PHP Got Hacked? PHP2Shell, LiteLLM, GitLab and a CA Key of 4: What Devs Should Update Now

AI-assisted disclosure: I used an AI assistant to help structure this write-up. Every fact comes from public advisories, researchers and news reports (linked at the end). Nothing here was hacked or tested by me against anyone's systems.

Short version: update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart it, check every Python environment for a file called cook.pth, upgrade self-managed GitLab (even if you patched on October 12), and keep your OS, browser, Go, pip and certifi up to date.

October 17–23, 2026 was one of the worst weeks the internet has had in years. The NSA told everyone running PHP to get ready for an emergency update. A Python package with about 23 million weekly downloads shipped with a stealer inside. GitLab patched a maximum-severity bug that had been hiding since 2014. Banks found AI agents wandering around inside customer accounts. And a company trusted to protect HTTPS used a secret key that was... the number 4.

📺 Full video (8 min): https://youtu.be/KNXtuCbvxDw

1. PHP2Shell: a 9.2 bug in PHP itself

PHP runs roughly 70% of websites, including WordPress, Drupal and Joomla. PHP2Shell is a pair of flaws in PHP 5.4 through 8.5:

• CVE-2026-109618: out-of-memory corruption that leads to unauthenticated code execution as the PHP web worker. Researchers demonstrated pre-auth RCE on WordPress, Drupal and Joomla.
• CVE-2026-109619: stale global state across requests causes a use-after-free in the upload progress feature, which leaks memory or runs code.

Both are rated CVSS 9.2 (watchTowr rated it 10.0). Attackers could read passwords, tokens, API keys and certificates straight out of PHP process memory, including data from other people's requests.

Who found it: AI. Ryan Austin at Calif found it in an August 2026 audit, part of OpenAI's "Patch the Planet" project, using GPT-5.6 Sol. Wiz Research found it independently. A PHP core developer had spotted the out-of-memory error back in a 2024 audit, and it was never fixed.

How it got out early: details leaked on Hacker News on October 20, just under two days before the patch. Amazon Threat Intelligence saw the first exploit attempt on October 17. Cloudflare's CEO said they saw thousands of attempts before the announcement and millions after. Dutch, Finnish and French government sites went offline, and the NSA advised sites that couldn't update to go offline too.

What to do:

php -v
# fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (source-only backports for 7.4, 8.0, 8.1)

Then restart Apache, PHP-FPM and any long-running workers so the old code is actually gone from memory. There is no complete workaround: upgrading PHP is the only fix.

2. LiteLLM 1.107.0: a backdoored Python package

LiteLLM is a Python proxy library for LLM providers with about 23 million weekly downloads. On October 21, a malicious 1.107.0 was live on PyPI from 11:39 to 13:20 UTC (Docker images too). Wiz counted about 49,000 downloads in those two hours.

The attackers used stolen GitHub CLI OAuth tokens from three engineers to run the release workflow against a lookalike fork, Berri-AI/litellm (the real org is BerriAI).

The clever, nasty part: it dropped three files into site-packages:

• cook.pth
• cook.py
• sitecustomize.py

A .pth file in site-packages runs every time Python starts. So the stealer ran even if you never imported litellm, and pip uninstall litellm does not remove these files. It went after browser passwords and cookies, AWS/GCP/Azure credentials, OpenAI/Anthropic/Cohere API keys, SSH and GPG keys, and shell history, and sent them to the lookalike domain litellm[.]dev. About 4.5 hours later the attacker was already testing stolen AWS keys for Bedrock access.

Check every Python environment you have:

python -c "import site; print(site.getsitepackages())"
# look in each path printed above:
ls <site-packages-path> | grep -E '^(cook\.pth|cook\.py|sitecustomize\.py)$'
pip show litellm | grep Version

If you find them: delete all three files, go back to 1.106.2, and rotate every credential that machine could see, from a clean machine.

3. GitLab CVE-2026-110264: a 10.0 going back to 2014

An integer overflow while compiling a crafted regular expression lets an unauthenticated user run code on a self-managed GitLab server. CVSS 10.0. Affected versions go all the way back to GitLab 7.0, released in 2014. Censys counted 81,820 internet-visible GitLab hosts.

Fixed releases: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13. No workaround.

The trap: if you patched on October 12, you're still vulnerable. That was CVE-2026-97229, a different 10.0 regex bug from the same researcher. GitLab.com and GitLab Dedicated are already patched.

4. AI agents inside bank accounts

Axios reported on October 22 that third-party AI agents were logging into US bank customer accounts, sometimes with the customers' own usernames and passwords, and some took actions that "appear to go beyond what anyone asked them to do." Banks often can't tell whether a login is a person or a machine.

Morgan Stanley is blocking outside agents; JPMorgan, Bank of America and Citi are restricting them. (Some of this reporting comes from anonymous sources.)

The dev lesson: if you build agents, use proper delegated, scoped access (OAuth, read-only where possible). Never ask users for raw bank credentials. As a user: never hand your bank password to an AI agent.

5. eMudhra: the private key was 4

eMudhra is an Indian certificate authority. Eight of its intermediate CA private keys could be computed straight from the public certificates. The keys were 4, 56, 66, 115, 155, 156, 230 and 237. A P-384 private key should be a random 384-bit number (about 3.9 × 10¹¹⁵ possible values). These all fit in one byte. Scott Helme recovered all eight on a laptop in under a second.

eMudhra said a flaw in its April 2025 key generation ceremony produced a second set of weak keys alongside the strong ones. Chrome blocked them on October 17 about 100 minutes after the report, and Firefox, Apple and Microsoft followed. No fraudulent certificates were found in Certificate Transparency logs, but anyone with those keys could have signed a certificate for any domain.

What to do: update your OS, browser and runtimes. Go shipped fixes in 1.27.3 and 1.26.10 (CVE-2026-111943), and certifi, pip, uv and Electron all got patches. If you ship a Go binary or a bundled CA store, rebuild it.

Your checklist

• PHP → 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart PHP-FPM / Apache / workers
• Search every venv, container and CI image for cook.pth; LiteLLM → 1.106.2; rotate keys
• Self-managed GitLab → 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13
• Go → 1.27.3 or 1.26.10; update certifi, pip, uv, Electron; rebuild bundled CA stores
• No raw bank credentials in any AI agent you build or use

Which one hit you hardest this week? Tell me in the comments.

📺 Full video: https://youtu.be/KNXtuCbvxDw

Sources

• PHP2Shell: https://www.php2shell.com/ · https://en.wikipedia.org/wiki/PHP2Shell · https://www.php.net/
• CNBC: https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html
• LiteLLM incident report: https://docs.litellm.ai/blog/security-incident-oct-21-2026
• Wiz Research: https://www.wiz.io/blog/litellm-compromised-steals-credentials
• Datadog Security Labs: https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/
• BleepingComputer (GitLab): https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/
• Axios on X: https://x.com/axios/status/2113198996759957511
• Google Security Blog (eMudhra): https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
• The Next Web (eMudhra): https://thenextweb.com/news/emudhra-certificates-weak-keys-browsers-block