PHP2Shell and a Crowded Week in Web Security: Patches, Breaches and Stolen Credentials
On Wednesday, October 21, 2026, the PHP project released emergency security updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which are collectively called PHP2Shell. The PHP project's own news archive describes them as allowing unauthenticated remote code execution, meaning an attacker can run commands on a server without logging in. Palo Alto Networks Unit 42 rates both as Critical. PHP is a scripting language widely used for web servers and content management systems, which is why the disclosure reached well beyond PHP's own maintainers.
According to TechCrunch, government websites in several countries went offline after the flaws were discovered by AI. Reuters reported that cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately or take their websites offline until patches were available. The U.S. National Security Agency gave the same advice, according to the same TechCrunch report. Reuters had earlier described the agencies' warnings as arriving while PHP was still preparing its patches.
The timing was set in advance. CERT-EU, the cybersecurity team that serves the EU's institutions, had published an advisory on October 20 noting the forthcoming release. The PHP project's mailing-list announcement scheduled the fixes for 14:00 UTC on October 21. Help Net Security reported that the team then shipped the emergency fixes. Aikido Security says the PHP2Shell flaws are being exploited. The company has published patched PHP images and a free checker that tells administrators whether they are affected, and it is the vendor source for those details. OpenAI, for its part, published a page describing "Patch the Planet," an initiative that connects security researchers, maintainers and incident responders to coordinate the response to critical open source vulnerabilities.
The same day brought a separate set of updates from Node.js, the JavaScript runtime used to run server-side code. Its October 21 security releases patch four high-severity vulnerabilities, including one allowing remote code execution and two allowing a TLS validation bypass. TLS is the encryption layer beneath HTTPS, and a validation bypass weakens the check that a connection really reaches the server it claims to reach. The release also updates c-ares dependencies on the 26.x, 24.x and 22.x lines, and it includes a ca-cert update tied to the eMudhra certificate authority. The Node.js Project had said in June that new security releases would arrive on this date.
The LiteLLM incident is arguably the most unusual item in the batch. LiteLLM is an open source proxy that routes requests to multiple LLM providers, the large language model services behind chatbots and AI tools. According to a LiteLLM post on X on October 21, an attacker compromised the project by injecting malicious code. Malicious artifacts were published to PyPI, Docker Hub and GitHub Container Registry, the package and image repositories developers pull from. The payload included an information stealer that targets cloud credentials, passwords and AI service credentials, along with a remote access trojan, which gives an attacker control of the infected machine. LiteLLM has removed the malicious releases and images and told anyone who installed them to follow its published remediation guidance. The project's GitHub security page had already carried several advisories earlier in 2026, including an SQL injection in Proxy API key verification and an authentication bypass through Host header injection, neither of which is tied to this compromise.
Certificate infrastructure was also affected. Indian certificate authority eMudhra had its private keys compromised, which could allow attackers to issue fraudulent certificates and impersonate legitimate websites. A certificate authority is the trusted issuer that vouches for a site's identity in your browser. Node.js's ca-cert update is one visible downstream response to that event.
Two further incidents arrived in the same window. PingCAP announced on Monday, October 19, 2026 that TiDB Cloud, its cloud-native database-as-a-service, had suffered a breach. Separately, attackers have been actively exploiting four patched Plex Media Server flaws, collectively called Plex2Shell.
In my view, the notable feature of this week is less any single flaw than the path they share. PHP, Node.js and LiteLLM sit beneath a large share of web back ends and AI tooling. A compromise of a routing proxy or a package registry reaches credentials that are far more valuable than the server it runs on. Operators who can quickly answer which PHP builds, container images and npm or PyPI dependencies they run are in a better position than those who must search for them under pressure.
The broader context here also includes a more hopeful thread. The coordinated disclosure described on OpenAI's Patch the Planet page, and the free patched images and checker that Aikido published, are the kind of shared tooling that shortens the gap between a flaw being found and a fix being applied. That gap, not the existence of bugs, is what determines how long a government site stays dark.
