The day not every employee could stick to their working hours.
21 October 2026 / a very long day
A rant by @fiveoutofnine.
The original English text.
01 / It started with PHP.
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix,
02 / Everyone says the same thing.
so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline,
03 / Fine. Offline.
so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP.
04 / Oh, right. GitLab too.
Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years,
05 / pip install disaster
and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year,
06 / The cloud is having a day.
and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company,
07 / It keeps going.
and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post.
08 / The private key.
Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237.
09 / Clocking out?
Anyway, it's Wednesday.
After the tweet / microtimeline
Railway / AI API keys
Railway confirmed an internal breach: some stored secrets were decrypted, with AI API keys among the targets.
OpenRouter: the separate breach allegation was unconfirmed in the report dated 22 October.
Response on 21 OctBuilds and deployments were paused; Railway recommended rotating stored secrets.
AWS / PHP2Shell
AWS reported a PHP2Shell exploitation attempt from 17 October in its MadPot honeypot network: four days before public disclosure.
More actors followed on 21 October before the embargo lifted. AWS left open whether these early attempts would have succeeded against real systems.
CVE-2026-109618CVE-2026-109619New finding, earlier attack activityObserved on 17 October. Published on 21 October. The advisory was not the starting gun.
The PHP Foundation / Security
In 2024, a Foundation-funded PHP developer addressing an audit finding spotted early signs of the OOM memory problem. Exploitation was suspected, but no concrete attack path was found.
The team developed several approaches to a fix. Difficult trade-offs, decision-making problems and understaffing delayed resolution — openly acknowledged by the Foundation as a “structural failure”.
CVE-2026-109618Sustain the people securing PHPThe Foundation funds security work and is improving decision-making. Organizations relying on PHP should help sustain that work.
Fortinet / Security updates
On 21 October, Fortinet announced coordinated FortiOS, FortiManager and FortiAnalyzer updates for 22 October: critical and high-severity flaws found through AI-assisted security testing.
Full advisories were scheduled for 10 November. This announcement did not confirm active exploitation or identify individual CVEs.
Coordinated update date · 22 OctFortinet urged prompt upgrades, prioritizing internet-facing devices.
Ruby / GitLab
Crafted patterns could corrupt Onigmo memory during compilation and enable RCE in GitLab.
Requires attacker-controlled patterns. Regexp.timeout does not protect against these bugs.
CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264Fix releasesRuby 4.0.9 / 3.4.12 / 3.3.13
Collabora / Nextcloud
CISA added the already disclosed Collabora flaw to its Known Exploited Vulnerabilities catalog. Unauthenticated requests could execute commands as the web server user.
Affects Nextcloud with richdocumentscode before 26.4.303 while its CODE server is not running. Standalone Collabora servers are unaffected. The original advisory dates to 14 October.
CVE-2026-110447Active exploitation / KEV addition · 23 OctUpdate the app to at least 26.4.303 or remove it. The vendor says disabling it is not sufficient.
PHP / Session upload progress
Another RCE notice: session upload progress combined with a runtime switch of the session serializer can open an additional attack path.
PHP describes an unusual combination of configuration and application code. Applications that never switch the serializer at runtime are unaffected by this path.
CVE-2026-115560Fix handled in the regular release cyclePHP suggested session.upload_progress.enabled=0 in the meantime. Those who had already set it should keep it in place.
Google Brotli / Broccoli2Shell
Google’s Brotli decoder mistakes malformed data for missing data and writes beyond an eight-byte buffer. Possible outcomes include crashes, memory disclosure and remote code execution. Discovered by OpenAI Codex Security; also known as Node2Shell. CVSS 4.0: 9.2 / critical; Node.js: High.
Exposure requires decoding untrusted Brotli data, including indirectly through HTTP clients, link previews or uploads. The C decoder ships in Node.js, Python, Bun, Envoy and Istio; bundled copies in projects such as DuckDB also need checking. Compression alone does not trigger the flaw. The source fix dates to 27 February; security releases followed on 21 October: 236 days later.
CVE-2026-11149726 Oct · More vendor updates arriveAmazon Linux updates its advisory on 26 October; Node.js had already shipped updates on 21 October. Fixed versions: Brotli 1.2.1 (backports 1.1.1 / 1.0.10), Node.js 22.23.4 / 24.22.1 / 26.12.1, Python Brotli 1.2.1 / brotlicffi 1.2.1.0. Update affected runtimes, libraries and bundled copies, rebuild and redeploy containers, and restart processes. Updating a system package does not replace bundled copies.
TianoCore EDK II / UEFI
Crafted ICMP error messages can overflow a 504-byte buffer in the EDK II PXE driver. Possible outcomes include a stalled boot and code execution in UEFI firmware before the operating system loads. CVSS 4.0: 9.5 / critical.
Requires affected firmware actively PXE-booting over IPv4 or IPv6 and ICMP packets that can reach it. Targeted code execution requires knowledge of the firmware build. Disk-only boot does not reach this attack path. The original advisory was published on 22 October.
CVE-2026-97631Source fix available / vendor firmware requiredA fix PR was already public on 28 September; the source fix was merged on 15 October. Devices need the appropriate BIOS/UEFI update from their manufacturer. Disable unneeded network boot in the meantime.