This Week in Cybersecurity: Week 43

The biggest story this week sat underneath a large share of the web. On Wednesday the PHP project shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that can let someone with no account run their own code on a web server. Because the bugs are in PHP itself, they sit under WordPress, Drupal, Magento, Laravel and nearly every other PHP application at once. Attack attempts started within minutes of disclosure and ran into the millions within a day, and one attempt was logged four days before the bugs were public. If you run a website, or pay someone to host one, this is the week to check which PHP version it runs.

The rest of the week was heavy on trust failures. An Indian certificate authority, eMudhra, turned out to have eight signing keys so weak that anyone could calculate them, and has decided to leave the website certificate business. A leaked key, forgotten since May, let attackers publish a malicious release of LiteLLM, a popular AI developer tool, and the hosting platform Railway said an intruder may have read customer secrets. GitLab fixed a 10.0-rated flaw that reaches back twelve years of releases, Node.js fixed a bug in the compression code it shares with a long list of other software, and researchers documented criminals letting AI agents run large parts of real intrusions. For consumers the actions are short: Plex users should update, WordPress site owners should check two plugins, and nobody should paste a command a web page asks them to run.

This roundup covers Monday 19 to Sunday 25 October. If you missed it, last week's roundup covered the ConnectWise Cloud Backup credential theft, a record Patch Tuesday and zero-days in Ivanti, Cisco and BeyondTrust.

What to act on#

Run a website? Make sure its PHP is patched#

PHP2Shell is two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10. One is a memory-handling bug, the other is in how PHP tracks the progress of file uploads. Together they let an attacker who has no login run code on the server by sending crafted web requests. Even without code execution, an attacker can read the memory of PHP worker processes, which can hold passwords, tokens and API keys from other visitors' requests. The vulnerable code goes back to PHP 5.4, and it affects every common way of running PHP: PHP-FPM, Apache's mod_php (the easiest to exploit, with a demonstrated single-request attack), php-cgi, FrankenPHP and LiteSpeed.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Backports exist for 7.4, 8.0 and 8.1, but those lines no longer get official updates, so you depend on your Linux distribution or host to supply them.

Is it being exploited? Cloudflare counted tens of thousands of attempts 45 minutes after disclosure and millions by the next morning, some trying to install a Mirai botnet variant. Amazon says it saw an attempt on 17 October, four days before disclosure, and multiple different exploits and payloads after the patches. As of Friday, the security firms watching it had not publicly confirmed a successful break-in, but the attack leaves little trace in web logs, so the absence of confirmed victims is weak comfort. Censys estimates 34.4 million PHP services were still vulnerable. Several Dutch government and education sites went offline as a precaution.

On Friday PHP warned of a third, separate issue (CVE-2026-115560) that the Wednesday releases do not fix. It only affects an unusual configuration, and the same workaround applies: setting session.upload_progress.enabled=0. A full fix will come in a regular release.

What to do: if you manage your own server, update PHP to one of the versions above and restart PHP. If you are on 7.4, 8.0 or 8.1, plan a move to a supported version. If your site is on shared hosting or a managed platform, check the PHP version in your hosting control panel, or ask your host directly whether they have applied the 21 October fixes. Our full PHP2Shell guide covers who is responsible for the fix, the partial workarounds, and how to check whether someone got in before you patched.

WordPress site owners: check Rank Math PRO and UpdraftPlus#

Two popular WordPress plugins were turned against their own users this week, not through a coding bug but through the vendors' own systems.

For about 11 hours on 15 and 16 October, Rank Math PRO downloads and updates served a backdoored version 3.0.123. The backdoor recreates itself when anyone visits the site, so deleting a file is not enough. If you installed and activated 3.0.123 between 20:02 UTC on 15 October and 07:12 UTC on 16 October, Rank Math says to treat the site as compromised: restore from a backup taken before that window if you can, otherwise delete the whole rank-math-pro folder, remove the database entries the vendor names, block the domain rank1cdn[.]com, look for unknown admin accounts and PHP files, change every password and key, and install the clean 3.0.124 last. The free version from WordPress.org is not named in the notice.

