The IT week was the runtime. PHP2Shell is in the interpreter; Plex’s 1.43.3 label is not the build; LiteLLM’s Git tag is clean; Gheist already printed the private secrets.

19–26 October 2026. Eight new KEVs, catalog 2026.10.23 / 1,756. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — neither CVE is on KEV. Plex assume-compromise. Collabora 110447 and Arista 114625 due today. Storm-0940 named on last week’s SkyKick.

RWP Ventures · 2026-10-26 · 22 min read · priority 9.0

Executive summary

FACT: Last week the highest-leverage enterprise problem was the broker — a ConnectWise Cloud Backup publisher secret minting Graph tokens, ARMORY CASTLE on BeyondTrust Remote Support, UTA0576 already root on patched Connect Secure, Cisco splitting SEG 76519 out of September. Those tickets did not vanish. Microsoft named Storm-0940 and ARTEX on the SkyKick path. ConnectWise is targeting phased restore today. They are unfinished hunts on last week’s boxes. They are not this week’s pattern.

This week’s pattern is that the runtime you already run is the actor, and the close you already applied is still in.

CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.23 released 23 October 19:30 UTC, now holds 1,756 rows. Eight of those were added between 20 and 23 October. All eight carry ransomware-use Unknown. Two of them — Collabora CVE-2026-110447 and Arista CVE-2026-114625 — are due today, both with forensic triage Yes. Neither CVE-2026-109618 nor CVE-2026-109619 is on that list.

The material IT development this window is not those eight CVE rows.

On 21 October the PHP project shipped 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. They close two unauthenticated RCEs in php-src, not in WordPress, Drupal, Magento, or any plugin. CISA and the UK NCSC said take unpatched or EOL PHP offline. A CMS update does not change the interpreter. Distro packages keep the old upstream number. A WAF is not the patch. Catalog freeze still has no PHP row.

On 20 October CISA listed the four-CVE Plex2Shell chain. Plex had already said, 19 October, that an internet-facing server older than 1.43.3.10861 should be assumed compromised. 1.43.3 is not the fixed build. Patching does not empty Codecs or revoke the stolen admin token. CVE-2026-96656 was due 23 October with forensic triage Yes.

On 21 October LiteLLM’s official wheels and latest Docker tags shipped cook.pth / cook.py / sitecustomize.py. The Git tag v1.107.0 is clean. pip uninstall is not the close. Pinning 1.106.2 on a dirty interpreter is a second false green. Vendor RCA 23 October: unrevoked May master key, not a CVE.

On 25 October Wiz published Gheist. Stolen GitHub tokens since 15 September plant sync-check.yml. GitHub’s July hold stopped every public github.com run Wiz checked. Private repositories and GitHub Enterprise Server executed. Deleting the branch is not rotation.

On 23 October CISA listed Collabora CODE CVE-2026-110447 (disable is not the close; due today) and Arista VeloCloud CVE-2026-114625 (September’s floor is still in; due today).

ASSESSMENT: If the patch queue this week was last week’s SkyKick disable plus leftover BeyondTrust rebuild, you sequenced an identity ticket and called it done. The PHP worker that greened on a current WordPress is still 8.3.6. The Plex box that greened on 1.43.3 is still 10828. The venv that greened on a clean Git tag still runs cook.pth at interpreter start. The private repo whose public sibling sat at action_required already printed the secrets.

The week in one assessment

Four threads, one pattern: the product you already run is the initial-access path, and the control you already have is not the eviction. PHP’s request never has to reach application code. Plex’s codec loader runs .so files without a signature check. LiteLLM’s payload lives outside the application directory, so uninstall leaves it. Gheist rides GitHub’s own API; there is no attacker domain to block. Eight new KEV rows sit under that pattern only in part — Plex, Collabora, Arista, SiteGuard, Siemens. PHP, LiteLLM, and Gheist have no CVE on KEV. Last week’s SkyKick ticket got a name (Storm-0940) and a restore target (today); that is a catalog of unfinished broker work, not this week’s lead. Attackers keep buying the box that already executes: the interpreter, the startup hook, the Actions runner, the codec path, the Nextcloud proxy.php that still answers when the app is “disabled.”

1. Most important development

The runtime, not the CVE.

Do not collapse four facts. They are four tickets.

1. PHP2Shell is in php-src. CVE-2026-109618 (OOM corruption, GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (stale global state, GHSA-6wmf-4rv5-p3rp). PHP rates each CVSS v4.0 9.2. Highest demonstrated risk: Apache mod_php, before application code. PHP-FPM, php-cgi, FrankenPHP, LiteSpeed are in the affected set. Fixed trains: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. PHP 8.1 and older get no point release from the project. CISA 21 October, updated 23 October: take unpatched or EOL PHP offline; a WAF may help until the update; CISA has not observed successful exploitation as of that update. Amazon MadPot: attempt 17 October from 103.216.220.92, more 21 October 02:00–08:00 UTC, then “broadly exploited in the wild,” with success on production not established in that post. Huntress 21 October: no partner-base hits. Unit 42’s 23 October European-government write-up was later qualified — post-compromise activity on a vulnerable PHP application, PHP2Shell as initial access not confirmed. BleepingComputer 26 October relays Adel Karimi (Perplexity) honeypot RCE on Apache mod_php PHP 8.4.26; Marcus Hutchins called it the highest-quality confirmation he had seen. That is REPORTED sensor success, not a named production victim and not a KEV row. Catalog freeze 2026.10.23 / 1756: absent. Ubuntu 24.04’s fixed php8.3 is 8.3.6-0ubuntu0.24.04.13. php -v is not the close.

1. Plex2Shell is on KEV. A 1.43.3 label is not the fix. CVE-2026-96652 / 96654 / 96655 / 96656, listed 20 October. Unaffected starts at 1.43.3.10861. Censys: nearly 8,000 internet-facing hosts on 1.43.3.10828. Plex 19 October: internet-facing older than 10861, assume compromised. Confirmed payloads in public reporting: cryptominer and residential proxy, not ransomware. Forensic triage Yes only on 96656 (file write into Codecs). Clocks on 96654/96656 expired 23 October. Patching does not empty Codecs or revoke the admin token.

1. LiteLLM’s Git tag is clean. The wheel still runs at Python start. 21 October: litellm==1.107.0 wheels and Docker tags v1.107.0 / latest / main-latest / main-stable. Payload: cook.pth / cook.py / sitecustomize.py in site-packages, not under the litellm directory. PyPI window ~1 hour 44 minutes; Wiz ~49,000 downloads. 23 October RCA: unrevoked 27 May Agent Platform master key → 10 October org-owner GitHub CLI token from 69.48.229.143. Microsoft: because the hooks live outside the application directory, uninstall can leave them; starting Python — including starting pip — re-runs them. Same-day AWS instance-role use 16:20–17:01 UTC from 168.100.8.57 / 165.227.201.8. No LiteLLM CVE. Not on KEV. Enterprise private registry was out of scope.

1. Gheist already printed the private secrets. Wiz 25 October: stolen GitHub tokens since 15 September plant ci-sync-* branches and .github/workflows/sync-check.yml (ci: sync config). Secrets leave as base32 in Actions logs through GitHub’s API; the run is deleted seconds later. User agent gheist. >13,500 branches, >850 accounts. GitHub’s 28 July malicious-workflow hold stopped every public github.com run Wiz checked. Private repos and GHES executed. CloudTrail showed the organization’s own workflows assuming AWS roles from attacker branches. Distinct from GhostAction and from LiteLLM. Not a CVE. Not KEV. Deleting the branch is not rotation.

There is no confirmed OT or physical-process impact on any of these four. PHP on a plant historian web UI is an IT/web runtime. Plex on a NAS in an industrial closet is an endpoint. A Siemens Software Center ClickFix on an engineering workstation is an IT compromise of that PC; process impact belongs in [this week’s weekly OT](/posts/2026-10-23-weekly-ot-siemens-ssc-wago-hitachi/), not imported onto PHP2Shell. We do not have PLC-write evidence.

