We added 16 new entries to VibeVulns this week, which brings the total to 142. A few of them affect almost any web app, not just AI tools, so those come first.
php2shell: unauthenticated code execution in PHP itself
Critical. Two bugs (CVE-2026-109618 and CVE-2026-109619) in how PHP cleans up memory after a request ends abnormally can let a single unauthenticated HTTP request run code as your PHP worker. Every PHP install that serves web requests is affected, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your site sits behind Cloudflare, its WAF blocks the known exploits by default, even on the Free plan, but you should still upgrade.
Node.js security releases from October 21
High. Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 CVEs. Four are rated high: a Brotli decoder bug that can lead to remote code execution, two ways around TLS certificate hostname checks, and dns.resolve cutting off names that contain a NUL byte. If your app runs its own Node process (a VPS, Docker, Railway, Render and so on), upgrade.
Fake ChatGPT, Claude and Codex setup packages on npm
Critical. On October 19, GitHub flagged eight npm packages as malware. They use AI tool names as bait, such as claude-desktop-setup, chatgpt-desktop-setup, codex-setup and api-anthropic. If any of them was installed on a machine, treat that machine as compromised.
A fake Anthropic client on PyPI
Critical. A PyPI package called anthropic-sdk looked like a drop-in for Anthropic's Python client, but from the third import on it downloaded code from a third-party GitHub repo and ran it. The official package is just anthropic. Search your requirements files and lockfiles for anthropic-sdk.
Langchain-Chatchat runs shell commands for anyone
Critical. Langchain-Chatchat through 0.3.1.3 has a POST /tools/call endpoint with no authentication, and its shell tool is always on. One request can run commands on the server, as root in the shipped Docker image. There's no fixed release yet, so keep it off the public internet.
Google Agent Mesh skipped its capability checks
Critical. In Google's open-source Agent Mesh 0.1.0-alpha.1 and alpha.2, the /libp2p-http ingress skipped the Biscuit capability checks (CVE-2026-102503). Any peer that could reach a node could call its MCP, A2A and inference backends, including MCP servers that run commands.
MCP servers with missing or broken access checks
Several MCP servers and platforms let the wrong people in. All of these are rated critical:
- DBHub (Bytebase's database MCP server) had no authentication in HTTP mode before 0.22.5, and a malicious web page could use DNS rebinding to query or change your database through your browser. Details
- Obot let any logged-in user use a restricted MCP server's tools, with its stored OAuth credentials, just by knowing its ID. Fixed in v0.21.1. Details
- obsidian-tc let any valid token read, write or delete notes in every configured Obsidian vault before 1.3.1. Details
- NetLicensing MCP could leak plaintext API keys, admin keys included, through a path traversal before 0.1.8. Details
- x64dbg-MCP Server served all 71 debugger tools on 0.0.0.0 with no authentication in early versions. Details
Agent frameworks that ran code they shouldn't have
Also critical, and worth a look if you build agents with these:
- PraisonAI: the server started by AgentTeam.launch() accepted any request, or none, before praisonaiagents 1.6.59, and it listens on 0.0.0.0 by default. Details
- PraisonAI again: CodeAgent ran model-written Python with every API key in its environment and ignored sandbox=True, and the AICoder UI let the model write any file and run any command. Details
- Flowise 3.1.2 and earlier: the CSV and Airtable agents can be prompt-injected into sending your data out or reaching internal services. Details
- Flowise custom functions could break out of the sandbox through puppeteer.launch() and run commands, as root in the official Docker image. Details
- Langflow 1.10.0 and earlier built the key that encrypts stored credentials from Python's non-cryptographic random module. Anyone with the secret_key file can decrypt them all. Details
Some of these were disclosed earlier in the year and only made it into VibeVulns this week, so the fixes may already be out. Each page has the check and the fix.
Found something we missed? Send it in. Every entry needs a public source.