Front Page

Web Infrastructure

PHP2Shell: Two Pre-Auth Flaws in the Runtime Underneath Most of the Web, Disclosed by an Embargo That Broke Early

CVE-2026-109618, a memory corruption bug, and CVE-2026-109619, a stale internal request-state bug, each give unauthenticated remote code execution at CVSS v4 9.2. CISA's assessment is that they affect every PHP installation serving web requests — mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed — with mod_php carrying the highest risk. The embargo broke on October 20, ahead of the planned coordinated release; PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 the following day, CISA issued an alert the same day, and both CVEs reached the KEV catalogue on October 26 with an October 29 remediation date. Unsupported branches, PHP 5 among them, are reported affected with no fix coming.

Exploitation reporting is genuinely mixed: honeypot operators report attempts in the wild, while Rapid7 says the public proof-of-concept code works only against particular combinations of operating system, PHP version and web server. Unpatched is therefore not the same as compromised, and saying so is part of the job. Forensic priority: execution lands as the web worker and need not drop a file, so the web server access and error logs are the primary record — preserve them before rotation, and scope the hunt to the window between the embargo break and your patch. PHP-FPM recycles its workers, which destroys process state, so if a host is still suspect, capture memory before anything restarts the service.

Trust Infrastructure

Eight Keys Anyone Could Have Computed: A Flawed Key Ceremony Put Weak eMudhra Intermediates Into Every Trust Store

Private keys for eight eMudhra intermediate CA certificates are compromised — not stolen, but weak enough to derive. eMudhra attributes this to a flaw in its April 2025 key ceremony that produced a second, weak set of keys, and it was that set which went to the browser root programmes; published analysis describes each P-384 private value as below 256, recoverable from the public certificate in under a second. A researcher reported it to the root programmes on the evening of October 17 and it became public on October 20. Chrome and Firefox blocked the intermediates from October 17, Apple from October 19 and Microsoft from October 20.

Chrome reported that no TLS certificates chaining to the six website-facing intermediates had been logged to Certificate Transparency before the block, and eMudhra says it has no evidence the weak keys were recovered or abused before disclosure. What remains exposed is everything that is not a browser: API clients, containers, build pipelines and embedded devices that carry their own CA bundles and never check revocation or CT. Cloudflare now rejects these certificates in its Workers and Pages build images and has flagged that custom SSL_CERT_FILE or REQUESTS_CA_BUNDLE settings need updating by hand. Forensic priority: CT logs are the evidentiary record, and for the web-facing intermediates the absence of a logged certificate is a real negative finding. Everywhere else, the question is an inventory one — find out where your trust stores actually live before you assume a browser vendor fixed this for you.

Threat Bulletin

Critical

CVE-2026-111497 — Brotli, as bundled by Node.js and others. An out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0: a crafted stream can crash a process, leak memory or lead to code execution. CVSS v4 9.2, though Node.js rates it High. Disclosed October 21 and fixed in Node 22.23.4, 24.22.1 and 26.12.1, with Node 20 and earlier unfixed and Bun needing 1.4.4. Named Node2Shell, then widened to HTTP2Shell once Python Brotli packages and other HTTP stacks proved affected. Forensic Note: Exposure is a dependency question, not a product one — enumerate everything that decompresses attacker-supplied Brotli, including Express 5's default JSON body handling.

Active Exploit

CVE-2026-110447 — Collabora Online built-in CODE Server, as used within Nextcloud. An OS command injection yielding remote code execution, with the notable precondition that it applies when the CODE server is not running. CISA KEV October 23, due October 26. Forensic Note: Because the flaw depends on a stopped service, pull service start and stop history and reconcile it against request logs — an outage window is the thing to hunt around, not an anomaly to dismiss.

Malware Spotlight

ARTEX — The Intrusion Handed Over to an Agent

Microsoft Threat Intelligence reported on October 21 that China state-aligned Storm-0940 used ARTEX, an open-source agentic AI penetration-testing framework, to automate attacks against hundreds of organisations from around September 2026, and assesses the actor responsible for the ConnectWise supply chain compromise of a multi-tenant application. In several cases under three hours elapsed between initial targeting and privileged access to cloud infrastructure. The actor authenticated into Microsoft 365 through already-authorised compromised applications, avoiding interactive user sign-in altogether. Forensic Note: No user sign-in means no sign-in log to alert on, so pivot to service principal and OAuth application activity — and read the compression of the timeline itself as evidence, because a human-paced playbook does not reach privileged access in under three hours.