Kodem Security Research Team

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 Explained

PHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated PHP RCE in mod_php and PHP-FPM. Get fixed versions, memory_limit mitigations, and the runbook.

LiteLLM Supply Chain Attack: The 1.107.0 Backdoor That Runs Without an Import

The LiteLLM supply chain attack backdoored litellm 1.107.0 on PyPI and Docker. Get the IOCs, what the malware steals, and a first-hour response runbook.

MALFEX npm Campaign: Eight Malicious Packages, Three Payloads, 14 Months Without an Advisory

MALFEX pushed eight malicious npm packages delivering Overlord RAT and the movinlike stealer. Get the versions, IOCs, and the first-hour response runbook.