PHP2Shell, Node2Shell, Pillow, LiteLLM: how October 2026's flaws reach your AI agents

> TL;DR: October 2026 brought critical flaws in PHP, Node.js, Pillow and LiteLLM's release chain. Taken one by one, they are infrastructure flaws. In an agent architecture, they become reachable through a simple prompt injection: the agent fetches the URL, opens the file or calls the tool the attacker picked. Here are the four concrete paths, and what to check.

1. The "read a web page" tool and Node2Shell

An agent with a browsing or fetch tool calls URLs it finds in what it reads: a ticket, an email, a search result. If that tool runs on Node.js and uses fetch(), a Brotli-compressed response from a hostile server goes straight into the vulnerable decoder (CVE-2026-111497).

The scenario: a hidden instruction in a document pushes the agent to "check" a URL. The server answers with a booby-trapped Brotli stream. The MCP server or agent backend process crashes, leaks memory, or runs code.

Check: the Node.js version of every MCP server and agent backend, and the list of domains the fetch tool can reach.

2. Attachments and Pillow

An agent that generates previews, reads images or extracts text from documents often uses Pillow. With CVE-2026-112900, the file name carries the attack, not the content. If the agent saves an attachment under the sender's file name, the attacker controls an argument passed to Ghostscript.

Check: the Pillow version (13.0.0 minimum), whether Ghostscript is in the image, and systematic renaming of received files.

3. Archives and tarfile

Agents that ingest repositories, exports or document sets unpack archives. The flaws fixed in CPython's tarfile extraction filters and zipfile decompression allow writing outside the intended folder or exhausting memory. An archive uploaded by a user is enough.

Check: the CPython version of the agent's runtime, and isolation of the directory where it extracts files.

4. PHP backend tools

The agent calls tools: a CRM, a store, an intranet. Many run on PHP. With PHP2Shell, an attacker who compromises that backend also controls the responses the tool sends back to the agent. The agent then reads fabricated data and acts on it. It is an indirect injection through infrastructure.

Check: the PHP versions behind every tool the agent calls, and session.upload_progress disabled until patched.

5. The model gateway: LiteLLM

The LiteLLM 1.107.0 compromise is a reminder that the gateway holds the keys to every model. A stealer installed in the agent's environment grabs those keys, and the attacker consumes models on the company's behalf.

Check: pinned versions, no latest in production, key rotation and billing alerts.

What these flaws have in common

None of them attacks the model. All of them exploit the fact that an agent acts on inputs it does not control: a URL, a file name, an archive, a tool response. A prompt injection hands the attacker the choice of those inputs. The infrastructure patch closes the flaw, but the underlying question remains: what can your agent fetch, open or unpack, and on whose instruction?

This week's checklist