PHP, Node.js, Go, GitLab Critical Vulnerabilities: Patches, Exploitation & AI Discovery

PHP: Two Vulnerabilities in Engine Error Handling

PHP fixed CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), both scoring CVSS v4.0 9.2 and allowing unauthenticated remote code execution under certain conditions.

First Vulnerability: Memory Exhaustion

The first issue triggers when a request hits memory_limit at a precise moment, leaving partially uninitialized internal data that PHP later treats as valid, causing memory corruption. PHP Foundation confirmed that in Apache mod_php, unauthenticated requests can trigger this before application code runs, with a full RCE demonstration on default configuration. PHP-FPM also confirmed RCE but requires traversing application code paths; trigger conditions differ between deployment modes.

Second Vulnerability: Use-After-Free Across Requests

A fatal error leaves internal global state pointing to freed memory from a previous request. The same worker may reuse this freed memory for subsequent requests, a classic use-after-free. This causes worker crashes, and reporters demonstrated RCE in a real Apache mod_php application.

Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php at highest risk. Updating only WordPress plugins does not fix the engine.

Official patches: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Minimal source backports exist for 7.4, 8.0, 8.1, but those branches remain unsupported.

Why Release Came Early

PHP Foundation's retrospective explains the early release and prior delays. In 2024, core developers saw early signs of the memory exhaustion bug during a Quarkslab audit but could not find a concrete RCE path. Multiple fix options had trade-offs: compatibility breaks, potential DoS, or requiring many third-party extensions to change. The small team could not decide, causing a "structural failure" of process and resources.

On August 11, 2026, Calif reported an unconditional RCE path for the same root cause; OpenAI independently reported the same day. Wiz and OpenAI added more vectors, prompting PHP to elevate priority. Original coordinated release was planned for October 22, 14:00 UTC. On October 20, CVE numbers leaked with wrong scores and no details. PHP moved release to October 21, 14:00 UTC. Around 20:00 UTC October 20, Calif accidentally posted an exploit demo video; copies persisted. On October 21, 07:41 UTC, Chainguard released fixed images six hours early, violating coordinated disclosure. Foundation noted no confirmed working exploit in the wild before official release.

Remi, CloudLinux, Plesk Patch Progress

Remi : EL9 x86_64 repo shows PHP 8.3.36, 8.4.27, 8.5.12; older branches 8.1.34-6 and 7.4.33-31 also updated. Other distros/architectures need separate verification.

CloudLinux : As of October 22, alt-php 5.2–8.5 for CL7/8/9 in stable; Ubuntu 22.04 alt-php branches, CL7–10 ea-php52 through ea-php85, and TuxCare ELS lines have fixes. CL10 alt-php 5.2 in stable; others from ELS ALT PHP repo. Critical detail: packages published but OVAL and UpdateInfo security metadata not yet updated. Running only security updates ( dnf updateinfo) may miss them; CloudLinux advises normal update flow then restart Apache/PHP-FPM/LiteSpeed. CloudLinux heavily uses backports; package versions may stay below upstream fixed versions. Must check full package version and changelog for CVE entries, not just PHP version number. alt-php, ea-php, and distro native PHP are separate. As of 22 Oct 09:21 UTC, native PHP 8.2/8.3 on CL9 and PHP 8.2 on CL8 in stable; CL10 PHP 8.3, CL9 PHP 8.0/8.1, CL8 PHP 7.2/7.4/8.0 in testing rolling out to ~0.2% servers; CL8 PHP 7.3 preparing; CL7 PHP 5.4 via TuxCare ELS not in this rollout. On 22 Oct 13:17 UTC, CloudLinux noted update failures may stem from outdated cloudlinux-release; required minimum versions: CL7 7.9-2.17, CL8 8.10-16, CL9 9.8-3, CL10 10-5. Update that package, clean cache, retry PHP update.

Plesk : Two components — website PHP and panel's own sw-engine (Linux) / plesk-engine (Windows). As of Oct 22, Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 include panel engine fixes. Website PHP on Linux provides backports for 7.4, 8.0, 8.1 where version number may not change (e.g., 7.4.33 before and after); identify by build date 2026-10-21. Example check: /opt/plesk/php/8.3/bin/php -v should show PHP 8.3.36 and built: Oct 21 2026 08:04:57. System php -v may not reflect website PHP.

