Black October: what one week of PHP2Shell, LiteLLM and eMudhra says about who scans your code

Between October 17th and 24th, 2026, PHP's interpreter released emergency patches for two pre-authentication remote code execution (RCE) vulnerabilities discovered with frontier AI models. The patch dates were accelerated due to a leaked embargo. A popular AI proxy distributed a backdoored release on PyPI and Docker Hub, while an Indian certificate authority revealed eight intermediate keys that could be derived from public certificates.

Node.js also released ten security fixes on the same day as PHP. Several European government websites went offline on purpose while operators patched their systems.

Two old bugs were discovered during this week: CVE-2026-109618 and CVE-2026-109619, both classified with a CVSS v4.0 score of 9.2. The first vulnerability is a memory corruption issue in PHP's out-of-memory handling, accessible through crafted multipart requests. The second is a use-after-free vulnerability from state that persists between requests on a reused worker, resulting in unauthenticated code execution as the web worker.

All SAPIs (servers application programming interfaces) that serve web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Rapid7 states that mod_php is the worst case scenario, as exploitation can occur before any application code runs.

Wiz researchers utilized Gemini 4 Argon, Wiz Atlas, and GPT-5.6 Sol to uncover the vulnerabilities, finding the root cause in a week, a task that typically takes months for a strong team. A misleading post on Hacker News claimed a reliable source had announced two PHP RCEs rated CVSS 10.0. Screenshots circulated on X and Mastodon, and on October 20th, watchTowr confirmed the embargo had been breached while noting they had not found the bugs themselves.

The PHP security team issued an advance notice on the same day, moving the release up to Wednesday, October 21st, at 14:00 UTC, and reserving the right to ship earlier if details became public.

The fallout included the NSA advising PHP operators to update or take systems offline until the issue was resolved. Reuters reported that several European government websites went dark on purpose while operators patched their systems. Roughly 1.5 million of the 2.6 million hosts monitored by Palo Alto Networks were running a PHP version without a fix available at that time. Cloudflare and WatchTower honeypots logged attempts to exploit the vulnerabilities.

On October 23rd, the PHP Foundation issued a third issue, CVE-2026-115560. A mitigation exists, but no patch has been released yet. Exploitation requires a non-standard configuration. Additionally, LiteLLM version 1.107.0 was released on PyPI with three extra files, allowing a credential stealer and remote loader to execute when the Python interpreter starts.

The malicious wheel was live on PyPI for approximately 11:39 to 13:23 UTC and remained on Docker Hub and GHCR images for about 14:20 UTC. LiteLLM's supply-chain compromise is the second such incident this year, following versions 1.82.7 and 1.82.8 in March. The root cause of the LiteLLM vulnerability is a file containing a master key to an internal LiteLLM Agent Platform deployment that was later force-pushed to the repository, despite key revocation.