A Chaotic Week in Security

Security

The last few days have been chaotic for anyone working in IT operations responsible for server security. Four major incidents unfolded almost simultaneously, affecting PHP, Node.js, GitLab, and the entire PKI trust chain.

If you manage servers, this week wasn’t like any other week, and “Captain, it’s only Wednesday” yet. On October 20 and 21 of 2026, four major incidents that collectively affected a huge portion of the internet happened.

PHP2Shell: Websites going down precautiously

On October 20, details of two critical remote code execution vulnerabilities in PHP leaked online before their coordinated disclosure date. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were collectively named PHP2Shell after an exploit tool that surfaced alongside the leak. Both vulnerabilities are rated CVSS 9.2 (Critical) and affect nearly all PHP versions from 5.4 onward: that’s essentially every PHP-powered website on the internet. The bugs allow unauthenticated attackers to execute arbitrary code on vulnerable servers.

PHP announced a release with fixes for the vulnerabilities on October 21 at 16:00 CET. A few PHP backed websites went down precautionsly until a fix was implemented.

Patches were released later for supported PHP branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. End-of-life versions (PHP 5, 7, 8.0, 8.1) received no official fix.

What to do: Upgrade PHP immediately on all internet-facing servers. If you’re running EOL versions, isolate them behind a WAF or take them offline until you can migrate. Expect mass exploitation attempts to continue for weeks.

eMudhra CA Compromise: The secret number 4

On October 20, it was publicly disclosed that the private keys of eight eMudhra intermediate CA certificates had been compromised. The keys were generated with insufficient randomness where 4, 56, 66, 115, 155, 156, 230, 237 were the secret numbers.

A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities.

The affected certificates include six TLS intermediates trusted by major browser root programs and two code-signing intermediates trusted by Microsoft. A researcher demonstrated the compromise by signing a message with each of the eight recovered private keys.

This goes beyond blocking individual certificates as an entire root of trust was removed. Any service still presenting certificates chained through emSign ECC Root CA – G3 will stop working for users on updated browsers.

What to do: Update your browsers and operating systems to get the latest trust store changes. If you host services using certificates from the affected hierarchy, replace them immediately. Check your ca-certificates package on Linux servers and ensure all API clients and build pipelines are updated, not just your browser.

GitLab: The fix that reaches 12 years back

GitLab had a particularly rough week with two separate CVSS 10.0 vulnerabilities, both allowing unauthenticated remote code execution.

The first, CVE-2026-97229, was disclosed on October 12. It was an integer overflow in GitLab’s CI/CD regular expression compiler that could let an attacker execute arbitrary code via a crafted regular expression in a CI/CD configuration. Patches were released for versions 19.4.2, 19.3.5, and 19.2.8.

Then, just nine days later on October 21, came CVE-2026-110264: another integer overflow in the same regex compiler, also rated CVSS 10.0. But this one reaches back to GitLab 7.0 (2014), meaning 12 years of GitLab versions since then are affected. Crucially, servers that were patched on October 12 are vulnerable again, as the new fix is in a higher patch version.

What to do: Upgrade all self-managed GitLab instances immediately to the latest patched version (18.11.13 or later). If you updated on October 12, you need to update again.

Node.js: Three TLS bypasses and one path to full control

On October 21, the Node.js project released emergency security updates: v22.23.4, v24.22.1, and v26.12.1, addressing 10 vulnerabilities including four high-severity flaws.

The most concerning is CVE-2026-111497, a Brotli decoder out-of-bounds write that permits remote code execution. Crafted compressed data processed by a vulnerable Node.js server could lead to arbitrary code execution.

Additionally, three high-severity TLS hostname bypass vulnerabilities were fixed:

  • CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address.
  • CVE-2026-105483: TLS certificate hostname bypass when the IP is written in fullwidth digits.
  • A third TLS-related flaw weakening hostname checks.

The release also drops trust in the compromised eMudhra certificates, tying back to the CA incident above.

What to do: Upgrade Node.js to the latest security release on all servers. If you use single-executable or snapshot builds, rebuild them. Verify that your TLS connections are no longer vulnerable to hostname bypass attacks.

Every server component hit at once

What makes this week particularly alarming is the convergence: four unrelated incidents all demanding immediate action, all affecting foundational infrastructure components. PHP powers nearly 70% of websites with a known server-side language. Node.js runs countless APIs and services. GitLab hosts source code and CI/CD pipelines for organizations worldwide. And the eMudhra compromise undermines the very trust model that TLS relies on.

If you manage infrastructure, the priority is clear:

  1. Patch PHP to a supported, fixed version.
  2. Upgrade Node.js to the latest security release.
  3. Update GitLab to the latest patched version (and again if you patched on Oct 12).
  4. Verify your certificate chains are not affected by the eMudhra compromise.
  5. Update your trust stores across all systems, not just browsers.

How my infrastructure was impacted

As I’m hosting websites with a PHP based CMS for my clients, PHP2Shell took my attention on October 21, 2026. After that fix in the evening, I didn’t think yet that the night would get much longer:

After the second mysterious post on Lemmy with references to the number four (between all the PHP2Shell ones), I found out that there was another global incident regarding a CA’s leaked private keys. I checked the CA bundles across by devices and servers and removed any eMudhra chains.

Still, I had to open my RSS reader to get the news of GitLab and Node.js and were able to upgrade my private GitLab server too. Node.js fixes were done today too.

The internet had a rough week. Let’s make sure our servers are ready for the next one.

References: