Edition dated · Period reviewed: 19 October 2026 – 25 October 2026
An editorial selection, not an exhaustive feed: press coverage is cross-checked with vendor and researcher advisories. The analysis distinguishes risk, attempts and confirmed compromise. This dated edition is not a real-time feed.
Editorial scale: 1–3 low, 4–6 moderate, 7–8 high, 9–10 critical. 10 is the maximum risk. Ratings consider potential impact, exposure and exploitation conditions for affected systems before mitigation. They are neither CVSS scores nor an audit of your system.
Vulnérabilités
PHP2Shell: prioritise PHP runtime patches
Security risk 9/10
Unauthenticated code execution is possible; high priority for exposed, unpatched PHP deployments.
Two critical flaws, CVE-2026-109618 and CVE-2026-109619, can enable unauthenticated code execution. PHP released fixes on 21 October.
Our analysis
Coverage stresses urgency, but exposure also depends on deployment. Detected attempts do not prove compromise. PHP’s 23 October advisory describes an additional, uncommon session-related scenario.
Priority action
Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor’s backport; also review the 23 October advisory.
Certificats
eMudhra: TLS trust extends beyond the browser
Security risk 8/10
Fraudulent certificates can enable interception; exposure depends on the trust store and whether it has been updated.
Eight eMudhra intermediate certificates have recoverable weak keys. Reported on 17 October and publicly discussed on 20 October, the incident could enable forged certificates.
Our analysis
This is a cryptographic trust incident, not a PHP flaw. Browsers distributed protections, but applications with bundled certificate stores need separate review.
Priority action
Update affected systems, browsers, runtimes and SDKs. Review the Flutter and Firestore applications identified by Google.
Chaîne logicielle
LiteLLM 1.107.0: investigate exposed credentials
Security risk 10/10
The compromised release can steal secrets when Python starts; removing the package alone does not restore security.
Microsoft analysed a compromised LiteLLM release published on 21 October. Malicious code can run at Python startup without explicitly importing LiteLLM.
Our analysis
Removing the package is insufficient: developer machines, containers and CI agents may have exposed credentials. Recovery must cover both the environment and accessible secrets.
Priority action
Isolate affected environments, inspect artifacts without starting Python or pip there, rebuild from trusted sources and revoke exposed secrets.
Vulnérabilités
Node.js: Brotli, DNS and TLS fixes
Security risk 8/10
Network and TLS defects can bypass security checks; severity depends on which functions are used.
The 21 October security release fixes CVE-2026-111497 in the Brotli decoder, alongside DNS resolution and TLS verification issues.
Our analysis
Brotli exposure concerns applications decompressing attacker-controlled input. A public proof of concept does not mean every Node.js server is compromised.
Priority action
Deploy fixed versions 22.23.4, 24.22.1 or 26.12.1 for your release line, then rebuild and redeploy application images.
