The Whistle: Special Bulletin - php2shell and the eMudhra CA keys

Not the Monday digest: PHP shipped an emergency release this morning for two leaked-then-patched core RCEs, eight eMudhra intermediate CA keys are compromised, and Cisco and Oracle both emptied their patch trucks.

PHP: the leak won the race

Two core RCE flaws in PHP leaked under embargo on October 20, with a screenshot of an exploit tool that calls itself “php2shell”; the PHP team pre-announced an emergency release, and the fixes shipped today as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both rate CVSS v4.0 9.2, unauthenticated; watchTowr reproduced one of the two before the fixes were public. Unit 42 describes the shape: CVE-2026-109619 leaves request-owned state pointing at freed memory after a fatal error, so the next request on the same PHP-FPM worker branches through stale data, and CVE-2026-109618 interrupts handling via out-of-memory processing, leaving partially initialized request data that cleanup trusts. Unit 42 counts 22.6 million exposed PHP instances; if you run PHP on anything internet-facing, patch today and check distro backports, since 8.1 and older get no official fix.

The eMudhra keys: a CA compromise, not a code bug

On October 17, a researcher signing as “Wayne” proved he held the private keys of eight eMudhra/emSign intermediate CA certificates by using each key to sign a message reading “We have a problem here”. Weakly generated in April 2025, the keys are recoverable from the public certificates; the intermediates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, and Mozilla’s incident report shows the cACompromise revocations of October 18. Red Hat’s bulletin covers the trust-store race: Firefox and Chrome blocked the chains on day one, Apple and Microsoft within three days, Go 1.27.3 and 1.26.10 hard-block all eight keys (CVE-2026-111943), and NSS, certifi, webpki-roots, and curl’s CA bundle updated the same day. Not a software vulnerability, so OS patching is not a complete answer: CT-enforcing browsers never saw these intermediates logged, and macOS’s built-in curl still verifies against an untouched /etc/ssl/cert.pem. Run the incident page’s check per runtime on your build machines.

Cisco: the third-Wednesday dump

October 21 was Cisco’s second monthly advisory day, and CVE-2026-76466 is the change-window item: an unauthenticated attacker with network access gets a root shell on clustered Expressway-C and Expressway-E through the database service, via static credentials (CWE-798) and cluster-mode TLS that skips client-certificate validation. CVSS 9.8, no workaround, first fix X15.5.20. The same batch hardens the UC products in one release: Emergency Responder, Prime Collaboration Deployment, Unified CM, and Unity Connection, with CVE-2026-76473 and CVE-2026-76474 at 9.8, plus Snort 3, whose CVE-2026-20043 out-of-bounds write at 9.0 also runs inside Meraki MX and Cyber Vision. Cisco found these in internal review, largely frontier-AI-assisted, with no exploitation reported. Patch the internet edge first anyway; last fortnight’s mail gateways did not wait for KEV.

Also patched: Oracle’s biggest CPU and an embedded TLS parser

Oracle’s October 20 CPU addresses 1,283 vulnerabilities by its own count, with E-Business Suite at 196 patches and a 10.0 top score, plus Essbase (38 fixes, up to 9.9), Outside In document parsing (CVE-2026-91354 at 9.9), and Agile PLM entries in this week’s NVD queue; most assume an authenticated or co-located attacker, so it is normal Tuesday work unless one of those suites faces the internet. Then CVE-2026-93475 in Eclipse ThreadX’s NetX Secure X.509 parser (CVSS v4.0 9.3) accepts RSA keys of any size while signature verification decrypts into fixed-size buffers, so a larger-modulus certificate writes past a static buffer during chain verification. Triggers: TLS client against a hostile server chain, or server doing client-cert authentication. CISA-coordinated, automatable, no exploitation observed; the fix is a firmware rebuild through your device vendors.

Patch PHP today, recheck trust stores on your build machines, and book a window for the Expressways. Something wrong here, or a stronger opinion? info@stackref.com always works.

This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.