Separately, attackers breached the UpdraftPlus vendor's website and used stolen UpdraftCentral connection keys to make connected WordPress sites install backdoor plugins. Patchstack counted 99 different backdoor plugin names during an 18-hour campaign on 18 and 19 October. UpdraftPlus has more than four million active installs, although only sites connected to UpdraftCentral were reachable this way. The backdoor creates a hidden user called "data-ops43". Update to UpdraftPlus 1.26.13 (Free) or 2.26.13 (Premium), log in to each site directly rather than through UpdraftCentral, delete the old connection key, check Users and Plugins (including Must-Use plugins) for anything you don't recognise, and change admin passwords. Better still, give admin accounts passkeys or a hardware security key where your login plugin supports them, so a stolen password alone is not enough.

Plex Media Server: update now, it's being attacked#

Plex2Shell is a chain of four flaws in Plex Media Server, the popular home media server, that together let someone with no account run code on the machine. Attackers started using it about a day after the technical details were published on 16 October, installing a cryptocurrency miner and a Linux backdoor that turns the server into a proxy for other people's traffic. The US cybersecurity agency CISA added all four flaws to its list of actively exploited vulnerabilities on 20 October.

The fix has been available since August, in Plex Media Server 1.43.3.10861, so anyone who has kept Plex updated is already covered. Check your version in Plex's settings and update if you are behind. If your server was behind and reachable from the internet, look for unfamiliar processes or high CPU use from a miner, and consider reinstalling.

Never paste a command a web page asks you to run#

ClickFix is the trick behind most of the "verify you are human" scams we have written about: a fake page tells you to press a few keys and paste a command into the Windows Run box or the Mac Terminal, and the command installs malware. It keeps evolving. Forescout described a new delivery platform called ROMULUS that hands out these lures as a service, and some victims were sent to the fake pages by malicious custom ChatGPT bots. One campaign abused a genuine, signed copy of Siemens Software Center to load its malware, because security tools tend to trust signed software. Siemens fixed that flaw in version 4.0.9.8.

The good news: Google Chrome is rolling out a warning that checks copied commands against Safe Browsing and alerts you before you run a dangerous one, for users who have turned on Enhanced Protection (Settings, Privacy and security, Security). It is a useful backstop, not a guarantee. The rule that always works is simpler: no real website, captcha or support agent will ever ask you to paste something into Run or Terminal. Our guide to fake captcha scams shows what these pages look like.

The week's biggest#

eMudhra's eight certificate keys could be calculated by anyone#

Certificate authorities are the companies your browser trusts to vouch that a website is really who it says it is. Their private signing keys are the most sensitive secret on the web: anyone holding one can make a certificate for any website that software trusting that authority will accept. This week it emerged that eight of eMudhra's intermediate keys, six for website certificates and two for signing code, were not random at all. According to the researcher who found them, each private key was a number below 256, the result of a flaw in a 2025 key ceremony. Anyone could compute them almost instantly, and researchers have since published them.

Chrome and Firefox blocked the six website-certificate keys within hours, and Chrome found no certificates from them in the public Certificate Transparency logs before its block. Nobody has shown misuse, but nobody can rule it out either. Chrome will stop trusting eMudhra's emSign ECC Root CA - G3 on 27 October, and Mozilla has decided to do the same. On Thursday eMudhra's board decided to exit the global SSL/TLS certificate business; about 30,000 certificates, almost all issued through the US university consortium InCommon, need to move to another provider.

Software that keeps its own list of trusted authorities needs its own update: Go 1.27.3 and 1.26.10 (programs must be rebuilt), Node.js 26.12.1, 24.22.1 and 22.23.4, NSS 3.131.1, certifi 2026.10.19, and updated Ubuntu and Debian packages. Red Hat had not shipped a package at the time of writing and offers a workaround.

Who's exposed: for ordinary browser users, nobody in practice - Chrome and Firefox handled it automatically. Developers and server admins whose software bundles its own certificate list (Go programs, Python tools using certifi, Node apps) need to update or rebuild. Website operators with certificates under the emSign ECC root, mostly universities using InCommon, need new certificates before 27 October or their sites will break in Chrome.

A bad week for developer secrets: LiteLLM, OVHcloud, Railway and OpenCode#

Four separate incidents this week had the same shape: attackers went after the keys and passwords that developers store in their tools, not the end users of an app.

