The Stack — October 22, 2026

Daily IT Briefing Cybersecurity

Today is a heavy security day. Three critical incidents hit core web and developer infrastructure: the PHP runtime, the TLS trust chain, and a widely used AI gateway library.

"PHP2Shell": critical RCE in the PHP engine, patches out now

Early reports described two emergency PHP releases as imminent and called the "PHP2Shell" exploit unconfirmed. The full disclosure has since landed, and the fixes are available.

Patched versions and CVEs

• Fixed in: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• CVEs: CVE-2026-109618 and CVE-2026-109619.
• Affected: every version back to PHP 5.4.
• Severity: The official CVSS score is 9.2. The 10.0 score that circulated during the leak was wrong.

Impact

• Unauthenticated remote code execution.
• Disclosure of process memory, which can leak passwords, tokens and API keys from other users' requests on the same worker.

Root cause

• PHP mishandles fatal errors, especially out-of-memory errors, during request processing.
• Stale global state survives into later requests on the same worker. That creates use-after-free and type-confusion conditions.

Attack vectors

• Session upload-progress handling. This works even if the app never calls `session_start()`.
• Fatal-error backtraces.
• OPcache shared-memory slot reuse.

Demonstrated exploits: Wiz showed working RCE chains against stock WordPress, Drupal and Joomla containers.

Mitigation: PHP says there is no complete workaround. You must upgrade PHP itself, because patching application code or plugins won't help. Note also that PHP 8.2 stops receiving security fixes on December 31, 2026.

Two competing narratives about who found it:

• Wiz's account:
• Wiz calls this an "AI inflection point." It credits frontier models (Gemini 4 Argon and GPT-5.6 Sol) with turning a decade-old flaw into a working exploit in about a week.
• It describes the bug as among the most severe "in software history."
• The write-up is heavily promotional, so discount the superlatives.
• The oft-quoted "70% of websites" figure measures PHP usage, not exploitable servers.
• The PHP Foundation's account:
• The out-of-memory issue was first flagged in 2024, during a Quarkslab audit funded by the Sovereign Tech Agency.
• The fix then stalled for months over compatibility trade-offs and lack of resources. The Foundation itself calls this a "structural failure."
• Calif and OpenAI independently reported an RCE path on August 11, and Wiz reported on August 24.
• Earlier AI-assisted scanning also contributed, including Anthropic's Claude Mythos (via Alpha-Omega) and OpenAI tooling.
• Balanced read: AI tools clearly sped up exploitation. The underlying bug, however, was known and simply unfunded.

The embargo partially broke down:

• The CVE IDs leaked on October 20, so the release was pulled forward to October 21, 14:00 UTC.
• Calif accidentally published a proof-of-concept video, which then spread.
• Chainguard shipped patched images more than six hours before the coordinated release. According to the Foundation, that gave attackers time to diff the fix.

Is it being exploited? Accounts conflict:

• Cloudflare reports attack traffic and payload-mutation attempts after the leak.
• The PHP security team says it found no functional public exploits at release time.
• Assume active probing either way.

Cloudflare's response:

• It pushed WAF rules to all plans, including Free, about 9 hours before disclosure.
• It debuted "full transaction detection," which inspects both the request and the response.
• It still insists you patch.

AI-driven report volume: AI-assisted research is flooding maintainers. The PHP team has issued 15 CVEs since July 1 and triaged more than 100 invalid or duplicate reports. The Foundation is now asking for sponsorship to fund core security engineers.

eMudhra intermediate CAs had trivially recoverable private keys

Initial reports described "eight compromised intermediate certificates" from an unnamed CA. The details show something different from a classic theft. No keys were stolen. They were simply never secret in the first place.

What went wrong

• Eight eMudhra intermediates created in April 2025 used P-384 private keys that were effectively a single byte, with values such as 4, 56 and 115.
• Anyone could recover them from the public certificate in milliseconds.
• To be clear, the curve itself is not the weakness. The key generation was.

Affected certificates

• Six are TLS issuing CAs (DV, OV and EV).
• Two are code-signing CAs.
• All eight were also cross-signed by Sectigo's AAA Certificate Services root.

eMudhra's explanation: A bug in the key-ceremony script generated a second, weak key pair on the HSM. Similar naming then led staff to use the wrong key for the certificate signing request.

Browser response

• Chrome has blocked the intermediates via CRLSet, and Firefox via OneCRL.
• Mozilla is removing the eMudhra root in an NSS update.
• Chrome is removing it in Chrome Root Store v43.

Why this is worse than it looks: The keys were effectively public for about 17 months, and there is no way to know whether anyone abused them.

• Browsers are probably fine. Updated browsers enforce Certificate Transparency and block the intermediates directly.
• Most non-browser clients are exposed. They don't check revocation or CT by default. That includes curl, Python, Node, Go, Java, package managers, CI pipelines and IoT devices.
• The researcher showed a forged `api.stripe.com` certificate accepted by default on Linux and macOS.
• Windows code signing is exposed wherever revocation isn't checked.

Action items

• Update OS CA bundles, `certifi`, Node and Homebrew.
• Rebuild your container images.
• Frozen-firmware devices may trust these certificates until they expire in 2039.

LiteLLM 1.107.0 on PyPI was malicious

A backdoored LiteLLM 1.107.0 appeared on PyPI on October 21, and reportedly on Docker as well. It has since been removed.

