{
  "id": 16623592,
  "title": "Black October: what one week of PHP2Shell, LiteLLM and eMudhra says about who scans your code",
  "url": "https://urgent.news/2026/10/26/black-october-what-one-week-of-php2shell-litellm-and-emudhra-says",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T16:14:35.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/nurstar__ac8b784c29de45d/black-october-what-one-week-of-php2shell-litellm-and-emudhra-says-about-who-scans-your-code-258d"
  },
  "original_language": "en",
  "account": "Between October 17th and 24th, 2026, PHP's interpreter released emergency patches for two pre-authentication remote code execution (RCE) vulnerabilities discovered with frontier AI models. The patch dates were accelerated due to a leaked embargo. A popular AI proxy distributed a backdoored release on PyPI and Docker Hub, while an Indian certificate authority revealed eight intermediate keys that could be derived from public certificates. Node.js also released ten security fixes on the same day as PHP. Several European government websites went offline on purpose while operators patched their systems.\n\nTwo old bugs were discovered during this week: CVE-2026-109618 and CVE-2026-109619, both classified with a CVSS v4.0 score of 9.2. The first vulnerability is a memory corruption issue in PHP's out-of-memory handling, accessible through crafted multipart requests. The second is a use-after-free vulnerability from state that persists between requests on a reused worker, resulting in unauthenticated code execution as the web worker. All SAPIs (servers application programming interfaces) that serve web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Rapid7 states that mod_php is the worst case scenario, as exploitation can occur before any application code runs.\n\nWiz researchers utilized Gemini 4 Argon, Wiz Atlas, and GPT-5.6 Sol to uncover the vulnerabilities, finding the root cause in a week, a task that typically takes months for a strong team. A misleading post on Hacker News claimed a reliable source had announced two PHP RCEs rated CVSS 10.0. Screenshots circulated on X and Mastodon, and on October 20th, watchTowr confirmed the embargo had been breached while noting they had not found the bugs themselves. The PHP security team issued an advance notice on the same day, moving the release up to Wednesday, October 21st, at 14:00 UTC, and reserving the right to ship earlier if details became public.\n\nThe fallout included the NSA advising PHP operators to update or take systems offline until the issue was resolved. Reuters reported that several European government websites went dark on purpose while operators patched their systems. Roughly 1.5 million of the 2.6 million hosts monitored by Palo Alto Networks were running a PHP version without a fix available at that time. Cloudflare and WatchTower honeypots logged attempts to exploit the vulnerabilities.\n\nOn October 23rd, the PHP Foundation issued a third issue, CVE-2026-115560. A mitigation exists, but no patch has been released yet. Exploitation requires a non-standard configuration. Additionally, LiteLLM version 1.107.0 was released on PyPI with three extra files, allowing a credential stealer and remote loader to execute when the Python interpreter starts. The malicious wheel was live on PyPI for approximately 11:39 to 13:23 UTC and remained on Docker Hub and GHCR images for about 14:20 UTC. LiteLLM's supply-chain compromise is the second such incident this year, following versions 1.82.7 and 1.82.8 in March. The root cause of the LiteLLM vulnerability is a file containing a master key to an internal LiteLLM Agent Platform deployment that was later force-pushed to the repository, despite key revocation.",
  "summary": "Between Friday 17 October and Friday 24 October 2026, the PHP interpreter shipped emergency patches for two pre-auth RCEs found with frontier AI models. The fix date was forced forward by a leaked embargo. A popular AI proxy shipped a backdoored release to PyPI and Docker Hub, and an Indian certificate authority turned out to have eight intermediate keys that anyone could derive from the public…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "PHP2Shell: No login, no app code, no warning. What next?",
        "url": "https://urgent.news/2026/10/26/php2shell-no-login-no-app-code-no-warning-what-next",
        "published": "2026-10-26T08:00:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}