Update PHP Immediately to Fix Critical Flaws

The articles in this issue of NewsBites reflect a historic and bruising week in cybersecurity. Trends in AI-accelerated vulnerability discovery came to a head with Wednesday’s PHP emergency, while serious flaws and supply-chain attacks kept coming, and agentic cyberattacks are already underway. We’re all feeling it. Defenders are working around the clock. Rumors are flying, and mainstream journalists, neighbors, friends, and family members are asking what’s happening and whether they should worry. Seasoned professionals are exhausted and wondering whether this pace is the new normal. We must face these threats with clear eyes, without giving in to fear, uncertainty, and doubt.

Yet there is real reason for hope. Cybersecurity has weathered daunting challenges before because smart, committed people found ways through them together. Now those same human strengths, amplified by AI, are helping defenders protect people they’ll never meet. The thoughtful, practical commentary from our NewsBites editors throughout this issue is a reminder of just how much expertise and dedication this community brings to the fight. To boards and executive leaders: This is the time to listen to your security teams, strengthen the fundamentals, and give defenders the staffing, funding, tools, and authority to succeed, along with room to recover. Heroic effort cannot be our permanent operating model. To everyone on the front lines: THANK YOU. Your work matters. Support one another, share what you learn, and keep making the world safer and more secure. As SANS CEO James Lyne often reminds us: When attackers and defenders are both armed with AI, always bet on the ingenuity of skilled human defenders and the tools they wield.

For additional thoughtful commentary and analysis from James Lyne and Ciaran Martin wrapping up this noteworthy week, please listen to the latest episode of their Cyber Leaders Podcast, which will be published soon: https://www.sans.org/podcasts/cyber-leaders/a-patch-it-properly-week-hosts-special-39

—Ed Skoudis.

SANS NewsBites Editor

President, SANS Technology Institute

At 14:00 UTC on Wednesday, October 21, the PHP Foundation publicly released fixes for two vulnerabilities that allow unauthenticated remote code execution (RCE) in all versions of PHP, together dubbed "PHP2Shell." Both flaws carry CVSS score 9.2 and are known to be under attempted exploitation in the wild. CVE-2026-109618 allows RCE through out-of-memory corruption: An attacker can time a request to reach PHP's memory_limit such that "PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory." CVE-2026-109619 allows RCE via stale global state: watchTowr explains, "[The flaw] comes from internal state that outlives the request memory it points to, so the next request that the same PHP worker picks up can act on that leftover data."

Wiz estimates that PHP is present in 70% of all websites in the world, including prominent use in WordPress, Drupal, Joomla, and Magento. Ahead of the patch release, many organizations worldwide preemptively took sites and services offline to reduce risk of exploitation, including government sites in the UK, Germany, France, Belgium, Finland, the Netherlands, and Australia. At the time of this writing, the PHP foundation is not aware of any successful exploitation, but Amazon Threat Intelligence observed exploitation attempts against its honeypots as early as October 17, and Cloudflare has observed significant attack traffic attempting to target its customers before and after the public announcement.

Fixing these flaws has been "the top priority" for the PHP Foundation security team since their discovery in August with the help of Calif, Wiz, and OpenAI. However, leaked CVEs and release speculation began to circulate online on October 20, forcing an official release announcement about 18 hours before the patches would ultimately become available; the release itself also had to be shifted a day earlier than planned. A Calif video showing a proof-of-concept exploit and limited technical details was leaked around the same time. The PHP Foundation notes that at 07:41 UTC on October 21, about six hours before release, "Chainguard unilaterally broke the embargo and published built images containing the fix."

Users of any PHP installation serving web requests should update immediately to PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Minimal source backports for PHP 7.4, 8.0, and 8.1 are available due to the severity of the flaws, but versions 8.1 and older are unsupported, and users should look to upgrade. If immediate updating is not possible, users should follow temporary mitigation instructions in the advisory, which "reduce exposure to specific attack paths but do not make an installation safe." SANS instructors Rich Greene and Moses Frost hosted an emergency livestream discussing these vulnerabilities on October 21.

On October 21, GitLab issued an emergency patch release addressing 12 flaws in GitLab Community Edition (CE) and Enterprise Edition (EE), including one maximum-severity vulnerability; this is separate from the maximum-severity flaw addressed in the October 12 release (described in NewsBites 28.76). CVE-2026-110264, CVSS score 10.0, allows an unauthenticated attacker to execute arbitrary code on a self-managed GitLab server by exploiting an integer overflow that occurs when Onigmo is compiling a specially crafted regular expression. GitLab.com has been fixed, but every version of self-managed GitLab CE/EE since 7.0 is affected by this vulnerability; GitLab has released fixes in versions 19.5.1, 19.4.3, and 19.3.6 and has also backported fixes to versions that would not ordinarily still receive updates: 19.2.9, 19.1.9, 19.0.10, and 18.11.13. This flaw was reported by "joaxcar" through GitLab's HackerOne bug bounty program. The two high-severity flaws in the same advisory are an LDAP injection vulnerability allowing LDAP-backed account takeover (CVE-2026-15723, CVSS score 8.2), and HTTP request/response smuggling issue allowing redirection of "certain flows" to an externally controlled server (CVE-2026-112212, CVSS score 7.5). Users should upgrade to the latest version of GitLab CE/EE as soon as possible.

India's largest licensed digital certifying authority, eMudhra, has announced that it will voluntarily exit the global SSL/TLS certificate business following the discovery that the company had issued eight intermediate certificate authority (CA) certificates whose P384 private key numbers were found to be one byte or less in size. On October 17, a researcher reported to eMudhra and major root programs that the certificates had been compromised, attesting this by using the private keys to sign the message, "We have a problem here - Wayne." Six of the certificates are TLS issuing CAs, and two are code-signing CAs, so a malicious compromise of these certificates could allow an attacker to impersonate legitimate websites and code. Firefox and Chrome blocked the certificates on the same day, and Apple and Microsoft did so within three days; eMudhra revoked the certificates on October 18, and cross-signer Sectigo completed revocation a day later. Dennis Jackson, a cryptography engineer at Mozilla, writes that "the 8 impacted keys originate on the 30th April 2025 as part of a batch of 24 intermediates. [...] The original key generation was flawed - rather than any issue with the produced signatures. [...] The private keys are effectively all-zeroes apart from the last byte. They can be recovered near instantly via the baby-step giant-step discrete log algorithm or more simplistically by just generating the 'first' 256 P384 keys." One of the keys was the number '4'. Before announcing their departure from SSL/TLS, eMudhra stated that during the Key Generation Ceremony (KGC), "a flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause." A compromised emSign certificate from eMudhra has been removed from several Python packages including pip, and Seth Larson, Security Developer-in-Residence at the Python Software Foundation, urges Python users to update the specific affected packages immediately to fixed versions “and rebuild container images with layer caching disabled to fetch the latest system certificates. Failure to do so could result in monster-in-the-middle (MITM) attacks against TLS clients, including python.org and pypi.org.” For further action, Dennis Jackson directs trust store operators to Mozilla's dev-security-policy forum, and urges users to update their browsers and operating systems to the latest versions as soon as possible.

500 eligible utilities in North America will have the opportunity to seek free cybersecurity support in the first phase of the Community Cyber Resilience Foundation, a program launched on October 20, 2026 by Dragos, Accenture, and the SANS Institute. Citing the prevalence of recent cyberattacks on critical infrastructure, the foundation aims to offer five main types of free assistance to build resilience in utilities that lack adequate resources: 1. Access to the Dragos Platform; 2. Support from Accenture in deploying, configuring and integrating the platform; 3. ICS/OT security training and certification through SANS; 4. Funding for the hardware needed to run the Platform; and 5. Access to a community information sharing network. The foundation builds on the existing Community Defense Program operated by Dragos, which has previously helped a Massachusetts water and electric utility secure its systems after a nation-state intrusion, and has helped a three-person staff at the water and wastewater utility for Juneau, Alaska to raise critical system uptime from about 85% to 99.9% and improve visibility for about 50 remote nodes. Dragos's original program works with over 100 utilities, and the first phase of the Community Cyber Resilience Foundation will be open to another 500. Water, wastewater, electric, and natural gas utilities in the US or Canada qualify for the program if their annual revenue is less than US$100 million (CA$140 million); this threshold describes about 97% of utilities in the US, amounting to more than 50,000 organizations, according to the foundation.

A malicious version of LiteLLM (1.107.0) containing an infostealer and remote access trojan (RAT) was distributed in PyPI wheels and Docker images on Wednesday, October 21, after the software's release pipeline was compromised. The malicious version was live in PyPI from 11:39 UTC to 13:23 UTC and in Docker from 11:46 UTC to 14:20 UTC; PyPI has now quarantined the package, and Docker has removed the affected images. The private enterprise release of LiteLLM was not affected by this compromise. LiteLLM notes that "the official v1.107.0 source tag in GitHub does not contain the malicious files. The compromised artifacts were built from an attacker-controlled repository." LiteLLM believes the attacker had access to three sets of developer GitHub CLI credentials, one of which could run GitHub workflows, and took advantage of temporary release permission changes to disable branch protections and force push the malicious package, using a lookalike repository to sign the poisoned artifacts when running the workflow. Users should assume credentials are compromised if they ran pip install on LiteLLM v1.107.0, used an unpinned version of LiteLLM, or used an affected Docker image during the attack time frames. The advisory provides instructions for checking indicators of compromise and for cleaning the affected environment, which include pinning version 1.106.2.