2. Active exploitation

CONFIRMED in KEV this window, catalog 2026.10.23:

Eight rows is not eight equivalent tickets. 110447 is unauthenticated OS command injection in Nextcloud’s optional CODE proxy when the local server is down. 114625 is authenticated SQLi (Enterprise Read Only is enough) on on-prem VCO. 96656 is the file-write end of an unauthenticated chain. 106931 is a Japan-heavy WAF, local-vector command injection, root/SYSTEM. 110936 is local authenticated DLL search-order on a workstation updater — ClickFix, not a WAN RCE.

CONFIRMED exploited this window, not in KEV:

• PHP2Shell CVE-2026-109618 / 109619. Vendor emergency release, CISA/NCSC take-offline, Amazon MadPot pre-disclosure attempt, Cloudflare WAF 03:02 UTC 21 October. CISA as of the 23 October alert update: not observed successful exploitation. Catalog has no row. Treat sensor RCE (Karimi 26 October, REPORTED) as pressure, not as a BOD 26-04 clock.
• LiteLLM 1.107.0 wheels. Confirmed artifact compromise, confirmed AWS follow-on. No CVE. BOD 26-04 is a CVE instrument.
• Gheist. Stolen-token Actions abuse, private/GHES execution. No CVE.

CONFIRMED exploited, already in KEV last week, catalog increment this window:

• Siemens Software Center CVE-2026-110936. [Daily Top 20 October](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/) on ProductCERT wild-use. CISA listed it the next day. Due 3 November, forensic triage No. That is a catalog close on yesterday’s IT workstation story, already the lead of [weekly OT 23 October](/posts/2026-10-23-weekly-ot-siemens-ssc-wago-hitachi/). Not this week’s IT interrupt.

CONFIRMED exploited, already in KEV, no material field flip this window:

• CVE-2026-102764 BeyondTrust Remote Support. Clock expired 19 October. No new Mandiant victim increment past two in this retrieval.
• CVE-2026-104935 Ivanti Connect Secure. Clock expired 16 October. Privilege-escalation still unpatched / no CVE as of last week’s freeze; no vendor PE ship in this window.
• CVE-2026-76519 Cisco SEG. Clock expired 17 October.
• CVE-2026-0257 GlobalProtect, ransomware-use Known since 29 May. No new ReliaQuest increment.

CONFIRMED exploited, still not in KEV: CVE-2026-58138 Orkes / conductor-oss Conductor. Same status as five weeks ago. Named actor: UNKNOWN.

Not claimed exploited, still not KEV: Check Point CVE-2026-85103 and management CVE-2026-91843. NetScaler CVE-2026-107406. GitLab CVE-2026-110264 (CVSS 10.0, 7.0 through 19.5.0, no confirmed ITW). Node.js Brotli CVE-2026-111497 (Node2Shell; PoC exists; no confirmed ITW). HPE ArubaOS HPESBNW05162 (eight CVSS 10.0, no public ITW claimed).

SkyKick still has no CVE. Microsoft’s Storm-0940 assessment does not create a KEV row.

3. Threat actor / campaign activity

Storm-0940 / ARTEX on ConnectWise Cloud Backup. Microsoft Threat Intelligence, 21 October: assesses that China-state-aligned Storm-0940 was responsible for the ConnectWise multi-tenant application compromise. The material increment versus [last week’s weekly IT](/posts/2026-10-19-weekly-it-broker-skykick-beyondtrust-ivanti/) is the name, the tool, and the attempt count — not a new publisher secret.

Do not collapse four numbers.

• Huntress floor, last week: ~1,000 Entra tenants with any sign-in from 144.172.64.128, 300+ successful. Those remain the confirmed-success metrics we have from Huntress.
• Microsoft: Storm-0940 used ARTEX to attempt sign-in to more than 2,250 tenants, peaking around 2,900 attempts per minute. Attempts are not successes.
• Microsoft: 10–14 October password spray from 144.172.64.99 against 327 accounts at eight organizations, >151,000 failed logons, no successful authentication in that spray. Last week .99 was a vendor-shared hunt IP; this week Microsoft independently ties it to the spray. That is a field flip on the IP, not on tenant compromise.
• ConnectWise Trust Center freeze 25 October 14:00 UTC: unauthorized access to Cloud Backup application credentials; phased partner onboarding targeted for Monday 26 October, subject to checks; backup-restore access first, full re-enrollment later. SaaS Security and Cloud Management remain in the three-service set. Next daily update was scheduled by 26 October 14:00 UTC. This article’s freeze is before that 14:00 window. Restoration is not confirmed complete here.

