One week, three advisories.

SECURITY ADVISORY PHP2Shell Node.js eMudhra

Three kinds of failure

CVSS 9.2

[{"selector":"#anim-aff52595-70ba-4b76-9d39-51b4a77a2527","keyframes":{"opacity":[0,1]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-befbcec7-44b6-4a8e-88d0-e962f318ac69","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-b15db1e6-862c-4e36-882e-5690931be77f","keyframes":{"opacity":[0,1]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-ecc611b3-06bf-4a3f-a5c1-f74864074071","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-e828cbc9-9799-4e9e-abb0-8b5fb9946346","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ac7990b9-58b5-4a4e-8e63-9b644605126f","keyframes":{"opacity":[0,1]},"delay":0,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4c9e901f-600b-4b96-a180-e7b566fbb225","keyframes":{"opacity":[0,1]},"delay":140,"duration":900,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-9c4fdc33-3c95-4646-94f7-916f809093f6","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":140,"duration":900,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-52f4b2ef-ed07-49f9-9b91-7eacdbd3cf50","keyframes":{"transform":["translate3d(-107.86517%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":340,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-36ce4535-ad4e-4168-a1c7-7a245edfef04","keyframes":{"opacity":[0,1]},"delay":340,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8bc2a42d-219f-4ea0-991e-d87748d2bbb6","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":340,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-c345b837-8e11-4154-a44a-c6e2f56c0b4d","keyframes":{"transform":["translate3d(-163.63641%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":500,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f15e69b9-f1e3-4df5-b2e4-54a1ff2cc40d","keyframes":{"opacity":[0,1]},"delay":500,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-064e79b0-215d-4913-85f7-6d1c44800ef5","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":500,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-4cca4a62-0dd3-454e-8e82-63059758f2ce","keyframes":{"opacity":[0,1]},"delay":580,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] PHP2SHELL CVE-2026-109618 and CVE-2026-109619. Internet-facing systems go first.

10 CVEs

[{"selector":"#anim-3a72f035-4b26-4ef5-aad8-e1bb67b077af","keyframes":{"opacity":[0,1]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-3e2c3f4d-f77b-4a83-ae6b-0a4d80b1195f","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-3036ad34-79c9-42bf-9df4-263bf2041816","keyframes":{"opacity":[0,1]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-7a357adc-dbb9-4801-a76d-8629dbe67dc1","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-5663e678-8568-4d3e-b58f-3025bdd29e9a","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4922656c-b91f-4d14-a83b-5aa3a9b5bc63","keyframes":{"opacity":[0,1]},"delay":0,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6aa25f87-a5bb-43d8-88de-95f50b295399","keyframes":{"opacity":[0,1]},"delay":140,"duration":900,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-5537c9e3-7342-47a0-828d-f427c36b9c41","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":140,"duration":900,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-28a603cb-8fb6-4efd-9093-ea4d31b3d3c9","keyframes":{"transform":["translate3d(-107.86517%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":340,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-86f1a9e0-0928-4a4f-b642-bbd57946029f","keyframes":{"opacity":[0,1]},"delay":340,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8923ce6d-a7f6-4108-8daa-462885d4caa9","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":340,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-11afbffc-74ef-4969-949c-bb1331661f09","keyframes":{"transform":["translate3d(-163.63641%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":500,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c56ef155-bcbf-4471-a50c-addc7ea0a455","keyframes":{"opacity":[0,1]},"delay":500,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-7504563c-9cbe-4f43-a650-c4e9b60afb19","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":500,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-92ed1806-78e6-4738-aedc-1cf8c42e8f3a","keyframes":{"opacity":[0,1]},"delay":580,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] NODE.JS CVE-2026-111497. Upgrade to 22.23.4, 24.22.1 or 26.12.1 and restart every process.

Browsers moved in hours. Did your apps?

[{"selector":"#anim-23b068e2-bfdc-4369-a329-16688b60902d","keyframes":{"opacity":[0,1]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-fdff21a8-e12d-45a2-9975-fe9a40a89b36","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-ec90143a-0bba-4863-9a50-ccae88ac6ecd","keyframes":{"opacity":[0,1]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-c0a100f1-5c14-4c30-85fa-f4aba9ecbad6","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-84a57413-12ff-4ae4-bda6-b1788e16d5b7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-af95cd3d-d6b7-46f7-b98e-4f2d0ff36362","keyframes":{"opacity":[0,1]},"delay":0,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-795e0b87-ffd2-4912-9053-eb73d83afed9","keyframes":{"transform":["translate3d(-107.86517%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":140,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-544c447f-3fd6-4efc-b14a-7ba7c2d415e2","keyframes":{"opacity":[0,1]},"delay":140,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9b631ab2-d30d-4b1d-90c1-588469776014","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":140,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-a11f7fc5-45c7-4066-855e-e4dcfd93665f","keyframes":{"transform":["translate3d(-163.63641%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":300,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-de822015-b6c7-46f6-ad78-3c32d6fb88a3","keyframes":{"opacity":[0,1]},"delay":300,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f49059fb-1f82-476b-b648-13f0cd20195e","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":300,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-a1dd8f54-2ec5-4d30-9be7-cc7f282c6da7","keyframes":{"opacity":[0,1]},"delay":380,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] EMUDHRA Apps with their own trust stores (certifi, pip, Java keystores) still need updating.

Know what you run

Patch, rebuild, restart

Verify, watch, record

Get the full patch checklist

[{"selector":"#anim-4e63a876-1df0-4d84-bbfd-a1ec3f29fec6","keyframes":{"opacity":[0,1]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-34694202-4b4e-4d19-a665-72866db95210","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":1800,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-6bb1033f-58fa-4220-a3e8-a2e0c481a880","keyframes":{"opacity":[0,1]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-b75d6e99-87da-4e93-ace1-fd52159e4851","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":200,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-7f7cea1e-b464-4c1c-81b1-9dde2f2855bf","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-7cd00add-2067-4ffe-9535-c29fcbf6ee86","keyframes":{"opacity":[0,1]},"delay":0,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ea4a8d51-a966-4230-abe7-8fd6be2376b1","keyframes":{"transform":["translate3d(-107.86517%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":140,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-dfeb9cbe-3351-4364-bf5d-2052578ad2f4","keyframes":{"opacity":[0,1]},"delay":140,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5bd5abee-e91d-4c19-9a57-d8114fe43d94","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":140,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-724d9ff8-35e1-4b37-8b25-b92c73ffd22a","keyframes":{"opacity":[0,1]},"delay":300,"duration":700,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] READ MORE Including where these risks usually hide. Read the full article