In a social media post, Octave Klaba, the CEO of French cloud provider OVHcloud, urged users to quickly update to the latest version of OVHcloud CLI or else remove it entirely, because existing versions 0.11.0 through 0.15.0 had been compromised and contained secret-stealing malware. The attacker used a GitHub account belonging to a developer and was able to directly modify existing releases without checks from the CI/CD because a "release immutability" option was disabled; the feature has since been enabled. The malicious releases were live between 12:47 and 14:21 UTC on October 19. Klaba credits a customer with noticing the problem and reporting it to OVHcloud, and states that CI/CD pipelines, unit tests, functional tests, and CVE detection were not compromised. Researchers at OpenSourceMalware note that a Solana wallet mentioned in the malware also appears on lists of indicators for the threat actors behind the GlassWorm malware. Klaba recommends that affected users change all secrets stored on the disk, and says that OVHcloud CLI versions 0.10.0 and 0.16.0 are both safe to use.

From April to July, 2026, attackers tampered with the supply chain for AOMEI Backupper software in short bursts of five to ten minutes at a time, adjusting configuration files to deliver backdoor malware. AOMEI is a provider of disk management software, and Backupper is the company's backup software for Windows systems. Google Threat Intelligence Group (GTIG) explains that "the threat actor modified the update settings file on the update server to redirect the software to download a malicious ZIP package from attacker-controlled servers instead of legitimate updates," abusing an automatic notification feature to force an immediate download and local execution of a trojanized update if the software checked for updates during a tampering window. The payload includes the CrossRoad downloader, which then stages and downloads the ShinyRoad backdoor. These windows were observed lasting 5, 6, and 10 minutes apiece, after which the attacker would restore the legitimate contents of the configuration files. GTIG characterizes this attack methodology as "anti-analysis by design," and encourages defenders to "focus on behavioral profiling of updater processes, specifically monitoring for unsigned child processes spawned by background update runners and unauthorized network redirection originating from trusted desktop software." ManageEngine Threat Analysis Lab (METAL) identifies five controls to address the attack pattern: Apply asymmetric signing to configuration files and binaries; deliver checksums independently of the URL being validated; separately from file-level checksums, confirm that the delivered content matches the vendor's published baseline; and isolate content display channels from an application's execution paths. METAL notified AOMEI of the tampering in June, and GTIG/Mandiant contacted the company in July as well as notifying potentially affected organizations; AOMEI said on July 29 that corrective actions had been taken. However, the company stated to Recorded Future that it has neither identified nor notified potentially affected customers.

The UK Information Commissioner's Office (ICO) has issued reprimands to Local Government Data Unit - Wales (Data Cymru) and to Data Cymru's IT provider, Ogi Networks Limited (ONL), for security failures under the General Data Protection Regulation (GDPR) that led to a 2024 ransomware attack in which a threat actor stole information belonging to 3,300 people, the majority of whom are children. The attacker carried out this attack using an account ONL had created in 2012, with the username "Test2" and the password "Password1". Once inside, the attacker exfiltrated 42 GB of data from a primary domain controller, a file server, and an SQL server, including "information related to two projects supporting children and families in Wales," and then encrypted 182.7 GB of stored data. ICO also notes that "The local administrator accounts on the three impacted systems all had the same password. This meant that once one system had been breached, the local account hashes could be collected and used by the threat actor to authenticate access to other systems on the Data Cymru network." ONL was reprimanded for creating the unacceptable password in the first place, for failing to audit accounts regularly, and for failing to review administrator accounts after deployment. The reprimand of Data Cymru states that the organization lacked a contract with ONL containing mandatory data protection terms, lacked documentation of responsibilities for ONL's Active Directory services, and failed in the same audit responsibilities regarding the dormant account and regular account reviews. ICO notes that ONL and Data Cymru have a legally compliant data processing contract as of April 30, 2025, and the organizations have introduced a periodic account review process and stronger access controls, including multifactor authentication.

Chrome Holding Company, a name assumed by 23andMe in the wake of the company’s bankruptcy in March 2025, will pay $6 million to settle a lawsuit brought by the California Department of Justice, which contended "that 23andMe violated California law because its unreasonable data security practices led to the 2023 data breach and that the company made certain misrepresentations that misled its customers and the public." This latest settlement is separate from two other recent suits alleging cybersecurity failings, both of which the company formerly known as 23andMe also settled in 2026, paying $32.5 million to the class of victims whose data were exposed in the breach and $14 million to Kroll, and paying $18 million in a suit brought by 42 state attorneys. HIPAA journal notes that "when the [2023] credential stuffing campaign was discovered, 23andMe maintained that there had not been a breach, and that the compromised accounts were the result of customers’ poor security practices," but investigation revealed that the company had failed to compare passwords against blocklists, to require multifactor authentication, to implement rate limiting or intrusion prevention measures, to log and monitor adequately, to address unusual login patterns, to fix known vulnerabilities, and to properly review and test platform features, among other shortfalls. The October 19 settlement also resolves Attorney General Rob Bonta's objection and appeal alleging that the post-bankruptcy sale of 23andMe to the TTAM Research Institute violated Californians' right to not have their genetic information sold without separate affirmative consent. Bonta reminds Californians that state law empowers them to "control the use of their personal and sensitive data," including to request that 23andMe "delete their data, destroy their test sample, or revoke their permission for their genetic data to be used for research." Bonta's press release provides step-by-step instructions for all three of these requests.