ConnectWise still has not published a matching actor name on the Trust Center page retrieved for this run. Microsoft’s assessment is the attribution. Confidence: Microsoft’s, not ours to upgrade. ARTEX is an open-source agentic pentest framework; Microsoft dates Storm-0940’s use to early September. Do not convert “AI-enabled” into a new initial-access class. The access path remains a publisher credential that inherited every consent the backup app already had.

ARMORY CASTLE / UNC5221. No material increment past two confirmed BeyondTrust victims.

UTA0576. No material increment. PE still unpatched.

Gheist operator: UNKNOWN. Wiz traces some tokens to infostealer logs and earlier supply-chain exposure, including the March Trivy window. Overlap with Megalodon / PolinRider / lure-repo accounts is shared compromised identity, not attribution of Gheist to those campaigns. Roughly two-thirds of implicated accounts were gone from GitHub by 24 October; Wiz assesses response, not the operator going quiet.

LiteLLM 1.107.0 operator: UNKNOWN. Second documented LiteLLM hijack in 2026 (March 1.82.x was a different payload). JFrog: treat as separate. No public tie to TeamPCP.

PHP2Shell actors: UNKNOWN. Amazon assessed multiple actors from anonymized infrastructure. No named cluster.

SafePay. CISA/FBI/USSS/LKA Rheinland-Pfalz/NCA AA26-293A, 20 October: ≥600 victims since August 2024. Entry CVEs already on KEV (Cisco ASA 2020-3259, 2023-20269, Veeam 2023-27532, 2024-40711, SonicWall 2024-40766). Joint TTP pack, not this week’s interrupt.

Do not convert a SkyKick install at an industrial customer, or PHP on a historian, into confirmed process impact.

4. Vulnerabilities to prioritize

Order is operator consequence, not CVSS.

1. PHP2Shell CVE-2026-109618 / 109619 — inventory the interpreter, tonight. Every process that serves HTTP through PHP. Patch or distro-backport, restart every worker. Compare the package, not php -v. Official Docker images: rebuild and redeploy. CISA: if you cannot update, or you remain on 8.1 or earlier without a vendor backport, take the PHP-based system offline. Partial stopgaps (memory_limit=-1, session.upload_progress.enabled=0, PHP 8.5 fatal_error_backtraces=0) are incomplete. A WordPress, Magento, or Nextcloud update is not this patch. Hunt PHP workers launching shells or downloading tools, per CISA. No KEV clock; do not wait for one.

1. Plex2Shell — four-part build, assume-compromise if internet-facing before 1.43.3.10861. Clean reinstall path: empty Codecs, inspect Preferences.xml for unexpected transcoder options, sign out devices, change the Plex password. 96656 forensic triage Yes; clock expired 23 October. 96652 / 96655 still due 3 November.

1. Collabora CODE CVE-2026-110447 — due today, forensic triage Yes. Floor 26.4.303. Disable is not the close; upgrade or remove the app. proxy.php still answers when Nextcloud marks the app disabled. Nextcloud 29 cannot take the floor. Standalone / Docker / packaged Collabora is out of scope. Hunt shx*.php and extra PHP in the app tree. Webshells reported since 10 September, source 139.28.18.122.

1. Arista VCO CVE-2026-114625 — due today, forensic triage Yes. On-prem floors 5.2.3.18 / 6.1.3.10 / 6.4.2.12. September’s 5.2.3.16 / 6.4.2.8 (CVE-2026-93952) do not close it. Hosted already patched; that is not the on-prem ticket. Enterprise Read Only is enough. Observed IPs: 74.82.197.86, 38.54.50.151. Gateway and Edge not affected. Hunt web logs before upgrade.

