PHP releases fixes for two unauthenticated code-execution flaws

Independent

PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix CVE-2026-109618 and CVE-2026-109619. CERT-EU identifies affected versions across web-serving configurations and reports that the PHP team considers mod_php highest risk.

Why it matters: Memory corruption during out-of-memory handling and stale state surviving between requests can enable unauthenticated code execution. A demonstrated mod_php exploit triggers before application code runs, placing remediation at the runtime layer for PHP application operators, including users of products embedding PHP.

Decision: Apply fixed runtime releases or applicable vendor fixes. Where immediate patching is infeasible, CERT-EU recommends considering isolation of internet-facing applications until fixes are applied and verified; configuration mitigations only reduce particular attack paths.

What remains uncertain: Hadrian's claim of exploitation at scale is a vendor report; iTnews had not independently verified the leaked proofs of concept. Older branches lack routine PHP-project updates, although vendor fixes and minimal source backports for PHP 7.4, 8.0 and 8.1 may provide remediation paths.

Read: Reported article: Critical flaws strike PHP as disclosure embargo is broken - iTnews; Primary source: CERT-EU - Critical Vulnerabilities in PHP

eMudhra certificate remediation requires application-specific trust updates

Independent

Eight eMudhra intermediate certificates had weak private keys. Browsers blocked the certificates, while Cloudflare reports releasing client and Tunnel updates and deploying service mitigations. Some customer-operated trust configurations still require action.

Why it matters: Cloudflare says the keys permit certificate forgery for any domain, enabling server impersonation and traffic interception or modification. API clients and containers can use verifiers distinct from browsers. In its October 21 report, iTnews found macOS curl accepted the compromised chain despite Apple's block: browser protection did not establish protection through that verification path.

Decision: For affected applications, base remediation and validation on the actual TLS verifier and its trust configuration. Updating an SDK or passing a browser test alone is insufficient; retain certificate verification when resolving resulting connection failures.

What remains uncertain: Cloudflare reported finding no active exploitation on its services, which does not establish outcomes elsewhere. The curl finding is a reported observation, not a current test of every macOS installation. Distrusting affected certificates can break connections that rely on them.

Read: Reported article: Cloudflare warns fixing botched eMudhra certs goes beyond browsers - iTnews; Primary source: 8 eMudhra certificates are compromised. Here's what you need to know | Cloudflare Blog

Malicious LiteLLM release adds Python-startup credential theft and remote-access payloads

Independent

The Register reports that LiteLLM 1.107.0 distributed credential-stealing malware and a remote-access trojan through PyPI and container registries. PyPI quarantined the version, and the affected image was removed from Docker Hub and GHCR.

Why it matters: Researchers cited by the article say the malicious files execute at Python startup, without requiring an application to call LiteLLM. This exposes developer machines, proxy containers and CI runners to attempted credential theft and remote commands. Registry removal cannot undo execution on an affected host.

Decision: If Python ran after the compromised package was installed, treat the environment as a potential credential-compromise incident rather than resolving it solely through a version change. Socket advises stopping deployment of 1.107.0 and investigating those environments; the article advises assuming secrets were stolen where the malware ran.

What remains uncertain: The supplied reporting establishes malicious capabilities, not confirmed theft from every affected installation. The incident's scale remained unknown, and BerriAI had not responded at publication. Technical findings come from researchers quoted in the article; their underlying reports were not supplied.

Read: Reported article: LiteLLM supply chain attack hoovers up passwords and secrets

No linked primary source could be read; claims rely on the reporting above.