Watch · Web development
A Bad Week for the Web: What’s Confirmed and What to Do
The Brief
- PHP2Shell: unauthenticated remote code execution in PHP affecting versions back to 5.4, rated CVSS v4.0 9.2 Critical; fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with one-time source patches for 7.4, 8.0 and 8.1; no confirmed break-ins reported as of Oct 22
- Railway: an unauthorized party accessed systems storing customer environment variables and, for some customers, obtained decrypted values; builds and deploys were paused on Oct 21 and were running normally on all plans by Oct 23
- eMudhra: eight intermediate CA private keys (six TLS, two code signing) were recoverable due to a broken key generation step; browsers blocked the intermediates, Firefox removed the emSign ECC Root CA - G3 root, and eMudhra said it will leave the SSL/TLS business
- Node.js: Oct 21 security release fixing 10 CVEs, including CVE-2026-111497, a High-rated Brotli decompression flaw with no workaround; fixed in Node 22.23.4, 24.22.1 and 26.12.1
Why watch · Several widely used parts of the web stack had serious security incidents in the same week, and the video covers which details are confirmed and what developers should check.
- PHP2Shell
- Railway
- eMudhra
- Node.js
Summarised by Claude from the video’s title and description – YouTube doesn’t make transcripts available, so check the video for the details.
Show the full video description ›Hide the video description
Three separate security incidents hit three different parts of the stack in one week: PHP2Shell, the Railway environment variable breach, and eMudhra's compromised certificate authority keys. Here's what happened, what's actually confirmed, and what you need to do, if anything. As promised, the incident numbers and dates are below. Facts as of October 23, 2026. These stories are still moving, so check the sources for updates. PHP2SHELL - CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) - CVSS v4.0 9.2, Critical. The 10.0 going around came from the leak, not from PHP. - Unauthenticated remote code execution in PHP itself, affecting versions back to 5.4 - Oct 17: Amazon saw the first exploitation attempt on its honeypots - Oct 20: details leaked ahead of the planned Oct 22 disclosure - Oct 21: fixes released and CISA published an alert - Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. One-time source patches exist for 7.4, 8.0 and 8.1. - No confirmed break-ins reported as of Oct 22 - Found by Wiz Research, Calif and OpenAI's security team NODE.JS - Oct 21: security release fixing 10 CVEs - CVE-2026-111497: Brotli decompression flaw, rated High, no workaround - Fixed in Node 22.23.4, 24.22.1 and 26.12.1. The same release blocks the eight eMudhra intermediates. RAILWAY - Status page incident QH8L8B3E - Oct 21: Railway disclosed that an unauthorized party got into the systems that store customer environment variables and, for some customers, obtained the decrypted values. Builds and deploys were paused. - Oct 22: builds back for Pro and Enterprise (06:29 UTC) and Hobby (21:08 UTC) - Oct 23: builds and deployments running normally on every plan, including Free and Trial (08:09 UTC update) - Earlier platform incidents: Vercel (disclosed Apr 19, 2026) and OpenCode (Oct 17, 2026). Nobody has said it's the same attackers. EMUDHRA - Mozilla Bugzilla 2083449 - Eight intermediate CA private keys were recoverable: six for TLS, two for code signing. They were generated on Apr 30, 2025 by a broken key generation step, and one private key was literally the number 4. - Oct 17: reported to the browsers. Chrome blocked the intermediates at 19:45 UTC and Mozilla's block was in place by 22:59 UTC. - Oct 20: made public, and Firefox 158.0.1 removed the emSign ECC Root CA - G3 root - Oct 22: eMudhra said it will leave the SSL/TLS certificate business - Oct 27: Chrome removes emSign ECC Root CA - G3 WHAT TO DO - PHP: update to a fixed version.