1. LiteLLM 1.107.0 — if any host pulled the wheels or the four Docker tags in the 21 October window, assume exfil. Delete cook.pth / cook.py / sitecustomize.py from the shell, then rebuild the venv or image. Do not start that Python to “check.” Rotate every secret the host could reach, including provider keys in the proxy database. Pinning 1.106.2 on a dirty interpreter is not the hunt.

1. Gheist — private repos and GHES, not the public hold dashboard. Hunt ci-sync- branches whose only commit is sync-check.yml with message ci: sync config. Rotate every repository, organization, and environment secret the repo could read. Revoke the pushing token. Do not approve a held sync-check run. Audit-log user agent gheist.

1. SiteGuard CVE-2026-106931 — clock expired 23 October, forensic triage Yes. Japan-heavy WAF. Parallel 20 October row, narrower US enterprise surface.

1. Siemens Software Center CVE-2026-110936 — due 3 November, forensic triage No. 4.0.9.8 closes the load path; it does not clean AppData drops. Hunt the folder, not the Siemens hash. IT workstation; process impact not claimed. See weekly OT.

1. GitLab CVE-2026-110264 — CVSS 10.0, no confirmed ITW, not KEV. Self-managed CE/EE from 7.0 before 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1. GitLab.com / Dedicated already patched. 12 October builds (19.4.2 / 19.3.5 / 19.2.8) closed a different CVE and remain in for this one. No workaround. Patch on version, not on a log line.

1. Leftovers whose clocks already expired and whose hunts are unfinished: SkyKick seven Application IDs plus planted secrets (Storm-0940 does not retire the tenant hunt), BeyondTrust 102764 rebuild, Ivanti 104935 rebuild plus unpatched PE, Cisco SEG 25.3.0.5525, Ahsay 10.3.4.45, Atlassian 21589, PAN-OS 0322, Fortinet 61624, FortiBleed session kill, GlobalProtect 0257, NetScaler 88771/88772/88779 plus 107406 third ISO, FortiMail 104286, Conductor 58138, Check Point 85103/91843, ScreenConnect, PaperCut, Integrity Tech Appendix B.

5. Identity / cloud / enterprise

The identity plane this week is the non-human runtime, not last week’s service principal — except that last week’s service principal now has a name.

SkyKick remains the MSP object: one publisher secret, every consented tenant, no MFA. Microsoft’s Storm-0940 / ARTEX write-up does not change the hunt. Conditional Access written for users still does not apply. The tab is still Service principal sign-ins. The seven Application IDs stay disabled until ConnectWise publishes restoration instructions for that service. A restore of archives is not a tenant clean. Planted 2028-expiring client secrets on other apps survive disable and survive restore.

Gheist is the CI identity problem: a token that already had write access, a workflow that prints secrets, an API that looks like GitHub. OIDC cloud roles assumed from attacker branches are the downstream cloud ticket. The July hold is public-only; treating a held public dashboard as coverage for private/GHES is the false green.

LiteLLM is the AI-gateway identity problem: an unrevoked experimental master key minted an org-owner GitHub CLI token, which skips GitHub’s super-user reauth. Provider keys in the proxy database are the blast radius, plus any cloud role the host had.

Plex is shadow-IT identity: an admin token stolen through the chain, devices still signed in, Codecs still loaded. Collabora is the file-server identity: webshells hunting credential stores and password-manager artifacts on Nextcloud.

No material Entra Conditional Access product bug was published this window. Huntress’s M365 token-spray (79 orgs, 497 sign-ins, 14 July–22 September, disclosed 22 October) is a closed campaign in an older window; THN pickup this week is not a material increment.

6. Ransomware / criminal activity

CONFIRMED by CISA catalog field, unchanged: GlobalProtect CVE-2026-0257 ransomware-use Known. All eight new KEV rows this week: ransomware-use Unknown.

NOT claimed: PHP2Shell as ransomware. Sensor RCE and take-offline guidance are not a locker.

