Overview
Critical remote code execution bugs surfaced across the stack this past week, with several already exploited. The Hacker News recap highlights the following items.
Top Stories
| Item | Detail |
|---|---|
| PHP2Shell | CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE flaws in PHP. Cloudflare reported millions of exploitation attempts, but no successful exploitation had been observed at the time of the recap. |
| eMudhra CA compromise | Eight intermediate CA certificates used weak private keys. Apple began blocking 12 certificates on October 19, and eMudhra is exiting the TLS certificate business. |
| Brotli | CVE-2026-111497 is an unauthenticated RCE in Google's Brotli decoder. Fixes cover libbrotli, Python, Node.js, Bun, Envoy, and Istio. |
| Ruby Onigmo regex bugs | CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264 could enable RCE on GitLab servers. Fixed in Ruby 4.0.9, 3.4.12, and 3.3.13. |
| GitLab | CVE-2026-110264 (CVSS 10.0) allows unauthenticated code execution via an integer overflow in regex compilation. Patched in 19.5.1, 19.4.3, and others. |
| Linux KSMBD | Two CVSS 9.0 RCE flaws and one local privilege escalation were disclosed before fixes. No CVEs are assigned and no exploitation has been reported. |
| Plex Media Server | CVE-2026-96652, -96654, -96655, and -96656 are chained to deliver crypto miners and proxy software. CISA added all four to its KEV catalog. |
| Railway | A targeted campaign detected on October 20 aimed to steal AI provider API keys. Users should revoke and reissue sensitive environment variables stored before October 21. |
| LiteLLM | A master key leaked in May let attackers push malicious LiteLLM 1.107.0 to PyPI, with a credential stealer and a backdoor. |
Other Notable Items
- Redis CVE-2026-25243: a heap memory-corruption bug in the
RESTOREcommand is exploited in the wild, with attempts starting around October 16. - MeshCentral: update to 1.3.1; an active exploit is compromising servers.
- Pillow: CVE-2026-112900, CVE-2026-112403, and CVE-2026-112393 allow code execution through crafted images.
- Rapid7: the average time from disclosure of a high-severity flaw to exploitation is now three days.
- CrowdStrike: four threat actors used Claude Code to make decisions and run commands during intrusions.
Recommendations
- Patch PHP, Brotli consumers, GitLab, Ruby, and Plex now; prioritize internet-facing systems.
- Rotate any credentials on machines that installed LiteLLM 1.107.0.
- Rotate Railway-stored AI provider keys.
- Update MeshCentral to 1.3.1 and review Redis exposure.
- Track CISA KEV additions as the exploitation window keeps shrinking.