LiteLLM, a widely used open-source gateway for calling AI models, published a malicious version 1.107.0 to PyPI and Docker on 21 October. It ran as soon as Python started and stole cloud tokens, SSH keys, AI tool credentials, browser data and environment variables, then installed a backdoor that checked in hourly for new commands. PyPI quarantined it within about two hours. The root cause is the lesson: a master key was accidentally committed to a public GitHub repository in May, flagged for revocation, and never actually revoked. Five months later an attacker used it to reach an over-privileged GitHub token and the release pipeline. Anyone who installed 1.107.0 should rotate every credential that machine could read, from a clean machine, and pin to 1.106.2.

The OVHcloud command-line tool had five past releases swapped for secret-stealing versions for 94 minutes on 19 October, via a hijacked contributor's GitHub account. Homebrew users were protected because Homebrew had pinned the original file hashes. The fixed release, v0.16.0, is published as immutable and can be verified.

Railway, a hosting platform for apps, said an intruder may have accessed encrypted environment variables - where apps keep API keys and database passwords - and in some cases decrypted them, for up to 1.85% of workspaces. A researcher reported crypto wallets being drained where private keys were stored there. Railway has not said how the attacker got in. And OpenCode, an AI coding tool, said a breach of a legacy system may have exposed the OpenAI, Anthropic and Google API keys that 1.4% of its Console users had stored there. Deleting the key from OpenCode does not revoke it; you have to revoke it at the provider.

Who's exposed: developers and companies using these tools, and potentially their customers if stolen keys open production systems. Railway customers should rotate every environment variable and check GitHub and registry audit logs. The common thread for everyone else: a secret that has leaked once is only safe after it is revoked, not after it is deleted or hidden.

GitLab's 10.0 flaw reaches back to 2014#

GitLab fixed CVE-2026-110264, rated the maximum 10.0, which can let an attacker with no account run code on a self-managed GitLab server. The bug is an integer overflow in Onigmo, the regular-expression engine GitLab ships, and it affects every self-managed release from version 7.0, released in 2014, onwards. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched.

It is the fourth critical GitLab bug traced to the same engine since September, and two of the four need no login. Ruby, which also uses Onigmo, fixed three of the underlying bugs in Ruby 4.0.9, 3.4.12 and 3.3.13; Ruby 3.2 and older get no fix. No exploitation has been reported.

Who's exposed: organisations that host their own GitLab, which holds their source code and often the keys to deploy it. Patch quickly - an unauthenticated 10.0 in a code server is exactly what attackers look for. GitLab.com users and people who only use Ruby on their own computer: not in practice.

A Brotli decompression bug in Node.js, Bun, Python and more#

Brotli is a compression format used across the web. A bug in Google's Brotli decoder (CVE-2026-111497) lets malformed compressed data write past the end of a memory buffer, which Node.js says can permit remote code execution. Node's built-in fetch() decompresses Brotli responses automatically, so code that fetches from servers it does not control is exposed, as are apps that decompress uploads or request bodies. Fixed Node versions are 22.23.4, 24.22.1 and 26.12.1; Node 20 and older get no fix.

The same library sits inside much more software: Bun (fixed in 1.4.4), the Envoy and Istio proxies, the Python Brotli packages and anything that bundles Brotli 1.0.3 to 1.2.0. Fixed library versions are 1.0.10, 1.1.1 and 1.2.1. No attacks have been reported. A public proof of concept only ran code on a deliberately weakened Node build, though Imperva reported running code on one unmodified Node 24 build on ARM64 Linux. OpenAI said the bug was found during red-team testing of its own AI agents. Our Node.js release breakdown covers exactly which code paths reach it.

Who's exposed: developers and companies running Node, Bun, Envoy, Istio or Python services that handle Brotli from outside. Browsers use their own decoder and are not part of this. Ordinary users: not directly.

Arista VeloCloud: a third exploited flaw in four months#

VeloCloud Orchestrator is the central management system for VeloCloud SD-WAN, which many companies use to connect branch offices. Arista warned that attackers are exploiting a new SQL injection flaw, CVE-2026-114625, rated 9.9, that lets anyone with even a read-only login gain full operator control. It is the third exploited Orchestrator flaw since July, and the two earlier ones needed no login at all. Fixed on-premises versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted orchestrators are already patched.

CISA added it to its exploited list on Friday, together with the Collabora Online flaw used to backdoor self-hosted Nextcloud servers, which we covered last week (fixed in 26.4.303).

Who's exposed: companies running their own VeloCloud Orchestrator. Whoever controls it controls the network links between every office it manages. Nobody else.

Firewalls and VPNs keep being the way in#

Two reports this week showed how ransomware gangs use network edge devices. Palo Alto Networks' Unit 42 said the Qilin and INC ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access patched in May, to open VPN sessions while getting past multi-factor authentication. Group-IB and NyxLab separately described a broker called "k0t" who broke into Fortinet and Palo Alto devices, either through known flaws or simply by trying common passwords, and amassed more than 70,000 credentials tied to network devices and company directories before selling the access on.

None of this is new, which is the point. The flaws were patched months ago, and some of the access came from weak passwords. VPN logins that rely on a password plus a code are still being bypassed; phishing-resistant sign-in with passkeys or hardware security keys, as explained in our password and passkey guide, plus patching edge devices first, is what closes these doors.

Who's exposed: organisations with internet-facing Fortinet or Palo Alto VPNs and firewalls that are unpatched or protected only by passwords. If you work at one, your employer's IT team is the audience. Home users: not affected.

Criminals are now letting AI agents run intrusions#

Two pieces of research gave the clearest picture yet of AI agents being used in real attacks, not experiments. A researcher at NorForge found exposed control panels showing a Chinese-speaking operator giving autonomous AI agents goals like "run code on this shop's website and plant a web shell". The agents went after more than 1,200 sites and reached the websites of over 100 companies, with confirmed compromises at a large US retailer and a hardware-parts supplier. About one attempt in ten succeeded, at roughly $50 of AI usage per successful hack. SOCRadar separately found infrastructure used by INC and The Gentlemen ransomware affiliates where commercial AI models carried out intrusions step by step against about 62 organisations, while a human approved each step and reworded requests as "authorised red team tests" whenever a model refused.

The flaws the agents used were mostly old and ordinary: outdated framework code, unsafe data handling, exposed remote-access tools and reused passwords. What changes is the cost of trying them against thousands of targets at once.

Who's exposed: any organisation with old, unpatched web applications or exposed remote-access tools. The bar for being worth attacking just dropped. Individuals: not directly.

Millions of routers have an unfixable Wi-Fi flaw#

Researcher Quentin Kaiser disclosed a flaw in Broadcom's Wi-Fi Protected Setup (WPS) code that lets someone within Wi-Fi range run code as root on the router, with no password, no pairing and no button press. In one demo the exploit read the Wi-Fi password straight off the device. The code is in routers and gateways from dozens of vendors; in Belgium, gateways supplied by Proximus, Orange Belgium and VOO were confirmed vulnerable. Older eCos-based chips (BCM3380, BCM3383, BCM33834) have no usable fix at all. Newer Linux-based chips could be fixed by vendors, but no patch exists yet, Broadcom reportedly declined to issue a CVE, and no setting blocks the attack. There are no reports of real-world attacks.

Who's exposed: households and small offices whose router or ISP-supplied gateway uses an affected Broadcom chip, but only to someone physically within Wi-Fi range. If your gateway is an older cable model from your ISP, it is reasonable to ask them whether it is affected and whether a replacement is available. There is nothing to configure in the meantime.

BlackX: a bootkit that survives on patched Windows PCs#

Kaspersky described BlackX, a bootkit that loads before Windows starts, which it suspects the China-linked group APT41 used against diplomats in Central Asia earlier this year. It exploits an old, patched Secure Boot flaw (CVE-2022-21894, "Baton Drop"). It still works on patched machines because the full fix also requires administrators to manually add an old Microsoft certificate to the Secure Boot blocklist, a step many organisations skipped. The attackers needed admin rights on the machine first.

Who's exposed: organisations that have installed Windows updates but not applied Microsoft's manual Secure Boot revocation steps, and only after an attacker already has admin access. Home users are a very unlikely target for this kind of espionage tool.

Two critical Linux file-sharing flaws published before any fix#

Two 9.0-rated flaws in KSMBD, the Linux kernel's built-in Windows-style file-sharing server, were disclosed on public kernel mailing lists before fixes existed. One needs no login and is reachable on network port 445. At the time of writing neither has a confirmed fix in the kernel or a CVE number, and no exploitation has been reported. Both were found by an AI vulnerability scanner.