NOT claimed: Plex2Shell as ransomware. Miner and residential proxy are the documented payloads.

NOT claimed: LiteLLM or Gheist as ransomware. Credential theft is the documented objective.

NOT claimed: Storm-0940 / SkyKick as ransomware. Graph tokens on a backup app remain a ransomware-enabling position. Microsoft has not named a locker. ConnectWise has not named a locker. Huntress has not named a locker. Microsoft’s cluster is a suspected PRC-nexus CNE actor, not a locker.

SafePay AA26-293A is the week’s ransomware product: ≥600 victims, old already-KEV edge/backup CVEs, dual extortion, .SafePay extension. Useful as a TTP pack. Not a new initial-access class.

PaperCut KEV ransomware-use remains Unknown. No new GreyNoise increment past 440 in this retrieval.

Do not convert a water-utility SkyKick tenant or a Plex box on a plant NAS into confirmed process impact. None of this week’s IT sources showed a PLC write.

7. Defensive priorities

1. Tonight: inventory PHP that serves HTTP (patch/backport/restart, or take offline); Plex by four-part build (assume-compromise + Codecs hunt if internet-facing before 10861); Nextcloud richdocumentscode (upgrade to 26.4.303 or remove — disable is open); on-prem VCO (5.2.3.18 / 6.1.3.10 / 6.4.2.12, hunt 74.82.197.86 / 38.54.50.151 first); any host that pulled LiteLLM 1.107.0 or the four Docker tags (delete the three startup files from the shell, rebuild, rotate); private GitHub / GHES for ci-sync- / sync-check.yml (rotate secrets, revoke token). Then leftover SkyKick tenant hunt (seven IDs still disabled, planted secrets, Storm-0940 does not retire it), BeyondTrust rebuild, Ivanti rebuild, SEG 25.3.0.5525, SiteGuard 106931, Siemens SSC folder hunt, GitLab 110264 self-managed.
2. Forensic triage is the instruction on Collabora 110447, Arista 114625, Plex 96656, and SiteGuard 106931. Patching PHP without restarting workers is how you leave the unpatched interpreter mapped. Patching Plex without emptying Codecs is how you leave the .so. Uninstalling LiteLLM without deleting cook.pth is how you leave the hook. Deleting a Gheist branch without rotating secrets is how you leave the printed values live.
3. PHP: the remaining clock is not KEV. CISA still told everyone to patch now. Distro version strings will lie. Official images do not pick up a registry tag while running.
4. Plex: 1.43.3 in the asset register is the population Censys counted on 10828.
5. Collabora: Nextcloud 29 is a dead end for the named floor. Remove the app or upgrade Nextcloud first.
6. VCO: Hosted green is not on-prem green. 5.2.3.16 is last month’s CVE.
7. LiteLLM: the Git tag was the decoy. Rebuild from known-clean Python.
8. Gheist: the July hold worked where it applied. Production secrets are in private repos and GHES.
9. SkyKick: ConnectWise archive statement is not your Graph statement. Restore access, if it lands today, is not eviction of planted secrets.
10. Check Point 85103 and 91843 still uncatalogued. Conductor 58138 still exploited, still no row. NetScaler 107406 still not KEV. PHP still not KEV. Do not wait for those rows to start the work that already has a vendor floor.

8. What changed from last week

Last week’s [weekly IT](/posts/2026-10-19-weekly-it-broker-skykick-beyondtrust-ivanti/) was SkyKick OAuth with no actor name, ARMORY CASTLE on BeyondTrust 102764 due 19 October, UTA0576 on Connect Secure 104935, Cisco SEG 76519, Ahsay/Atlassian catalog closes, NetScaler 107406 still not KEV, Check Point 85103/91843 still not KEV, Conductor 58138 still exploited with no row.

