PHP2Shell, a certificate key that was just the number 4, and the week’s other breaches
I recommend checking out these tweets and the quote tweets around them to learn more about the discussion.
Hacker News was crowded with CVE-related posts on 21 October. These were on its front page that day:
| # | Story | Points | Comments |
|---|---|---|---|
| 1 | PHP 8.2.35 (php-src release) | 1014 | 539 |
| 2 | Eight Bits of Trust: eMudhra’s CA keys cracked in milliseconds (Scott Helme) | 881 | 418 |
| 3 | Security advisory: Critical remote code execution vulnerabilities, update now (php.net) | 1521 | 652 |
| 4 | Today’s PHP security release, and how we’re strengthening security (PHP Foundation) | 722 | 349 |
| 5 | Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (SafeDep) | 489 | 167 |
| 11 | Patch the Planet: global response coordination as agents uncover vulnerabilities (OpenAI) | 251 | 169 |
| 17 | GitLab critical patch release (GitLab) | 327 | 75 |
| 20 | Security Disclosure (Railway) | 425 | 249 |
| 34 | PHP2Shell: AI uncovers critical RCE in PHP (Wiz) | 441 | 174 |
| 38 | Dutch National Cyber Security Center is Offline because it uses PHP (NCSC) | 269 | 94 |
The bugs leaked a day early. On 20 October a Hacker News post said two critical PHP vulnerabilities were about to be disclosed. It was taken down, but screenshots spread, and PHP moved its release up a day. Huntress’s rapid response post tracks it.
Before the PHP patch came out:
Calif’s write-up: php2shell: A tale of two PHP remote vulnerabilities. Calif found the bugs with OpenAI and Wiz through Patch the Planet. They reach back to PHP 5.4.0 and gave pre-auth remote code execution on WordPress, Drupal, Joomla, MediaWiki, Nextcloud and more under default settings.
Matthew Prince, Cloudflare’s CEO, has great coverage of PHP and eMudhra, and stats on exploit attempts across Cloudflare’s network before and after the announcement.
The eMudhra one was just funny. The Indian certificate authority’s private keys for eight intermediate certificates were generated with almost no randomness (one was just the number 4), so anyone could have forged HTTPS certificates for any website. Browsers blocked them within hours.
Japan’s prime minister, Sanae Takaichi, asked everyone to apply the PHP patch released at 11pm that night, or take their websites offline for a while if they couldn’t.
The Dutch National Cyber Security Centre’s own website went offline because it runs on PHP (Hacker News thread).
OpenAI’s models found the bugs through Patch the Planet, the patch program OpenAI started with security researchers and maintainers.
Railway got hacked. It says an attacker may have read customers’ environment variables, as part of a series of attacks on platform companies aimed at AI inference providers.
PingCAP, the company behind TiDB, also found someone with unauthorized access to some of its internal systems.
GitLab: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases.
A Java advisory from Oracle, CVE-2026-91403 (CVSS 9.1).
A supply chain attack on LiteLLM: the 1.107.0 release on PyPI carried malicious code.
SafeDep: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor.