PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch

Between October 16 and 23, 2026, several major security incidents demanded rapid action: PHP had two pre-authentication remote-code-execution flaws, with exploitation attempts reported before disclosure; Node.js patched a serious flaw in its Brotli decoder; and self-managed GitLab faced an unauthenticated RCE rated CVSS 10. LiteLLM 1.107.0 contained credential-stealing malware, while an OpenCode Console breach may have exposed users’ AI-provider keys. Separately, eight eMudhra intermediate certificate keys were dangerously weak, including one equal to the number four. Fixes ranged from upgrading PHP, Node.js and GitLab to rebuilding affected LiteLLM environments and rotating credentials. The central challenge is not applying a known fix, but quickly finding every affected workload, its owner and its access.

The argument is that shrinking attack windows makes trustworthy asset and software inventories essential: time spent discovering exposure now adds directly to time attackers have to act. A practical response checks where vulnerable software runs, whether it is internet-accessible, who owns it, what identities and resources it can access, and where exposed secrets or certificates are also used. AWS and Azure provide read-only tools to investigate functions, applications, virtual machines, network exposure and ownership, but these have limits: resource names and tags may be unreliable, public load balancers can hide exposure, logs expire, and cloud control planes cannot identify software inside every VM or container. The guidance therefore emphasizes inventory coverage and tracing relationships between workloads, identities, credentials and dependent systems - not merely finding a vulnerable package.