PHP2Shell Patch Lands Today, CA Keys Cracked, Ransomware Skips MFA

PHP ships an emergency patch for two critical RCE bugs today, eight eMudhra CA keys turn out to be computable, ransomware crews ride a PAN-OS bug past MFA, OVHcloud's CLI releases get swapped for a stealer, and AI agents break into company websites for about $50 a hack. PHP2Shell emergency patch lands this morning PHP ships an out-of-cycle security release at 14:00 UTC (10 AM ET) on October 21 for two critical flaws rated 9.2 (CVSS v4). watchTowr says both allow remote code execution. Only branches 8.2 through 8.5 get fixes; roughly 884,000 internet-facing hosts report PHP 8.1 or older. No exploitation reported yet. CVEs (as used by researchers; not named in PHP's notice): CVE-2026-109618, CVE-2026-109619 Do this today: Inventory every PHP install, including control panels and vendor appliances, patch internet-facing servers first when the release lands, and put end-of-life versions behind a VPN or WAF. Source: The Hacker News Eight certificate authority keys were computable from public certs Mozilla and Google confirmed the private keys of eight eMudhra (emSign) intermediate CAs are compromised: weak randomness from an April 2025 key ceremony let anyone compute them. Chrome, Firefox, Apple, Microsoft, and Android have blocked them; Go 1.27.3 and 1.26.10 hard-block the keys because Go doesn't check revocation. Do this today: Update Go to 1.27.3 or 1.26.10, rebuild and redeploy Go services, and confirm nothing chains through an emSign G3 intermediate. Sources: The Hacker News (eMudhra keys), The Hacker News (Go emergency update) Ransomware crews ride a Palo Alto bug past MFA Unit 42 says Qilin and INC are exploiting a PAN-OS and Prisma Access authentication bypass, patched in May and on CISA's KEV list, to open VPN sessions without MFA, then pivot to vCenter, disable ESXi protections, and dump domain credentials from a DC's virtual disk. Veeam servers are also targeted via CVE-2023-27532. CVEs: CVE-2026-0257, CVE-2023-27532 Do this today: Confirm every PAN-OS and Prisma Access gateway has the May fix or later, review successful gateway VPN connections back to May, and keep vCenter management on a separate admin network. Source: The Hacker News OVHcloud's CLI releases swapped for a secret stealer On October 19, a hijacked contributor account replaced archives and checksums on OVHcloud CLI releases v0.11.0 through v0.15.0 for about 94 minutes (12:47 to 14:21 UTC). The install script, release-page downloads, the built-in upgrade on some installs, and unpinned CI fetches were exposed; Homebrew, go install, source builds, and Docker were not. Do this today: If anything installed or updated the OVHcloud CLI in that window, treat its secrets as stolen, rotate cloud and Git credentials, and reinstall from clean v0.16.0. Source: The Hacker News AI agents broke into company websites for fifty bucks a pop NorForge found exposed Cairn panels showing a Chinese-speaking operator's autonomous agents attacking 1,200+ sites and reaching sites at 100+ companies, including Deere, SharkNinja, and a Cummins vendor (per Reuters). Successful break-ins averaged just under 23 hours, about 10% of attempts worked, and the campaign used roughly $5,000 in tokens. Do this today: Hunt web servers for upload forms and PHP files you didn't deploy, patch or retire old framework code on storefronts and support sites, and keep session stores off the internet. Source: The Hacker News More from Matt: mattchapman.net Kindle: https://www.amazon.com/dp/B0HHMH88H9  Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472 Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764 https://mattch Support the show