Log Review Back to October 17

AWS MadPot honeypots detected PHP2Shell exploitation attempts on October 17, four days before public disclosure. On October 21 02:00–08:00 UTC, multiple attempt waves from different anonymous infrastructure; new PoCs hit sensors hours after patch release. AWS confirms only attempts, not successful compromise. For public PHP services, logs should be reviewed from October 17 onward. Cloudflare deployed WAF rules for free and paid users; WAF buys time but PHP official states upgrade is the only complete fix.

Node.js: Brotli, Certificate Validation, Random Number Caching

Security releases: 22.23.4, 24.22.1, 26.12.1. CVE-2026-111497: Brotli decoder out-of-bounds write, RCE risk, affects 22.x, 24.x, 26.x. Only impacts code paths that decode compressed data; not all Node.js services are automatically exploitable. CVE-2026-106074: Entropy cache used by crypto.randomUUID() and randomInt() may be saved into user startup snapshots and Single Executable Applications (SEA). Processes launched from same snapshot/artifact repeat cached random values. Affects same three branches; only when using startup snapshots or SEA, not all Node.js processes.

Other fixes: NUL byte truncation in DNS names, TLS hostname/IP verification, permission model. Impact varies: full-width digit IP TLS check affects 24.x/26.x; ZIP header validation only 26.x. Dependencies updated: ca-cert, c-ares, OpenSSL, SQLite, Undici per branch.

Node.js warns: EOL branches are considered affected by default during security releases; services on unsupported branches cannot assume safety just because only 22.x/24.x/26.x are listed. Fixes are in Node.js runtime; npm update does not replace runtime. Container deployments must update runtime and rebuild images; bundled Node.js installers, SEA, Electron apps must verify bundled version and vendor advisories; managed serverless depends on platform runtime update schedule.

Go: Rejecting No-Longer-Trusted Intermediate Certificates

Node.js dependency update highlighted eMudhra intermediate certificate private key leak. Go added reject list for a batch of untrusted intermediates.

Mozilla received report from researcher Wayne on October 17, independently recovered 8 intermediate CA private keys, confirming key generation flaw. Six used for TLS, two for code signing. Mozilla added to Firefox OneCRL same night.

Scott Helme's October 20 analysis: certificates used P-384 curve but private keys were integers <256, one being 4. He recovered all 8 keys from public certificates on a laptop in under a second. Flaw in key generation, not P-384 algorithm. He locally reproduced impersonation: configured test service with forged certificate for api.stripe.com; default curl, Python, Node.js clients accepted it ( SSL certificate verify ok, handshake success, authorized: true). This was local reproduction; Stripe not involved or breached.

Implication: any client still trusting that certificate chain without effective revocation/rejection can be impersonated if attacker controls network path. Browsers updated blocklists; server SDKs, scripts, old containers may not.

Go's GO-2026-6809 ( CVE-2026-111943) affects crypto/x509. Most platforms use system root store, but some trust stores don't auto-update. Go 1.26.10 and 1.27.3 (released Oct 19, vuln DB entry Oct 21) add reject list in crypto/x509; Certificate.Verify returns error for known untrusted intermediates. Go services often deploy as static binaries; upgrading toolchain on dev/CI does not change running binaries. Must rebuild with fixed toolchain and redeploy. Merely including fixed stdlib insufficient to judge exploitability; depends on actual verification call paths, certificate chains, platform trust store.

GitLab: Unauthenticated RCE via Regex Integer Overflow

GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 on October 21. CVE-2026-110264 CVSS 10.0: unauthenticated users may exploit integer overflow in regex compiler to execute arbitrary code on GitLab server. GitLab.com and GitLab Dedicated already patched; primary risk in self-managed instances.

Update includes database migrations. Example: 19.4.3 has post-deployment migrations. Single-node updates may need downtime; multi-version upgrades cannot skip mandated intermediate versions; background migrations must complete at each step. GitLab published two exploitation attempt detection rules for admins to audit logs.

Also This Week: nginx and PingCAP

nginx Security Updates

October 14: 1.31.7 (mainline) and 1.30.6 (stable) fix five issues: CVE-2026-15176: alias with rewrite buffer overflow. F5's CVE record more specific: requires alias, rewrite, and referencing $request_filename in set, return, or access log format. Crafted request may cause worker restart; code execution further requires ASLR disabled or bypassed. Rated medium in nginx list; F5 CVSS v3.1 8.1, v4.0 9.2 (different scales). CVE-2026-93479: Variable string expression evaluation (document root, access log, etc.) CVE-2026-95101: HTTP/3 unknown frame data treated as request body, may bypass body size limit or inject into proxy request CVE-2026-97629: TLS session ticket key rotation: one key uninitialized, possible session forgery CVE-2026-97205: AIO with include virtual SSI pages trigger use-after-free

October 21 mainline 1.31.8 released; fixes still based on 1.31.7/1.30.6.

