A Bad Week for the Web: What’s Confirmed and What to Do

Three separate security incidents hit three different parts of the stack in one week: PHP2Shell, the Railway environment variable breach, and eMudhra's compromised certificate authority keys. Here's what happened, what's actually confirmed, and what you need to do, if anything. As promised, the incident numbers and dates are below.

Facts as of October 23, 2026. These stories are still moving, so check the sources for updates.

PHP2SHELL
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)
- CVSS v4.0 9.2, Critical. The 10.0 going around came from the leak, not from PHP.
- Unauthenticated remote code execution in PHP itself, affecting versions back to 5.4
- Oct 17: Amazon saw the first exploitation attempt on its honeypots
- Oct 20: details leaked ahead of the planned Oct 22 disclosure
- Oct 21: fixes released and CISA published an alert
- Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. One-time source patches exist for 7.4, 8.0 and 8.1.
- No confirmed break-ins reported as of Oct 22
- Found by Wiz Research, Calif and OpenAI's security team

NODE.JS
- Oct 21: security release fixing 10 CVEs
- CVE-2026-111497: Brotli decompression flaw, rated High, no workaround
- Fixed in Node 22.23.4, 24.22.1 and 26.12.1. The same release blocks the eight eMudhra intermediates.

RAILWAY
- Status page incident QH8L8B3E
- Oct 21: Railway disclosed that an unauthorized party got into the systems that store customer environment variables and, for some customers, obtained the decrypted values. Builds and deploys were paused.
- Oct 22: builds back for Pro and Enterprise (06:29 UTC) and Hobby (21:08 UTC)
- Oct 23: builds and deployments running normally on every plan, including Free and Trial (08:09 UTC update)
- Earlier platform incidents: Vercel (disclosed Apr 19, 2026) and OpenCode (Oct 17, 2026). Nobody has said it's the same attackers.

EMUDHRA
- Mozilla Bugzilla 2083449
- Eight intermediate CA private keys were recoverable: six for TLS, two for code signing. They were generated on Apr 30, 2025 by a broken key generation step, and one private key was literally the number 4.
- Oct 17: reported to the browsers. Chrome blocked the intermediates at 19:45 UTC and Mozilla's block was in place by 22:59 UTC.
- Oct 20: made public, and Firefox 158.0.1 removed the emSign ECC Root CA - G3 root
- Oct 22: eMudhra said it will leave the SSL/TLS certificate business
- Oct 27: Chrome removes emSign ECC Root CA - G3

WHAT TO DO
- PHP: update to a fixed version. On a Linux distro the version number may not change, so check your distro's security advisory, then restart PHP so the workers pick up the fix.
- Node: update to 22.23.4, 24.22.1 or 26.12.1
- Railway: revoke the old keys at the provider first, create new ones, then update Railway and redeploy. Rotate every secret, not just the ones you think were exposed.
- Everyone: use a separate API key for every app, set spending limits and alerts, and check your OpenAI and Anthropic usage dashboards for unfamiliar models or sudden spikes.
- eMudhra: for most people, nothing. Keep your browser and OS updated. If you have a cert that chains to emSign ECC Root CA - G3, replace it before Oct 27.

TIMESTAMPS
0:00 Intro
1:25 PHP2Shell: what happened
1:52 Two ways to run PHP
2:44 It's a 9.2, not a 10
3:26 The 70% claim
3:54 Who found it, and AI's role
4:29 A messy patch
5:09 What to do about PHP
6:20 Node.js security release
7:01 Railway breach
7:55 Rotate or stay down
8:18 Why AI keys are the target
9:02 A stolen key is a credit card
9:25 What to do about Railway
9:54 Tips for everyone
10:32 eMudhra: 8 compromised CA keys
10:47 How the certificate chain works
11:39 Not a hack: tiny keys
12:20 The browser response and what to do
12:41 Wrap up: what ties it together
13:08 The fair pushback

SOURCES
PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5
CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
Node.js security releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Railway status, incident QH8L8B3E: https://status.railway.com/incident/QH8L8B3E
Google on the eMudhra intermediates: https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
Mozilla Bugzilla 2083449: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
Scott Helme on recovering the keys: https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/ Receive SMS online on sms24.me

Watch on YouTube

Subscribe on YouTubeReaderBot

TubeReader video aggregator is a website that collects and organizes online videos from the YouTube source. Video aggregation is done for different purposes, and TubeReader take different approaches to achieve their purpose.

Our try to collect videos of high quality or interest for visitors to view; the collection may be made by editors or may be based on community votes.

Another method is to base the collection on those videos most viewed, either at the aggregator site or at various popular video hosting sites.

TubeReader site exists to allow users to collect their own sets of videos, for personal use as well as for browsing and viewing by others; TubeReader can develop online communities around video sharing.

Our site allow users to create a personalized video playlist, for personal use as well as for browsing and viewing by others.

@YouTubeReaderBot allows you to subscribe to Youtube channels.

By using @YouTubeReaderBot Bot you agree with YouTube Terms of Service.

Use the @YouTubeReaderBot telegram bot to be the first to be notified when new videos are released on your favorite channels.

Look for new videos or channels and share them with your friends.

You can start using our bot from this video, subscribe now to A Bad Week for the Web: What’s Confirmed and What to Do

What is YouTube?

YouTube is a free video sharing website that makes it easy to watch online videos. You can even create and upload your own videos to share with others. Originally created in 2005, YouTube is now one of the most popular sites on the Web, with visitors watching around 6 billion hours of video every month.