--- title: "PHP2Shell Code Execution, AI Platforms Exploited, eMudhra Weak Keys | AutoSPF" description: "Explore the latest cybersecurity threats from PHP2Shell flaws and AI-driven attacks to weak certificate keys, software breaches, and critical security patches." image: "https://autospf.com/og/blog/php2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys.png" canonical: "https://autospf.com/blog/php2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys/" --- Quick Answer Cybersecurity threats in October 2026 include PHP2Shell flaws, AI-powered attacks, weak certificate keys, and software breaches. Organizations can reduce risks by applying security patches, rotating exposed credentials, and strengthening email authentication with SPF, DKIM, and DMARC. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=PHP2Shell%20Code%20Execution%2C%20AI%20Platforms%20Exploited%2C%20eMudhra%20Weak%20Keys&url=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F&title=PHP2Shell%20Code%20Execution%2C%20AI%20Platforms%20Exploited%2C%20eMudhra%20Weak%20Keys "Share on Reddit") [ ](mailto:?subject=PHP2Shell%20Code%20Execution%2C%20AI%20Platforms%20Exploited%2C%20eMudhra%20Weak%20Keys&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F "Share via Email") ![PHP2Shell AI Cybersecurity Threats](https://media.mailhop.org/autospf/spf-lookup-1085-1793185999598.jpg) Last week was one of the busiest of the year for [cybersecurity](https://autospf.com/blog/dumpster-diving-in-cybersecurity-how-discarded-data-becomes-security-risk/). Critical flaws in PHP, a certificate authority whose keys could be guessed, and AI-driven attacks on enterprise software all made headlines between 20 and 26 October. Here’s a roundup of the most important stories. ## Critical PHP flaws “PHP2Shell” let attackers run code on web servers! Two critical PHP vulnerabilities, [CVE-2026-109618 and CVE-2026-109619](https://newscord.org/article/php-project-releases-patches-for-cve-2026-109618-and-cve-2026-109619-after-php2s--Story%5F20261024%5FWillAIexposetherickeeec561d1), were nicknamed **PHP2Shell** after details leaked ahead of schedule. _PHP shipped emergency patches on October 21, and Cloudflare reported early attacks targeting the flaws before the fixes arrived._ Source: [BleepingComputer](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws) ## Attackers are using agentic AI platforms after PHP2Shell exploits! Researchers have observed threat actors using agentic **AI platforms** for post-exploitation activity after abusing the [PHP2Shell flaws](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html), which shows how quickly AI tools are being folded into real intrusions. Source: [The Hacker News](https://thehackernews.com/) ![Spf Record Example 4107](https://media.mailhop.org/autospf/spf-record-example-4107-1793186140086.jpg) ## Indian certificate authority eMudhra’s weak keys put HTTPS trust at risk! Researchers recovered **private keys** for eight [eMudhra](https://www.niftytrader.in/markets/emudhra-exits-global-ssl-8-weak-keys/) intermediate certificate authorities, and the keys were so simple that they could be recovered from public certificates. _Google, Mozilla, and Apple blocked the affected certificates, and eMudhra says its root keys were not affected._ Source: [BleepingComputer](https://bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates) ## Microsoft ties a ConnectWise supply-chain attack to a China-aligned group using AI! **Microsoft says** the state-aligned group [Storm-0940](https://www.bankinfosecurity.com/china-aligned-hackers-used-agentic-ai-to-target-connectwise-a-33184) used ARTEX, an open-source AI penetration-testing framework, to automate attacks on hundreds of organizations. The group compromised ConnectWise Cloud Backup customers’ Microsoft 365 environments, and in some cases the AI agents moved on to directory operations and set up persistent access. Source: [CyberScoop](https://cyberscoop.com/?p=91224) ## The same AI attack tool has reached Japanese and South Korean organizations! Kyodo News reported on October 20 that a private security firm found attack infrastructure aimed at [Japanese companies that used ARTEX](https://japannews.yomiuri.co.jp/society/general-news/20261022-355002/), with retail, finance, and logistics among the targeted sectors. Eight of those companies had disclosed data leaks in September and October, and traces of the tool were also found in intrusions at **South Korean financial institutions**. Source (Japanese): [Kumanichi](https://kumanichi.com/articles/2048468) ## Unpatched Tailscale SSH flaws could let one hacked device reach root on other servers! ![Spf Record Checker 1390](https://media.mailhop.org/autospf/spf-record-checker-1390-1793186199710.jpg) **A researcher’s report** published on October 25 says that when port forwarding is enabled, an attacker who controls a single device on a [Tailscale network](https://cybersecuritynews.com/tailscale-ssh-flaws/) can gain root access on other servers that device is permitted to reach. The findings were tested on Tailscale 1.104.2 and the self-hosted headscale 0.29.5\. Source: [The Hacker News](https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html) ## The popular AI gateway LiteLLM published a malicious release! [LiteLLM](https://www.tokenpost.com/news/technology/40648) says its release pipeline was compromised on October 21, and version 1.107.0 was pushed to PyPI and Docker containing credential-stealing malware. _The attacker used GitHub CLI OAuth tokens taken from three engineers’ accounts, and BerriAI has paused releases and pulled the affected builds._ Source: [RuntimeWire](https://runtimewire.com/article/berriai-stolen-github-tokens-apparently-used-to-publish-compromised-litellm-1-10) ## GitLab patches a CVSS 10.0 flaw that allows code execution without logging in! [CVE-2026-110264](https://easternherald.com/2026/10/22/gitlab-cve-2026-110264-critical-code-execution-patches/) is an integer overflow in **GitLab’s regular expression engine** that could let an unauthenticated attacker run code on self-managed servers. GitLab fixed it on October 21 and backported the fix to several older branches, but servers still on unpatched versions remain exposed. Source: [SecurityOnline](https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/) ## Developer hosting platform Zeabur is shutting down after a second breach in two months! _An attacker used leaked internal credentials on October 14 and 15 to break into Zeabur’s shared cluster, some dedicated servers, and internal systems, and read the platform database._ [Zeabur then announced it will wind down](https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/), with some services stopping on December 1 and all servers closing by December 31\. Source: [BleepingComputer](https://bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/) ## Hackers used Staples’ support tools to mint $5 million in gift cards! ![Spf Flattening 5047](https://media.mailhop.org/autospf/spf-flattening-5047-1793186305189.jpg) Court documents unsealed in October, reported by 404 Media on October 19 with follow-up coverage in the days after, describe how a crime ring hijacked logged-in customer-service sessions in Staples’ internal support system. The group issued more than 15,000 [gift cards worth over $5 million](https://www.gadgetreview.com/how-hackers-allegedly-turned-a-staples-support-tool-into-a-5-million-gift-card-machine), and investigators traced about **$425,000** in redemptions. Source: [404 Media](https://www.404media.co/how-a-massive-chinese-crime-ring-hacked-staples-to-steal-millions/) ## A large-scale campaign targets exposed edge firewalls! Researchers disclosed a major campaign against internet-exposed **network edge devices** such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. It came just after the October 21 emergency PHP release, underlining how attackers are hunting for unpatched perimeter devices. Source: [The Hacker News](https://thehackernews.com/) ## The FCC bans two devices with surveillance chips linked to Huawei! The [US Federal Communications Commission](https://cybernews.com/tech/us-blocks-huawei-linked-surveillance-chips/) has banned two devices that contain surveillance chips linked to Huawei. _The move builds on earlier FCC action against Chinese telecom and video-surveillance equipment and reflects continued US concern about hardware supply-chain risk._ Source: [The Record](https://therecord.media/) These [cybersecurity incidents](https://autospf.com/blog/8-cybersecurity-trends-that-will-redefine-the-digital-landscape-in-2024/) also highlight the importance of strengthening [email security](https://autospf.com/) with SPF, DKIM, and [DMARC](https://autospf.com/blog/what-is-dmarc-email-authentication-guide/). Together, these email authentication protocols help prevent email spoofing, support phishing defense, and reduce the risk of attackers impersonating trusted domains. Every one of these stories comes back to the same lesson: patch fast, rotate exposed credentials, and never assume your **perimeter devices** or certificates are safe. For [PHP sites](https://www.php.net/archive/2026.php#2026-10-20-1) specifically, the official advisory explains which versions are affected and how to fix them. Source: [PHP Security Advisory](https://www.php.net/archive/2026.php#2026-10-21-5) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F) [ ](https://twitter.com/intent/tweet?text=PHP2Shell%20Code%20Execution%2C%20AI%20Platforms%20Exploited%2C%20eMudhra%20Weak%20Keys&url=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fphp2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys%2F) Copy Related Articles - [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg) 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/) - [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg) The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/) - [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg) 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) - [ ![DNS vulnerabilities affecting email authentication](https://media.mailhop.org/autospf/spf-lookup-9081-1790592336407.jpg) 5 Common DNS Vulnerabilities Affecting Email Authentication Intermediate ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/)[ Intermediate 5 Common DNS Vulnerabilities Affecting Email Authentication Sep 28, 2026 ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"PHP2Shell Code Execution, AI Platforms Exploited, eMudhra Weak Keys","description":"Explore the latest cybersecurity threats from PHP2Shell flaws and AI-driven attacks to weak certificate keys, software breaches, and critical security patches.","url":"https://autospf.com/blog/php2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys/","datePublished":"2026-10-28T00:00:00.000Z","dateModified":"2026-10-28T00:00:00.000Z","dateCreated":"2026-10-28T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/php2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-lookup-1085-1793185999598.jpg","caption":"PHP2Shell AI Cybersecurity Threats"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"PHP2Shell Code Execution, AI Platforms Exploited, eMudhra Weak Keys","item":"https://autospf.com/blog/php2shell-code-execution-ai-platforms-exploited-emudhra-weak-keys/"}]} ```