# Security Findings Audit (October 2026)

## Summary of Recent Security Disclosures & Network Audit

---

### 1. 🐍 LiteLLM Supply Chain Compromise (v1.107.0)

* **Status**: **0% Impact / CLEAN**
* **Audit Findings**:
  * LiteLLM is **not installed or running** anywhere in the environment (`.13`, `.27`, `.35`).
  * Central LLM gateway is **OmniRoute** (Next.js/Node.js on `.13:20129`).
  * **IoC Scan**: Scanned all hosts for malicious `.pth` / `cook.py` / `cook.pth` files. Scan returned 100% clean across all filesystems.

---

### 2. 🐘 PHP Core Runtime ("PHP2Shell" - CVE-2026-109618 / CVE-2026-109619)

* **Status**: **ACTION TAKEN / MITIGATED**
* **Audit Findings**:
  * 11 containerized PHP applications run on host `.35`.
  * **Unauthenticated Applications (Action Taken)**:
    - **BookStack** (`bookstack.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/bookstack`
    - **Kanboard** (`kanboard.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/kanboard`
    - **LinkAce** (`linkace.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/linkace`
  * **Caddy HTTP Basic-Auth Shielded Applications**:
    - **Firefly III** (`firefly.lab.audasmedia.com.au`)
    - **phpIPAM** (`phpipam.lab.audasmedia.com.au`)
    - **FreshRSS** (`freshrss.lab.audasmedia.com.au`)
    - **LibreNMS** (`librenms.lab.audasmedia.com.au`)
    - **Spotweb** (`spotweb.lab.audasmedia.com.au`)
    - **DokuWiki** (`dokuwiki.lab.audasmedia.com.au`)
    - **Homebox** (`homebox.lab.audasmedia.com.au`)
    - **Metube** (`metube.lab.audasmedia.com.au`)
  * **Local LAN Only**:
    - **Pi-hole Admin** (`pihole.home.lab`)
    - **LinkStack** (`linkstack.home.lab`)

---

### 3. 🟢 Node.js / HTTP2Shell Stream Multiplexing (CVE-2026-11002 / 03)

* **Status**: **MONITOR & UPDATE BASE IMAGES**
* **Audit Findings**:
  * Node.js web services (**OmniRoute**, **Outline Wiki**, **n8n**, **Paperclip AI**) sit behind Caddy reverse proxy.
  * Caddy terminates front-end TLS/HTTP2 requests, mitigating raw HTTP/2 stream multiplexing floods to backends.
  * Base container images should be updated when upstream maintainers release Node v20.19.0+ / v22.14.0+ / v23.9.0+ images.

---

### 4. 🐍 Python Runtimes

* **Status**: **SAFE**
* **Audit Findings**:
  * **Console Portal** (`.13:8500`), **DeepSeek Harness** (`.13:3081–84`), and **Prefect** run Python 3.12 with Uvicorn in standard HTTP/1.1 mode behind Caddy.