News
Critical RCE bugs, supply‑chain attack and AI threats
• PHP Foundation releases patches for two critical PHP2Shell remote code execution flaws (CVE‑2026‑109618, CVE‑2026‑109619) prompting widespread scanning and site takedowns • eMudhra exits TLS certificate market after weak private keys compromise; Apple blocks affected certificates on Oct 19‑23, 2026 • Google fixes severe RCE vulnerability in Brotli decoder (CVE‑2026‑111497); updates also released for libbrotli, Python, Node.js, Bun, Envoy, Istio • Two high‑severity Linux KSMBD RCE flaws (ZDI‑CAN‑33774, ZDI‑CAN‑33549) disclosed, with guidance to restrict unprivileged namespaces and apply seccomp defaults • Plex Media Server vulnerabilities (CVE‑2026‑96652‑96656) exploited in the wild to deliver cryptominers, added to CISA KEV catalog • Railway reports targeted campaign on Oct 20, 2026 aiming to steal AI provider API keys for model distillation attacks • LiteLLM master‑key leak leads to supply‑chain attack via malicious Python package version 1.107.0