Urgent Fixes for Website Software After a Rough Week Online
On Wednesday, October 21, 2026, the PHP project released emergency fixes for two serious flaws, CVE-2026-109618 and CVE-2026-109619. Together they are called PHP2Shell. The PHP project says they let an outsider run commands on a server without logging in.
Think of a flaw like a spare key left under a doormat. Anyone who finds it can walk in. Palo Alto Networks Unit 42 rates both flaws as Critical. PHP is a programming language that many websites run on, so the news reached far beyond the people who build PHP.
According to TechCrunch, government websites in several countries went offline after the flaws were discovered by AI. Reuters reported that cybersecurity agencies in Europe, Australia, Japan and Britain told PHP users to update right away or take their sites offline until fixes were ready. The U.S. National Security Agency gave the same advice, according to TechCrunch. Reuters had earlier reported that these warnings arrived while PHP was still preparing its fixes.
The timing had been planned. CERT-EU, a cybersecurity team that serves EU institutions, published a notice on October 20 about the coming release. The PHP project had scheduled the fixes for 14:00 UTC on October 21. Help Net Security reported that the team then shipped them.
Aikido Security, a security company, says hackers are exploiting the PHP2Shell flaws. It has released fixed PHP images and a free checker that tells administrators whether they are affected. OpenAI also published a page about "Patch the Planet," an effort that brings researchers, software maintainers and incident responders together to coordinate fixes for serious open source flaws.
The same day, Node.js, a tool developers use to run JavaScript on servers, released its own security updates. Its October 21 security releases fix four high-severity flaws. One allows remote code execution. Two allow a TLS validation bypass, which weakens the check that you are really connected to the site you wanted. The release also updates c-ares dependencies on the 26.x, 24.x and 22.x lines, and includes a ca-cert update tied to the eMudhra certificate authority. In June, the Node.js Project had said new security releases would come on this date.
The LiteLLM incident is probably the strangest of the bunch. LiteLLM is an open source tool that sends requests to several AI services, including the ones behind chatbots. A LiteLLM post on X on October 21 said an attacker had slipped malicious code into the project. Bad files were published to PyPI, Docker Hub and GitHub Container Registry, the places where developers download software. The payload included an information stealer that targets cloud logins, passwords and AI service keys. It also carried a remote access trojan, a program that lets someone control a computer from far away. LiteLLM has removed the bad releases and images, and it asked anyone who installed them to follow its published fix steps.
Certificates were also hit. Indian certificate authority eMudhra had its private keys compromised. A certificate authority is the trusted issuer that vouches for a website's identity. If its keys are exposed, attackers could create fake certificates and pose as real sites. Node.js's ca-cert update is one visible response to that event.
Two more incidents came in the same stretch. PingCAP said on Monday, October 19, 2026 that TiDB Cloud, its cloud database service, had suffered a breach. Separately, attackers are actively exploiting four patched Plex Media Server flaws, collectively called Plex2Shell.
In my view, the most important part of this week is the chain these flaws share, more than any single flaw. PHP, Node.js and LiteLLM sit under a large share of websites and AI tools. Breaking into a tool that passes requests along, or into a shared package library, can expose passwords and keys worth far more than one server. Organizations that can quickly list the PHP versions, container images and packages they run are better placed than those who must hunt for them in a panic.
The broader context here also has a more hopeful side. The coordinated work described on OpenAI's Patch the Planet page, and the free patched images and checker from Aikido, are the kind of shared tools that shorten the time between finding a flaw and fixing it. That time, more than the existence of bugs, decides how long a government website stays offline.
