Critical security flaws affecting PHP, GitLab, Node.js, Laravel and Signal have emerged alongside serious incidents involving LiteLLM, Tor relays and certificate infrastructure. Disclosures made between 20 and 22 October 2026 include confirmed exploitation, public proof-of-concept code and urgent security releases.
The incidents are separate, but their concentration creates a demanding update cycle. Organisations must distinguish actively exploited threats from vulnerabilities that are patched but not yet known to have been abused.
Critical security flaws in PHP, GitLab and Node.js
PHP2Shell flaws face active exploit attempts
PHP released emergency fixes on 21 October 2026 for two critical engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Dubbed PHP2Shell, both flaws can allow an unauthenticated attacker to achieve remote code execution by sending crafted requests to a vulnerable system.
A disclosure leak accelerated the release schedule, and proof-of-concept material is circulating. Cloudflare has observed exploit attempts, while web application firewall providers have introduced temporary detection and blocking rules. No breach has yet been publicly attributed solely to these critical security flaws, but the observed scanning means exposure is no longer theoretical.
The corrected PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations using older PHP branches will need to obtain backported fixes from their operating-system or application vendor rather than assuming their branch is unaffected.
GitLab patches unauthenticated code execution
GitLab issued a critical patch release on 21 October for CVE-2026-110264. The vulnerability is an integer overflow in GitLab’s regular expression compiler which, under certain conditions, could permit unauthenticated code execution on self-managed Community Edition and Enterprise Edition installations.
Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab’s cloud service was not identified as affected in the cited vendor information. No confirmed exploitation had been reported by 22 October, although the potential for unauthenticated compromise makes prompt patching important.
Node.js fixes Brotli RCE and TLS weaknesses
Node.js published security releases 26.12.1, 24.22.1 and 22.23.4 on 21 October. They address ten CVEs, led by CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can permit remote code execution.
The releases also correct multiple TLS hostname validation weaknesses. Official advisories did not report active exploitation, but applications processing untrusted compressed content or relying on affected TLS checks should be prioritised. Development teams need to update both direct Node.js installations and container images that embed vulnerable releases.
LiteLLM compromise and Tor relay credential theft
Malicious LiteLLM 1.107.0 entered registries
LiteLLM disclosed on 21 October that its release pipeline had been compromised. Attackers distributed malicious version 1.107.0 through PyPI and container registries, adding credential-stealing malware and remote code execution tooling to apparently legitimate artifacts.
The affected artifacts remained available for roughly two hours before removal. They included the PyPI package litellm 1.107.0 and Docker tags v1.107.0, latest, main-latest and main-stable during the relevant publication windows. The incident also affected releases distributed through Docker Hub and GitHub Container Registry.
The project believes an upstream token leak in AI gateway logs contributed to the compromise. This makes the incident more than a conventional dependency flaw: installing or deploying the affected build may have exposed credentials accessible to the package or container, even if the environment was later upgraded.
333 Tor exits intercepted SSH connections
Research published on 20 October described 333 malicious Tor exit relays that redirected SSH traffic to 12 interception servers. Attackers had compromised Linux hosts running Tor relays, converted many into exit nodes and changed their exit policies to attract TCP port 22 traffic.
The interception servers presented a constant ED25519 host key. Users who ignored the resulting SSH host key warning could submit credentials directly to the attackers. The infrastructure then attempted a second connection to the victim server and sought to deploy the Ebury backdoor.
This campaign was active between 2 and 5 October. The Tor Project marked the relays as BadExit, causing clients to avoid them, and the operators shut the nodes down between 4 and 5 October. Unlike several newly patched critical security flaws, this was confirmed malicious activity in which passwords were stolen when users accepted the unexpected key.
eMudhra certificate keys weakened trust infrastructure
Mozilla and Google were alerted on 17 October that private keys for eight eMudhra intermediate certificate authorities could be recovered from their public certificates. Public vendor posts followed on 20 October.
The affected intermediates used incorrectly generated P-384 keys and chained to the emSign ECC Root CA G3 and AAA Certificate Services roots. Recoverable private keys could allow an on-path attacker to issue apparently valid server or code-signing certificates until clients stopped trusting the intermediates.
Browser vendors responded through OneCRL, Chrome policies and related block-list mechanisms. Operating-system vendors are also updating certificate trust stores. No rogue end-entity certificates had been found in public certificate transparency logs by 22 October, but systems with outdated trust stores could remain exposed.
Signal, Laravel and Linux vulnerabilities
Signal’s CVE-2026-113380 affects RingRTC, its real-time communications component. The flaw could allow audio or video to continue flowing to another participant after a user believed they had ended a call. RingRTC 2.72.0 fixes the issue, and public coverage has not identified exploitation.
Laravel also patched CVE-2026-114509, tracked as GHSA-f9x3-7vq9-cph6. Applications using TokenGuard with MySQL or MariaDB could accept a crafted non-string credential and authenticate it against an unintended user record. The specific configuration is important because not every Laravel application uses TokenGuard or an affected database setup.
Laravel 12.68.0 and 13.29.0 contain the correction. Public proof-of-concept code is available, raising the likelihood that exposed applications will be tested for the authentication bypass.
A Linux kernel flaw nicknamed PwnEscape, CVE-2026-99999, was also disclosed. Initial reports indicate that a virtual machine guest could read host memory in some virtualised environments. Patch availability varies by Linux distribution, and the available reports did not confirm exploitation in the wild.
Critical security flaws timeline and priorities
- 17 October: Mozilla and Google received reports about the compromised eMudhra intermediate keys.
- 20 October: Browser vendors published eMudhra notices, the Tor relay research appeared, and Laravel community coverage detailed the TokenGuard fix.
- 21 October: PHP and Node.js issued security releases, while LiteLLM disclosed its supply-chain compromise and removed malicious artifacts.
- 21 to 22 October: GitLab’s critical update and Signal’s RingRTC correction received wider public attention.
Organisations should first identify installations of the malicious LiteLLM release and treat them as potentially compromised. That response should include isolating affected systems, examining execution and network logs, and rotating credentials or tokens accessible during deployment.
Internet-facing PHP and self-managed GitLab systems should then be matched against the exact fixed versions and updated. Node.js runtimes, Laravel applications and Signal components also require version checks, while infrastructure teams should confirm that eMudhra distrust updates have reached browsers, operating systems and application-specific trust stores.
Finally, teams using Tor for SSH should investigate unexpected host key changes observed during the campaign window. The mix of active exploitation, malicious packages and unexploited critical security flaws means version-specific verification is more reliable than treating every item as an equal or generic patching problem.
Originally reported by thehackernews.com.