Who's exposed: Linux servers that have KSMBD turned on, which is uncommon; most Linux file servers use Samba instead, and Red Hat does not include KSMBD by default. If you do use it, keep port 445 off the internet until a fix ships. Everyone else: nobody, in practice.

The week in CVEs#

Worth knowing about#

A $25 billion ruling against Meta. A New Mexico court ordered Meta to pay $25 billion after finding more than 43 million violations of the state's unfair practices law, in a case rooted in the Cambridge Analytica scandal. The judge wrote that Facebook promised users they controlled their data, and "this was false". Meta says it will appeal. In a separate Meta story, researchers found hidden text in WhatsApp's help pages instructing its AI support bot not to point users to privacy regulators or mention the GDPR. WhatsApp called it a bug and removed it; EU users still have the right to complain to the Irish Data Protection Commission.

Spyware on a university rector's iPhone. Citizen Lab confirmed a Pegasus infection on the phone of the rector of the University of Belgrade, a supporter of Serbia's student protests, days before Sunday's election. It was a zero-click attack, needing no tap from the victim. For people at real risk of this kind of targeting - journalists, activists, politicians and those close to them - Citizen Lab's advice is to turn on Lockdown Mode, keep iOS updated and treat an Apple threat notification as a sign of infection until an expert has checked the phone.

Hijacked Tor relays harvested SSH passwords. For five days in early October, attackers controlled over 300 Tor exit relays and intercepted SSH connections passing through them. People who accepted a changed host key and typed a password handed it over; key-based logins were not exposed. The Tor Project removed the relays by 5 October. If you log in to servers, use SSH keys rather than passwords, and never click past a changed host key warning.

Google may use connected Gmail and Photos data for ads. Google's updated privacy policy says that if you connect services like Gmail and Photos to its Personal Intelligence AI features, that data may shape the ads you see in Search. It is opt-in, and not yet offered in the EEA, Switzerland or the UK. If you turned it on, you can disconnect apps or switch off personalisation at google.com/search-personalization.

Arrests, bans and spies. INTERPOL's Operation Serengeti III arrested 1,462 people across 21 countries, mostly in Africa, for investment fraud, phishing and business email compromise, and recovered over $105 million. The US government ordered DeepSeek products removed from federal civilian systems; it does not restrict the public. Symantec reported that Russia's APT28 breached a NATO naval shipbuilder and a military aircraft engine maker. And OpenAI said it paused AI training in September after an agent reached the outside internet through a misconfigured DNS resolver, and that its red-team tests found agents escaping virtual machines - a reminder that the companies building these systems are still learning to contain them.

Pillow fixes. The widely used Python image library Pillow fixed several critical flaws in version 13.0.0, including one that could run commands from a single crafted image file in some setups. No attacks have been reported. Developers whose apps process uploaded images should update.

Summary#

1. Run a website? Make sure it runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm it is patched against PHP2Shell.
2. WordPress site owners: if you got Rank Math PRO 3.0.123 on 15 or 16 October, treat the site as compromised. Update UpdraftPlus to 1.26.13 or 2.26.13, delete old UpdraftCentral keys, and look for a user called "data-ops43".
3. Plex users: update Plex Media Server to 1.43.3.10861 or later. It is being actively attacked.
4. Never paste a command a web page tells you to run. Turn on Chrome's Enhanced Protection for an extra warning.
5. Developers: if you installed LiteLLM 1.107.0, an affected OVHcloud CLI build, or store secrets on Railway or OpenCode Console, rotate them from a clean machine and revoke them at the source.
6. Self-hosted GitLab, VeloCloud Orchestrator, Node.js, Bun, Envoy, Istio and Pillow: patch to the versions above.
7. Software with its own certificate list (Go, certifi, Node) needs updating for the eMudhra keys; sites on the emSign ECC root need new certificates before 27 October.
8. Firewalls and VPNs: patch Palo Alto and Fortinet devices, and move VPN logins to passkeys or hardware keys rather than passwords plus codes.

This week's attacks kept going after the plumbing: the language a website runs on, the plugins and tools developers trust, the keys stored in hosting platforms. If you are not sure what your website runs on, which plugins and third-party tools can reach it, or which secrets are sitting in places they should not, get in touch - bluwarden can help you map that and close the gaps that matter first.

This roundup is for general information and reflects public reporting as of 25 October 2026. Vulnerability details, patch versions and exploitation status change quickly; always confirm against the vendor's own advisory before acting.