This week those open items closed or moved as follows:

• SkyKick: Microsoft named Storm-0940 / ARTEX (21 October). Attempt count >2,250. .99 independently tied to the 10–14 October spray (failed). Huntress 300+ successes not superseded. ConnectWise targeting phased onboarding today; freeze is 25 October 14:00 UTC, restoration not confirmed complete. Still no CVE, still not KEV.
• BeyondTrust 102764: clock expired 19 October. No new victim increment past two.
• Ivanti 104935: PE still unpatched / no CVE. No new UTA0576 IR.
• NetScaler 107406 is still not KEV. Citrix/MS-ISAC still report no exploitation of this CVE.
• Check Point 85103 is still not KEV. 91843 is still not KEV.
• Conductor 58138 is still exploited and still has no KEV row.
• PaperCut did not grow a published victim increment past 440.
• Catalog count 1748 → 1756. Eight adds in seven days, versus nine the week before. Unlike last week’s broker-heavy 2025–2026 products, this week’s catalog is Plex + a Japanese WAF + a Siemens updater + Collabora CODE + VeloCloud. The highest-leverage IT problems — PHP, LiteLLM, Gheist — are not on it.
• The target class moved down the stack. Last week the actor was the backup vendor’s app, the help-desk appliance, the VPN that was current, the mail scanner in the path. This week the actor is the interpreter, the Python startup hook, the Actions runner, the codec loader, the proxy.php that still answers.

9. What we are watching next

Whether CISA lists PHP 109618/109619 after the 26 October honeypot RCE reporting, or the 23 October “not observed successful” sentence holds. Whether a named production victim is published without retraction. Whether distro backports finish for 8.1/8.0/7.4 in every appliance vendor that embeds PHP.

Whether ConnectWise actually begins restore today, publishes reconnection instructions, or names Storm-0940 itself. Whether Huntress’s 300+ grows, or Microsoft publishes a success count rather than attempts. Whether planted SkyKick-era secrets show up past the one Huntress tenant.

Whether LiteLLM 1.107.0 produces a victim census beyond Wiz’s download and AWS-role reuse. Whether Gheist’s operator is clustered, or the self-hosted sync-host job starts working. Whether GitLab 110264 or Node2Shell 111497 move onto KEV. Whether Ivanti ships the Connect Secure PE. Whether NetScaler 107406, Conductor 58138, or Check Point 85103/91843 land in the catalog. Whether Plex 96652/96655 clocks on 3 November are accompanied by a new payload family. Chromium’s next in-the-wild after 85046 and 87491.

10. RWP assessment

Confidence: High on the KEV listing set (catalog 2026.10.23, count 1756, eight adds 20–23 October), on PHP’s 21 October four-train release and CISA/NCSC take-offline language, on Plex’s 19 October assume-compromise plus the 20 October four-row listing, on LiteLLM’s 23 October RCA and the Git-tag-versus-wheel split, on Wiz’s Gheist public-hold versus private/GHES split, on Collabora 110447 and Arista 114625 due today with forensic triage Yes, and on Microsoft’s 21 October Storm-0940 assessment as the attribution increment on last week’s SkyKick ticket. Moderate on unifying PHP, Plex, LiteLLM, and Gheist into a single “runtime” week — the pattern is operator consequence (the close you already applied is still in), not actor. Moderate on Amazon’s “broadly exploited” as pressure rather than a production census, and on Microsoft’s 2,250 as attempts rather than Huntress’s 300+ successes. Low on PHP production victim identity (Unit 42 initial-access retracted; Karimi is a honeypot), on LiteLLM victim count past downloads-plus-AWS-role, on Gheist attribution, and on ConnectWise restore actually landing today. None claimed on OT process impact. None claimed on PHP, LiteLLM, or Gheist as ransomware.

The week does not require a new SIEM use-case. It requires patching the interpreter rather than the CMS, emptying Codecs rather than reading 1.43.3, deleting cook.pth rather than trusting the Git tag, rotating Actions secrets rather than deleting the branch, upgrading or removing richdocumentscode rather than disabling it, and moving VCO past last month’s floor — without calling last week’s SkyKick disable the close.

This assessment covers 19–26 October 2026 and was published 26 October 2026. ConnectWise Trust Center freeze is 25 October 14:00 UTC. KEV freeze is catalogVersion 2026.10.23, count 1756, dateReleased 2026-10-23T19:30:18Z.