A critical PHP flaw, a database breach and certificate keys that were tiny numbers, within days. What is confirmed, and how to check if you are affected.

Three security stories broke within days of each other. PHP2Shell is a critical flaw in PHP itself, a database vendor disclosed a breach, and a certificate authority turned out to be signing with keys that were tiny numbers. They look unrelated, but they teach the same thing: finding weaknesses is getting cheaper, so what matters now is how fast you fix things and whether you know what you run.

PHP2Shell: patch PHP now, and check logs back to 17 October.

Secrets in code: scan your repositories and rotate what turns up.

Certificates: check whether any of yours chain to eMudhra.

Last checked 22 October 2026. These stories are still moving.

PHP2Shell: a flaw in the code under much of the web

On 21 October PHP shipped emergency fixes for two flaws, CVE-2026-109618 and CVE-2026-109619.…