PingCAP Data Breach

Confirmed data exfiltration event. Attackers used stolen service account credentials between September 9 and October 7 to access internal systems, copy data, obtain source code. PingCAP detected October 7, disabled credentials same day; by October 14 all identified compromised credentials revoked, entry points sealed.

Confirmed exposed: usernames/emails, org/project relationships, SQL editor text and errors, some customer contracts/orders/pricing/billing configs. One exported table contained encrypted TiDB Cloud API keys. No evidence TiDB-stored data affected, nor that encrypted API keys were decrypted or used. Internal data leak confirmed; customer impact scope under investigation.

October 20 advisory urges customers to rotate TiDB Cloud management API keys and watch for targeted phishing. If no abuse suspected: create new key, switch and verify apps, revoke old key. If abuse suspected: revoke immediately.

AI's Role in This Vulnerability Cycle

AI participated in discovery, exploit development, and patch verification for PHP vulnerabilities. PHP Foundation, OpenAI, and Wiz documented their processes.

OpenAI disclosed Calif used GPT-5.6 Sol in Patch the Planet project to discover a critical PHP vulnerability.

Wiz independently found and reported two vulnerabilities, using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to assist discovery, exploit development, attack detection, and patch verification.

Wiz noted frontier models lower difficulty of adapting exploits across PHP versions and memory layouts. PHP's experience: early signs of memory corruption seen years ago but no RCE path found; this research closed that gap.

PHP maintainers also use AI to validate reports and deduplicate same-root-cause issues. Foundation metric: since July 1, team published 15 CVEs while processing 100+ reports deemed invalid, duplicate, or unreproducible. Every judgment and patch still involves human review.

From Public Patch to Exploit: Public Benchmarks

Several public evaluations detail the process; release dates, experimental conditions, and targets differ.

Anthropic N-day Research (June 8)

Selected 18 SpiderMonkey security patches from Firefox 148/149. Fed public diffs, pre/post-fix builds to model in isolated jsshell CLI engine. Claude Mythos Preview produced working code-execution exploits for 8/18 vulnerabilities. First crash PoC ~12 minutes; first working exploit <1 hour; all 8 in ~12 hours. Success criteria: read random secret from file inaccessible to JS sandbox, succeed only on vulnerable build. Not a full-browser remote attack test.

Windows experiment: 21 kernel local privilege escalation CVEs. Model given pre/post-fix binaries, decompilation, public advisories. Mythos Preview completed 8 exploit chains to SYSTEM. Verified on fresh VMs with whoami; BSOD counted as crash reproduction only, not successful escalation.

AWS Security Agent Evaluation (October 15)

37 real-world CVEs (2025–2026) built as isolated container targets with flag at expected exploit endpoint. Agent given target endpoint, one-line prompt, necessary initial credentials; started from unauthenticated/low-privilege position; runtime barred from querying CVE or public PoC. Agent captured 35 flags; researchers counted 33 as successful (89.2%). Two excluded: one bypassed tested vuln via direct SSRF to internal service; another read env vars from debug crash page without completing exploit path. Two more found vuln but crashed target before flag capture, not counted. 33/37 is per-target audited score, not equivalent to internet-wide attack success rate.

Disclosure and Patch Progress Tracking

Anthropic's public vulnerability disclosure ledger (last updated October 2): reported 6,157 findings to 591 open-source projects; 516 had upstream patches per their info (patch availability ≠ user deployment). Process: model generates candidates, external security firms reproduce, assess, write reports. Of 6,123 reviewed, 5,674 deemed valid (92.7%). "Valid" includes duplicates, out-of-threat-model, or wont-fix; not all are remotely exploitable high-severity. Two reporting paths: 1,333 after external review to maintainers; 4,824 submitted directly by Anthropic without same independent check, may contain false positives. Thus 6,157 cannot all be considered independently verified vulnerabilities.

Google (September 19) described integrating security scanning into infrastructure code daily commits. Lightweight scan on each change, then dedicated Agent uses AST, call graphs, rules to check if attacker can reach problematic code. Nightly integration tests find cross-change issues. Fix Agent drafts patches from scan results and reproduction examples, merges back into original change for human review. Google self-reports hundreds of vulnerabilities blocked monthly from entering codebase or production; dedicated review Agent precision >92%, latency <1 minute. This is internal Google process data, not comparable to Anthropic's external review rate.

