Summary

This week was quite packed: there's a critical RCE in Pillow via EPS files, an RCE in official Node.js via the Brotli decoder (Node2Shell), four RCEs related to Ruby's regex engine found by GitLab, and a real supply chain incident in LiteLLM that briefly spread malware through the official package on PyPI and Docker Hub. The top priorities: teams that use Pillow to process uploaded images, anyone running Node.js on a path that processes external Brotli data, self-hosted GitLab users, and anyone who pulled the LiteLLM 1.107.0 image/package on October 21.

1. Pillow — RCE via crafted EPS file (CVE-2026-112900)

Pillow, the most common image library in Python, can be forced to execute OS commands via an EPS file. The cause: Pillow opens EPS files by calling Ghostscript and passing the filename through without validating it first. The article doesn't mention which version has patched this bug, so the safe move is: check the latest Pillow release for a patch to CVE-2026-112900, and in the meantime avoid processing untrusted EPS files. The Hacker News

2. Node2Shell — RCE in official Node.js build via crafted Brotli data (CVE-2026-111497)

Imperva researchers demonstrated "Node2Shell": specially crafted Brotli data can cause an application on the official Node.js 24.22.0 Linux arm64 image to execute attacker-controlled code, just through the bundled Brotli decoder — no debugger or custom build required. Node.js has already disclosed this flaw; watch the official advisory and update as soon as a release patching CVE-2026-111497 is available. The Hacker News

3. GitLab/Ruby — four RCEs in the Onigmo regex engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)

GitLab compiles user-supplied regex (for example, patterns in CI/CD configuration) with Regexp.new, and found that specially crafted patterns could corrupt memory while Ruby compiles them — this could be turned into RCE on a GitLab server. GitLab has already patched this in its own releases (GitLab 19.4.1, 19.4.2, 19.5.1), and now Ruby has released fixes for the underlying bug in Ruby 4.0.9, 3.4.12, and 3.3.13. Anyone running self-hosted GitLab or using Ruby to compile regex from user input should update to these versions. oss-security mailing list

4. LiteLLM — supply chain attack, malware spread through the official package

LiteLLM (a popular open source proxy for routing requests to various LLM providers) version 1.107.0 on PyPI and Docker Hub was briefly replaced with a package containing malware (an infostealer + RAT) on October 21, staying live for about three hours and estimated to have been downloaded more than 49,000 times before being pulled/redirected to a clean artifact. According to LiteLLM's investigation, the attacker obtained a GitHub CLI OAuth token from an internal account that was publicly exposed — the token likely leaked because Claude Code, under certain conditions, inserted the token into a response body that was then logged by LiteLLM. From there, the attacker disabled branch protection, redirected the releaser to a lookalike repo (Berri-AI/litellm, mimicking BerriAI/litellm), then ran a compromised workflow to sign and release the poisoned package. The payload dropped three files at the root of site-packages that run every time the Python interpreter is used. Enterprise customers pulling from the private repo were not affected. If your team happened to install LiteLLM 1.107.0 during that window, treat it as a compromise: check the contents of site-packages, reinstall from a clean source, and rotate any credentials that may have been exposed. SecurityWeek

5. Atlassian — 75 unique CVEs in third-party dependencies, 6 critical

Atlassian's October 2026 security bulletin covers 162 high-severity flaws and 14 critical-severity flaws (per SecurityWeek's count, 75 unique CVEs, 6 of them critical), all originating from third-party dependencies and affecting Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. The six critical CVEs: CVE-2026-65637, CVE-2026-65182, CVE-2026-68525 (Apache Tomcat, in Confluence/Crowd), CVE-2026-58062 (Bouncy Castle, in Confluence, Crowd, Jira Software, Jira Service Management), CVE-2026-75595 (Netty, in Confluence, Jira Software, Jira Service Management), and CVE-2026-77185 (Apache SSHD, in Fisheye/Crucible). Atlassian rates the actual risk exposure as "lower, non-critical" for all of these and doesn't mention any exploitation in the wild. The rest are high-severity flaws in Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Struts, and ActiveMQ — a mix of DoS, cryptographic weaknesses, auth issues, SSRF, info disclosure, and code execution. The recommendation remains the same: update to the latest product versions. SecurityWeek

6. x402 SDK — malicious APIs can drain AI agents' token balances

V12 reported that AI agents paying for API calls via the x402 SDK could be forced to sign a payment for their entire token balance if the API being called requested it. The cause: the SDK's default client had no spending limit until the August 18 release added one. This risk only applies to agents that auto-sign payments without an explicit limit set in their application. Make sure the SDK is on a version after August 18 and set an explicit spending limit. The Hacker News

7. PHP — informational advisory on session upload progress (CVE-2026-115560)

PHP recommends setting session.upload_progress.enabled=0 until the next bugfix release, to mitigate an RCE vector described as "unlikely". This flaw only appears in an uncommon combination: an application sets session.serialize_handler to php_binary or php_serialize in its configuration, then changes it to php at runtime via ini_set() before calling session_start(), with session upload progress still enabled. This mitigation is the same one already requested for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, October 21) — if that's already in place, no additional action is needed. The full advisory for CVE-2026-115560 will follow in the next regular release. oss-security mailing list

8. Perl HTTP::Headers::ActionPack — CPU exhaustion via Accept-Language (CVE-2026-113877)

Versions before 0.10 insert each Accept-Language range directly into the pattern /^$range\-/i without escaping, so regex syntax in the attacker's header gets executed by the regex engine. A 12-byte range like (a?|b?){26}z can cause backtracking lasting seconds, and each added quantifier doubles the time; an invalid range like ( causes a compile failure. A remote attacker can exhaust CPU or crash choose_language in any application that passes an untrusted Accept-Language header to this library. Upgrade to HTTP-Headers-ActionPack 0.10 or later. oss-security mailing list

Checklist

  • [ ] Check the latest Pillow release for a patch to CVE-2026-112900; in the meantime avoid processing untrusted EPS files
  • [ ] Watch the Node.js advisory for CVE-2026-111497 (Node2Shell) and update as soon as a fix is available
  • [ ] Update Ruby to 4.0.9 / 3.4.12 / 3.3.13; if self-hosting GitLab, make sure it's on 19.4.1/19.4.2/19.5.1 or later
  • [ ] If you pulled LiteLLM 1.107.0 on October 21: treat it as a compromise, check site-packages, reinstall from a clean source, rotate credentials
  • [ ] Update Atlassian DC/Server products (Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, Jira Service Management) to the latest version
  • [ ] Update the x402 SDK to a release after August 18, 2026 and set an explicit spending limit for agents that auto-sign payments
  • [ ] Set session.upload_progress.enabled=0 in PHP if the application changes the serialize handler to php at runtime via ini_set()
  • [ ] Upgrade HTTP-Headers-ActionPack (Perl) to 0.10 or later

---

Sources summarized:

Read also