Critical RCEs in PHP and GitLab plus eMudhra CA compromise

The week of October 20, 2026, brought a surge of critical security incidents affecting widely used software components. The PHP Foundation and GitLab released urgent patches for vulnerabilities allowing unauthenticated remote code execution, while Indian certificate authority eMudhra ceased operations after its private keys were compromised. These events highlight the fragility of both application code and the trust infrastructure that secures web communications.

What happened

Two severe vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed under the name PHP2Shell. These flaws allow attackers to execute arbitrary code on servers without authentication. Following the public disclosure, Cloudflare reported detecting millions of scanning attempts targeting these weaknesses. Although no successful exploitation has been confirmed yet, the sheer volume of probes and the ubiquity of PHP led some website operators to take their services offline temporarily as a precaution.

Simultaneously, the trust model for HTTPS certificates faced a significant blow. Eight intermediate CA certificates from eMudhra were found to use critically weak private keys, making them susceptible to forgery. This compromise meant attackers could potentially issue valid certificates for any domain, enabling man-in-the-middle attacks. In response, major browsers like Apple’s Safari began blocking the affected certificates automatically. Python also updated several packages, including certifi and pip, to remove the compromised emSign root CA from their trusted bundles. Consequently, eMudhra announced its exit from the certificate-issuing business.

Other notable incidents included the discovery of Plex2Shell, a chain of four vulnerabilities in Plex Media Server actively exploited to deploy cryptocurrency miners. GitLab patched a critical integer overflow flaw, CVE-2026-110264, with a perfect CVSS score of 10.0, which could allow unauthenticated code execution. Additionally, a supply chain attack on LiteLLM was traced back to a master key leaked on GitHub, resulting in a malicious package version that harvested credentials and installed backdoors.

Key details

• PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) triggered millions of scans but have no confirmed successful exploits yet.
• eMudhra exited the TLS certificate market after weak private keys allowed potential forgery of trusted certificates.
• Apple and Python updated their systems to block or remove eMudhra’s compromised emSign root CA certificates.
• GitLab fixed CVE-2026-110264, a critical remote code execution flaw with a CVSS score of 10.0, in multiple recent versions.
• Plex Media Server vulnerabilities are being actively exploited in the wild to install miners and proxy software.
• A leaked LiteLLM master key led to a supply chain attack where malicious code executed automatically upon Python startup.

Background

Remote Code Execution (RCE) is one of the most dangerous types of security vulnerabilities. It allows an attacker to run arbitrary commands on a server, effectively giving them full control over the system. When an RCE is unauthenticated, it means the attacker does not need a username or password to exploit it, making it particularly severe. This is why flaws like PHP2Shell and the GitLab integer overflow are treated with extreme urgency.

Certificate Authorities (CAs) are trusted entities that issue digital certificates to verify the identity of websites. Browsers and operating systems maintain a list of trusted root CAs. If a CA’s private key is weak or compromised, attackers can create fake certificates that browsers will accept as valid. This breaks the encryption and trust model of HTTPS, allowing attackers to intercept and modify traffic between users and websites without triggering security warnings.

Why it matters

For teams running self-hosted software, the PHP and GitLab vulnerabilities represent immediate operational risks. Many internal tools, dashboards, and development pipelines rely on these platforms. An unauthenticated RCE means that if your server is exposed to the internet, even briefly, it could be compromised before you have a chance to patch it. The high volume of scanning activity indicates that automated bots are already hunting for vulnerable instances, reducing the window of safety for unpatched systems.

The eMudhra compromise highlights a dependency risk that is often overlooked. Even if your own infrastructure is secure, you rely on third-party CAs for valid TLS certificates. When a major CA is compromised, it can disrupt services if browsers block their certificates, or worse, expose users to sophisticated interception attacks. For IT managers, this underscores the need for monitoring not just your own certificates, but the trust status of the issuers themselves.

Supply chain attacks, like the one affecting LiteLLM, demonstrate that vulnerabilities can enter your environment through dependencies you did not directly write. A single leaked key can compromise thousands of downstream users. This makes it essential to verify the integrity of packages and manage secrets rigorously, especially in AI and development tooling where API keys are common.

What you can do

• Update PHP to the latest patched version immediately to mitigate the PHP2Shell vulnerabilities.
• Upgrade GitLab to one of the fixed versions (e.g., 19.5.1, 19.4.3) to address the critical RCE flaw.
• Check if your systems trust eMudhra or emSign certificates and remove them from your trust stores if present.
• Audit your Plex Media Server installations and apply patches to prevent active exploitation by Plex2Shell.
• Rotate any API keys or secrets stored in LiteLLM or similar platforms if they were accessible before October 21, 2026.
• Monitor your outbound network traffic for unusual connections that might indicate a compromised server sending data out.