Steven Lowson

This week has been quite a shitshow already, and there are still 2 days to go Here’s a quick recap of the security mess we’ve seen in just the last few days: 1. PHP Core RCE (CVSS 9.2) Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great… Useful links: Official PHP advisory and patches: php.net/archive/2026.php#202… Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks: vincentschmalbach.com/cve-20… Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity: huntress.com/blog/php2shell-… Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI: wiz.io/blog/php2shell-php-rc… Corelight’s open-source Zeek and Suricata detection rules: github.com/corelight/php2she… 2. GitLab RCE (CVSS 10.0) CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases. docs.gitlab.com/releases/pat… 3. Node.js / Brotli RCE CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected. nodejs.org/en/blog/vulnerabi… 4. DNS-over-QUIC DoS CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers. nlnetlabs.nl/projects/unboun… 5. eMudhra CA disaster And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct. Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server. Google’s analysis and response: blog.google/security/protect… Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations: bugzilla.mozilla.org/show_bu… — And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research. We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years. I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects. The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control. Anyway, quite a week. And it’s only Thursday…

Liked PHP2Shell? You’re gonna love Node2Shell. We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now! imperva.com/blog/node2shell-…