Black October 2026: PHP2Shell, eMudhra, GitLab and LiteLLM — What Happened and What to Do Now
In five days in October 2026, four unrelated incidents hit the foundations of the web at once: a remote-code-execution flaw in the PHP engine, a certificate authority whose private keys anyone could compute, a CVSS 10 in self-managed GitLab, and a backdoored release of the LiteLLM AI gateway. Our new 17-page special edition, produced by MAG212 CYBER (cyber.mag212.com), separates what was confirmed from what was rumoured and gives IT teams the versions, indicators and commands they need.
Key takeaways
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2) allows unauthenticated code execution in the PHP engine itself. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- eMudhra: eight intermediate CA keys were generated so weakly that they could be computed from public certificates. Browsers are protected; apps with their own CA bundles may not be.
- GitLab CVE-2026-110264 (CVSS 10.0) enables unauthenticated RCE. Patches shipped 21 October; no confirmed exploitation had been reported as of 23 October.
- LiteLLM 1.107.0 was a malicious release that steals credentials every time Python starts. Pin to 1.106.2, rebuild affected hosts and rotate secrets.
- The common lesson: the exposure outlasts the patch. Verify fixes; don’t assume them from a version number.
1. PHP2Shell: the bug beneath every PHP application
Researchers from Calif, Wiz, OpenAI and Quarkslab disclosed two memory-safety flaws in the PHP engine on 21 October. Because the fault sits in the runtime rather than in WordPress, Drupal or Joomla, updating plugins does not fix it. The vulnerable code dates back to PHP 5.4.0. Apache mod_php carries the highest risk; PHP-FPM is likely susceptible through the session upload-progress path.
Amazon’s MadPot honeypot recorded an exploitation attempt on 17 October, four days before disclosure. Since then, exploitation attempts have been widespread, though no confirmed compromise had been documented publicly at the time of writing. A third, informational issue (CVE-2026-115560) was published by the PHP project on 23 October and affects already-patched releases in a specific configuration.
What to do: update PHP or apply your distribution’s backport (note that backports keep the old version number in php -v). Until you can patch, PHP recommends disabling session.upload_progress.enabled in php.ini or the FPM pool, tightening post_max_size, and enforcing request limits at your proxy. Cloudflare’s managed WAF rule is enabled by default on all plans but is a stopgap only.
2. eMudhra: eight CA keys anyone could compute
A flawed key-generation ceremony in April 2025 produced P-384 private keys with tiny values; one was literally the number 4. Six TLS and two code-signing intermediates were affected. Mozilla blocked them through OneCRL on 17 October and removed the root “emSign ECC Root CA – G3”; Chrome blocked them through CRLSet and drops the root in Chrome Root Store v43. eMudhra has since announced it is leaving the global SSL/TLS business.
What to do: update CA bundles in language runtimes, containers and appliances (for example certifi 2026.10.19, current Go, Node.js and Python releases). Test a client with curl https://dv-g3b-emudhra.we-have-a-problem.com/; a certificate error is the good result. Site owners with certificates under the removed root should replace them now.
3. GitLab CVE-2026-110264: a real CVSS 10
GitLab’s 21 October Critical Patch Release (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) fixes an integer overflow in the bundled Onigmo regex engine that can give an unauthenticated user code execution. Instances patched only on 12 October are still vulnerable, because that release fixed a different flaw. Versions 18.10 and older receive no fix.
What to do: upgrade immediately, restrict network access and public projects in the meantime, and check exceptions_json.log and puma_stderr.log for the patterns GitLab’s detection rules look for. If compromise is suspected, rotate runner tokens, access tokens and every CI/CD variable.
4. LiteLLM 1.107.0: a leaked key and a trusted pipeline
A LiteLLM Agent Platform master key committed to a public repository in May was never revoked. In October an attacker used it to obtain maintainers’ GitHub tokens, then made LiteLLM’s own release pipeline publish a backdoored version to PyPI and container registries on 21 October. The payload runs at every Python start, harvests cloud, Kubernetes, SSH and AI-provider credentials, and sends them to litellm.dev.
What to do: do not run Python or pip on a suspect host to check it. Search lockfiles and site-packages with shell tools for 1.107.0, cook.pth and cook.py, rebuild pinned to litellm==1.106.2, and rotate every credential the host could reach. The full list of hashes, image digests and IP addresses is in the PDF.
Status at a glance
| Incident | Severity | Fixed in | Exploitation (as of 25 Oct) |
|---|---|---|---|
| PHP2Shell | CVSS v4 9.2 | PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Widespread attempts; no public confirmed compromise |
| eMudhra CA | CA key compromise | Updated trust stores | ~107,000 test certificates in CT logs; none classed as malicious |
| GitLab CVE-2026-110264 | CVSS 3.1 10.0 | 19.5.1 and backports | None reported |
| LiteLLM 1.107.0 | Malicious release | Pin 1.106.2 | Confirmed credential theft |
What security leaders are saying
- Sam Altman, CEO of OpenAI, told Stanford GSB students: “I no longer think we’re going to be able to just patch all the bugs.”
- Matthew Prince, CEO of Cloudflare, told Reuters that for a while “every single week it’s going to feel like the sky is falling.”
- Jason Clinton, Deputy CISO at Anthropic, warned in August that a “vulnerability tsunami” was months away.
AI-enabled hacking must be treated as a speed-and-discipline problem. Organisations should reduce exposure, validate reality fast, and operationalise defence with aggressive patching, segmentation, continuous monitoring and regular incident rehearsals.
El Mostafa Ouchen, Cybersecurity Adviser
What’s inside the PDF
- An hour-by-hour timeline of Black October across all four incidents
- CVE details, CVSS vectors, affected and fixed versions, and Linux distribution advisories
- Indicators of compromise: IPs, file hashes, container image digests and certificate fingerprints
- Read-only triage commands for PHP, GitLab, CA trust stores and LiteLLM
- A 24-hour response playbook and guardrails for using AI defensively
- A full corrections log and primary sources
Primary sources
- PHP project: 2026 release announcements
- Wiz Research: PHP2Shell
- AWS Security: PHP2Shell activity before disclosure
- Cloudflare: WAF protection for the PHP vulnerabilities
- Mozilla Security Blog: eMudhra intermediates
- Google: protecting Chrome and Android users
- GitLab Critical Patch Release 19.5.1
- CERT-EU Security Advisory 2026-019
- LiteLLM: October 21 attack chain
Evidence reviewed through 25 October 2026. Advisories, patch status and CISA KEV listings change quickly; verify against vendor sources before acting. Commands in the PDF are read-only and intended only for systems you own or administer. No exploit code is published.