PHP2Shell Code Execution, AI Platforms Exploited, eMudhra Weak Keys

Last week was one of the busiest of the year for cybersecurity. Critical flaws in PHP, a certificate authority whose keys could be guessed, and AI-driven attacks on enterprise software all made headlines between 20 and 26 October. Here’s a roundup of the most important stories.

Critical PHP flaws “PHP2Shell” let attackers run code on web servers!

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were nicknamed PHP2Shell after details leaked ahead of schedule. PHP shipped emergency patches on October 21, and Cloudflare reported early attacks targeting the flaws before the fixes arrived. Source: BleepingComputer

Attackers are using agentic AI platforms after PHP2Shell exploits!

Researchers have observed threat actors using agentic AI platforms for post-exploitation activity after abusing the PHP2Shell flaws, which shows how quickly AI tools are being folded into real intrusions. Source: The Hacker News

Indian certificate authority eMudhra’s weak keys put HTTPS trust at risk!

Researchers recovered private keys for eight eMudhra intermediate certificate authorities, and the keys were so simple that they could be recovered from public certificates. Google, Mozilla, and Apple blocked the affected certificates, and eMudhra says its root keys were not affected. Source: BleepingComputer

Microsoft ties a ConnectWise supply-chain attack to a China-aligned group using AI!

Microsoft says the state-aligned group Storm-0940 used ARTEX, an open-source AI penetration-testing framework, to automate attacks on hundreds of organizations. The group compromised ConnectWise Cloud Backup customers’ Microsoft 365 environments, and in some cases the AI agents moved on to directory operations and set up persistent access. Source: CyberScoop

The same AI attack tool has reached Japanese and South Korean organizations!

Kyodo News reported on October 20 that a private security firm found attack infrastructure aimed at Japanese companies that used ARTEX, with retail, finance, and logistics among the targeted sectors. Eight of those companies had disclosed data leaks in September and October, and traces of the tool were also found in intrusions at South Korean financial institutions. Source (Japanese): Kumanichi

Unpatched Tailscale SSH flaws could let one hacked device reach root on other servers!

A researcher’s report published on October 25 says that when port forwarding is enabled, an attacker who controls a single device on a Tailscale network can gain root access on other servers that device is permitted to reach. The findings were tested on Tailscale 1.104.2 and the self-hosted headscale 0.29.5. Source: The Hacker News

The popular AI gateway LiteLLM published a malicious release!

LiteLLM says its release pipeline was compromised on October 21, and version 1.107.0 was pushed to PyPI and Docker containing credential-stealing malware. The attacker used GitHub CLI OAuth tokens taken from three engineers’ accounts, and BerriAI has paused releases and pulled the affected builds. Source: RuntimeWire

GitLab patches a CVSS 10.0 flaw that allows code execution without logging in!

CVE-2026-110264 is an integer overflow in GitLab’s regular expression engine that could let an unauthenticated attacker run code on self-managed servers. GitLab fixed it on October 21 and backported the fix to several older branches, but servers still on unpatched versions remain exposed. Source: SecurityOnline

Developer hosting platform Zeabur is shutting down after a second breach in two months!

An attacker used leaked internal credentials on October 14 and 15 to break into Zeabur’s shared cluster, some dedicated servers, and internal systems, and read the platform database. Zeabur then announced it will wind down, with some services stopping on December 1 and all servers closing by December 31. Source: BleepingComputer

Hackers used Staples’ support tools to mint $5 million in gift cards!

Court documents unsealed in October, reported by 404 Media on October 19 with follow-up coverage in the days after, describe how a crime ring hijacked logged-in customer-service sessions in Staples’ internal support system. The group issued more than 15,000 gift cards worth over $5 million, and investigators traced about $425,000 in redemptions. Source: 404 Media

A large-scale campaign targets exposed edge firewalls!

Researchers disclosed a major campaign against internet-exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. It came just after the October 21 emergency PHP release, underlining how attackers are hunting for unpatched perimeter devices. Source: The Hacker News

The FCC bans two devices with surveillance chips linked to Huawei!

The US Federal Communications Commission has banned two devices that contain surveillance chips linked to Huawei. The move builds on earlier FCC action against Chinese telecom and video-surveillance equipment and reflects continued US concern about hardware supply-chain risk. Source: The Record

These cybersecurity incidents also highlight the importance of strengthening email security with SPF, DKIM, and DMARC. Together, these email authentication protocols help prevent email spoofing, support phishing defense, and reduce the risk of attackers impersonating trusted domains.

Every one of these stories comes back to the same lesson: patch fast, rotate exposed credentials, and never assume your perimeter devices or certificates are safe. For PHP sites specifically, the official advisory explains which versions are affected and how to fix them. Source: PHP Security Advisory