
• Affected versions: Paytium <= (All versions prior to current release) [4]
• Fixed in: Not disclosed in sources; check for latest plugin update [4]
• Action now:
  • Update plugin: wp plugin update paytium immediately.
  • Audit site for unauthorized administrator accounts or suspicious .php files in wp-content/uploads.

3. SUPPLY CHAIN: LiteLLM Backdoor & Python Package Poisoning

Security researchers discovered a master key leak for LiteLLM that allowed attackers to steal GitHub tokens and compromise a PyPI release, leading to a backdoor installation on servers using these AI-integration tools [8].

LiteLLM Master Key Leak — Data Theft & Backdoor Installation

• CVE / severity: No CVE assigned / Critical [8]
• Affected versions: Infrastructure using LiteLLM with exposed master keys; specific poisoned PyPI packages [8]
• Fixed in: Master key revocation by vendor [8]
• Action now:
  • Rotate all GitHub tokens and credentials that may have been stored in LiteLLM environments [8].
  • Verify integrity of Python environments: pip list and check for unauthorized packages or versions released in the last 48 hours.

4. WINDOWS SHELL: Active Zero-Day Exploitation

Microsoft has issued an emergency patch for an actively exploited zero-day vulnerability in the Windows Shell, bypassing critical security features [12]. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog [10].

Windows Shell Security Feature Bypass — Active Zero-Day

• CVE / severity: CVE-2026-96951 / Severity Critical [12]
• Affected versions: Windows Server 2019, 2022, and 2025; Windows 10/11 [12]
• Fixed in: October 2026 Security Updates [12]
• Action now:
  • Apply Windows Updates immediately via WSUS or Windows Update [12].
  • Monitor for unusual explorer.exe or cmd.exe child processes initiated via web browsers or mail clients.