56 lines
2.5 KiB
Markdown
56 lines
2.5 KiB
Markdown
# Security Findings Audit (October 2026)
|
||
|
||
## Summary of Recent Security Disclosures & Network Audit
|
||
|
||
---
|
||
|
||
### 1. 🐍 LiteLLM Supply Chain Compromise (v1.107.0)
|
||
|
||
* **Status**: **0% Impact / CLEAN**
|
||
* **Audit Findings**:
|
||
* LiteLLM is **not installed or running** anywhere in the environment (`.13`, `.27`, `.35`).
|
||
* Central LLM gateway is **OmniRoute** (Next.js/Node.js on `.13:20129`).
|
||
* **IoC Scan**: Scanned all hosts for malicious `.pth` / `cook.py` / `cook.pth` files. Scan returned 100% clean across all filesystems.
|
||
|
||
---
|
||
|
||
### 2. 🐘 PHP Core Runtime ("PHP2Shell" - CVE-2026-109618 / CVE-2026-109619)
|
||
|
||
* **Status**: **ACTION TAKEN / MITIGATED**
|
||
* **Audit Findings**:
|
||
* 11 containerized PHP applications run on host `.35`.
|
||
* **Unauthenticated Applications (Action Taken)**:
|
||
- **BookStack** (`bookstack.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/bookstack`
|
||
- **Kanboard** (`kanboard.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/kanboard`
|
||
- **LinkAce** (`linkace.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/linkace`
|
||
* **Caddy HTTP Basic-Auth Shielded Applications**:
|
||
- **Firefly III** (`firefly.lab.audasmedia.com.au`)
|
||
- **phpIPAM** (`phpipam.lab.audasmedia.com.au`)
|
||
- **FreshRSS** (`freshrss.lab.audasmedia.com.au`)
|
||
- **LibreNMS** (`librenms.lab.audasmedia.com.au`)
|
||
- **Spotweb** (`spotweb.lab.audasmedia.com.au`)
|
||
- **DokuWiki** (`dokuwiki.lab.audasmedia.com.au`)
|
||
- **Homebox** (`homebox.lab.audasmedia.com.au`)
|
||
- **Metube** (`metube.lab.audasmedia.com.au`)
|
||
* **Local LAN Only**:
|
||
- **Pi-hole Admin** (`pihole.home.lab`)
|
||
- **LinkStack** (`linkstack.home.lab`)
|
||
|
||
---
|
||
|
||
### 3. 🟢 Node.js / HTTP2Shell Stream Multiplexing (CVE-2026-11002 / 03)
|
||
|
||
* **Status**: **MONITOR & UPDATE BASE IMAGES**
|
||
* **Audit Findings**:
|
||
* Node.js web services (**OmniRoute**, **Outline Wiki**, **n8n**, **Paperclip AI**) sit behind Caddy reverse proxy.
|
||
* Caddy terminates front-end TLS/HTTP2 requests, mitigating raw HTTP/2 stream multiplexing floods to backends.
|
||
* Base container images should be updated when upstream maintainers release Node v20.19.0+ / v22.14.0+ / v23.9.0+ images.
|
||
|
||
---
|
||
|
||
### 4. 🐍 Python Runtimes
|
||
|
||
* **Status**: **SAFE**
|
||
* **Audit Findings**:
|
||
* **Console Portal** (`.13:8500`), **DeepSeek Harness** (`.13:3081–84`), and **Prefect** run Python 3.12 with Uvicorn in standard HTTP/1.1 mode behind Caddy.
|