Top stories.
- PHP2Shell vulnerabilities put millions of sites at risk.
- Indian certificate authority exposes private keys.
- Threat actors compromise LiteLLM.
- Quest Diagnostics discloses a breach.
- GitLab patches a maximum-severity vulnerability.
PHP2Shell vulnerabilities put millions of sites at risk.
PHP received patches for two critical vulnerabilities Wednesday morning, and all PHP users are urged to update immediately. The flaws, which researchers are tracking as “PHP2SHELL,” can enable unauthenticated remote code execution.
One of the vulnerabilities (CVE-2026-109618) can lead to RCE via out-of-memory corruption, while the other (CVE-2026-109619) can enable RCE via a stale global state. The flaws affect “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.” PHP’s maintainers state, “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
Amazon Threat Intelligence detected attempts to exploit the vulnerabilities four days before their public disclosure on October 21st. The activity, observed through Amazon’s MadPot honeypot network, originated from anonymized infrastructure, suggesting threat actor involvement. How the attackers obtained exploit information remains unknown.
Separately, PHP’s maintainers have called out Chainguard for breaking the embargo and publishing built images containing the fix more than six hours before the coordinated disclosure. This activity is unrelated to the exploitation observed by Amazon, but it may have given attackers a head start to begin developing exploits before patches were broadly available. PHP stated, “Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.”
Mirai botnet operators have joined the host of threat actors that are now targeting PHP2Shell, though researchers have not yet observed evidence of successful compromises, SecurityWeek reports. Arctic Wolf, Hunt.io, and Sophos say attackers are targeting the flaws to deploy an “updated and significantly expanded version” of the Mirai variant “Potassium,” but the attempts have so far been unsuccessful.
Indian certificate authority exposes private keys.
Tech giants and the broader security industry on Tuesday scrambled to respond to the discovery of extremely weak private keys belonging to eight intermediate certificates operated by India-based certificate authority eMudhra, Ars Technica reports. Weak private keys can allow attackers to craft forged certificates for any domain and use them to impersonate servers and intercept traffic. One of eMudhra’s CA private keys is the number 4.
Google, Mozilla, Apple, Cloudflare, and many open-source ecosystems have already issued patches and revocation lists to block the affected certificates, but many systems remain vulnerable. Cryptography engineer Filippo Valsorda told Ars Technica, “This will be a massive cleanup job, bigger than Heartbleed. There will be a very, very long tail–IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python).”
eMudhra announced on Thursday that its board had decided to voluntarily withdraw from the global SSL/TLS certificate business.
Threat actors compromise LiteLLM.
Threat actors compromised the open-source AI gateway LiteLLM on Wednesday, pushing a malicious release to its PyPI and Docker registries, the Register reports. The malicious version contained a credential harvester and a remote access trojan capable of executing arbitrary code. The compromised release was live for about 1 hour and 40 minutes, during which time it received approximately 49,000 downloads.
Users who installed the compromised versions should assume their secrets have been compromised. Wiz says threat actors began abusing stolen credentials approximately 4.5 hours after the incident occurred.
Quest Diagnostics discloses a breach.
US lab testing giant Quest Diagnostics has disclosed a disruptive cyberattack that likely resulted in data theft, the Record reports. The company stated, “We have identified an incident involving unauthorized access to our Quanum Lab Services Manager (LSM) system, which certain clients use to place test orders, receive and look-up results. Upon discovery of the incident, we paused access to the system, and we are continuing to investigate the incident. Our core business operations are not impacted and remain up and running.”
Quest believes the exposed data included patient medical information and PII, but the company is still working to determine the scope of the attack. Quest noted that the breach did not involve the recently disclosed PHP vulnerabilities.
GitLab patches a maximum-severity vulnerability.
GitLab has issued patches for a maximum-severity vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE), BleepingComputer reports. The vulnerability (CVE-2026-110264) “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.”
GitLab has released threat detections to help users detect exploitation attempts. Users are urged to apply the patches immediately.