Observed Real-World Attacks

Google Threat Intelligence (September 30, window through August): 2026 January disclosed vulnerabilities 5,045, August 10,740. Confirmed in-the-wild exploitation rose from 2025 monthly avg 10.5 to 2026 first 8 months avg 18; zero-day exploitation from 8 to 11 per month. ~0.23% of 2026 disclosed vulnerabilities observed exploited (~1 in 431). This measures vulnerability count, not compromised server ratio; remaining vulnerabilities not proven unexploitable. Google attributes growth to rapid weaponization of high-risk n-days; attacks still concentrate on edge devices and internet-exposed enterprise services.

Case study: BeyondTrust vulnerability CVE-2026-1731 discovered by Hacktron AI research Agent; within 4 days of public disclosure, GTIG observed real attacks; 5 attack clusters within 7 days. Post-exploitation included privilege escalation, data exfiltration, additional payload deployment. Proves AI-discovered vulnerabilities are being exploited by attackers; does not prove attacks themselves were AI-autonomous.

Caveats: CVE counts influenced by numbering policies and coordinated disclosures; public records lack unified AI attribution field. "More vulnerabilities", "models participate in discovery", "attackers use agents" each need separate evidence.

Back to PHP2Shell: AWS publicly confirms only exploitation attempts; success on real systems unknown.

Future Security Work Outlook

Short term: more vulnerabilities rediscovered and re-verified in legacy projects. Next 1–2 years may see increased demand for security engineers, SREs, DevOps to maintain old systems: identify affected packages, update images, rebuild binaries, plan migrations. Current vendor advisories already list many such concrete tasks.

Two years out: how many legacy services rewritten, how many security roles reduced — these reports don't answer. PHP's episode leaves a concrete lesson: models helped find exploit path, but maintainers still spent months choosing fix, handling compatibility, coordinating multi-vendor release.

References

PHP Security Advisory: Critical RCE vulnerabilities, update now (https://www.php.net/archive/2026.php#2026-10-21-5)

PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security (https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)

OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/)

Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (https://www.wiz.io/blog/php2shell-ai-uncovers-critical-rce-vulnerabilities-affecting-70-of-the-internet)

Remi's RPM repository: Enterprise Linux 9 package indexes (https://rpms.remirepo.net/enterprise/9/)

CloudLinux: Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 (https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619)

CloudLinux: PHP vulnerability fix status and phased rollout progress (https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5)

Plesk: Vulnerability CVE-2026-109618 and CVE-2026-109619 (https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk)

AWS Security Blog: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/)

Cloudflare: Cloudflare deploys protections against php2shell vulnerability (https://blog.cloudflare.com/php-vulnerabilities-waf-protection/)

Node.js: October 21, 2026 Security Releases (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)

Go Vulnerability Database: GO-2026-6809 (https://pkg.go.dev/vuln/GO-2026-6809)

Go: Release History (https://go.dev/doc/devel/release)

Mozilla: eMudhra intermediate certificate incident, Bug 2083449 (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)

Scott Helme: Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds (https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/)

GitLab: Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (https://about.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)

GitLab: Upgrade paths (https://docs.gitlab.com/update/upgrade_paths/)

nginx: Security advisories and changelog (https://nginx.org/en/security_advisories.html; https://nginx.org/en/CHANGES)

F5: NGINX ngx_http_core_module vulnerability, CVE-2026-15176 (https://www.cve.org/CVERecord?id=CVE-2026-15176)

PingCAP: Security Update: October 2026 (https://www.pingcap.com/trust-hub/security/security-update-october-2026)

PingCAP: Security Update: Customer Actions October 2026 (https://www.pingcap.com/trust-hub/security/customer-actions-october-2026/)

Anthropic: Measuring LLMs' impact on N-day exploits (https://www.anthropic.com/research/n-days)

Anthropic: Coordinated vulnerability disclosure dashboard (https://red.anthropic.com/2026/cvd/)

AWS Security Blog: AWS Security Agent exploited 33 of 37 new real-world CVEs (https://aws.amazon.com/blogs/security/aws-security-agent-now-part-of-aws-continuum-exploited-33-of-37-new-real-world-cves/)

Google Cloud: Using AI agents to secure Google infrastructure (https://cloud.google.com/blog/topics/systems/using-ai-agents-to-secure-google-infrastructure)

Google Threat Intelligence: Vulnerability Discovery and Exploitation Trends in the AI Era (https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/)