Persistence: It drops `cook.pth` and `sitecustomize.py` into site-packages. Both execute in every Python process on the host, including ones that never import litellm.

Payload

• Credential stealer: It grabs SSH keys, cloud credentials, CI/CD and AI tool tokens, and browser passwords. It also takes the LLM provider keys stored in a LiteLLM proxy database. Data goes to `www.litellm[.]dev`.
• Backdoor: An hourly daemon pulls its command-server address from a GitHub repo, then downloads and runs remote code.
• That repo went offline about two hours after the release.
• Any second-stage code already delivered may still have run.

How it got in: The malicious source matches neither the release tag nor any public commit. Researchers assess, with moderate to high confidence, that BerriAI's private release pipeline built the wheels from attacker-modified source. This is not confirmed.

Clean versions: 1.106.2, 1.107.0rc1 and 1.107.0rc2.

If you installed 1.107.0: Treat the host as fully compromised and rotate every credential it could reach.

Industry Anthropic's leaked draft S-1: big revenue, bigger paper losses

A draft IPO prospectus has been reported in the financial press. Anthropic is reportedly targeting a November IPO and did not comment. All figures are from an unofficial draft and could change.

First half of 2026

• Revenue: $16.3B, up from $1.1B in the same period of 2025.
• Net loss: $80.7B, nearly double the full-year 2025 loss of $42B.
• About $72B of that is non-cash write-downs tied to convertible bonds and similar financing instruments, not operating spend.
• This context matters, and it is missing from some coverage.
• Compute and infrastructure spend: nearly $9B, already above the full-year 2025 figure of $7.3B.

Third-quarter claim: Anthropic reportedly told investors Q3 revenue alone hit $16.8B, up 45% from Q2. Treat this as pre-IPO pitch material.

Discrepancies to flag:

• Customer concentration.
• One account says two customers made up roughly one-fifth of sales.
• Another says most revenue came from two customers.
• Those are very different risk profiles.
• Both accounts agree the filing expects a "significant" share of future revenue to come from a "limited" number of customers.
• Cloud commitments.
• One report cites roughly $450B over 7–10 years:
• ~$111B with Google Cloud
• ~$110B with AWS
• ~$31B with Microsoft
• up to $86B for Nvidia capacity through smaller AI-focused clouds
• Another cites potential spend above $750B, explicitly including deals still under negotiation.
• The likely reconciliation is committed contracts versus committed-plus-pending deals.

Compute strain: Anthropic is reportedly struggling to secure enough capacity from AWS, Google and Microsoft. Those providers increasingly see it as a competitor rather than just a customer.

• To compensate, it is leasing its own data centers and using third-party operators.
• The draft flags those operators' "limited operating history" as a reliability risk.

Risk factors take up roughly a third of the draft. They include:

• Liability from a "catastrophic AI incident" that could exceed insurance coverage.
• Growing local opposition to data center construction.

Science: Quantum Computing

Error correction keeps improving with scale. A new demonstration shows logical-qubit error rates falling substantially as the code grows larger.

• Why it matters: Getting an encoded qubit to beat its physical components, known as breakeven, was the earlier milestone. Showing errors keep dropping as you add qubits is the property fault-tolerant machines actually need.
• What's missing: The research team, hardware platform and exact numbers weren't available in today's reporting.

AI Infrastructure OpenAI models coming to Google Cloud

OpenAI announced its models will be offered on Google Cloud. No further detail on availability, model lineup or terms has emerged yet.

The move fits a broader pattern of frontier labs and hyperscalers blurring the line between partner and rival.

Google and Amazon chip away at PyTorch's Nvidia dependence

Google has open-sourced TorchTPU, a PyTorch backend for its TPUs.

• Google says existing PyTorch apps can move to TPUs, and therefore to Google Cloud, with a configuration change rather than a code rewrite.
• It reports compatibility work with Meta, Hugging Face, Inferact (vLLM), RadixArk (SGLang) and others.
• Related launches:
• A new TPU agent suite to help developers migrate apps and fix errors.
• Better PyTorch model support in LiteRT, Google's existing on-device runtime for phones, laptops and embedded hardware.

Amazon released TorchNeuron a day earlier, bringing the same no-rewrite pitch to Trainium.

• More significantly, Amazon is upstreaming changes to core PyTorch to decouple features from Nvidia-specific code.
• That would make PyTorch more hardware-agnostic for everyone, not only AWS customers.

Why it matters: PyTorch has been under the Linux Foundation since 2022 but grew up around CUDA. The widely quoted "85% of AI apps" figure is loosely sourced.

Caveats

• Portability doesn't guarantee migration. Real-world performance and adoption are still unproven.
• Framing Google as "one-upping" Amazon reflects Google's own messaging.

Dev World DuckDB 2.0.0 LTS "Cinnamon Teal"

This release is built from about 20,000 commits since 1.5.

• Support: 2.0 is supported until at least October 2027. Support for 1.5 is extended to March 2027.

Client-server mode

• A polished Quack protocol plus a new `CONNECT` statement.
• `CONNECT` also works with PostgreSQL and MySQL, with remote query pushdown.

Performance

• Asynchronous I/O for Parquet and CSV, giving much faster reads from object storage such as S3.
• `VARIANT` is now a first-class type, with automatic shredding for compression and fast execution.

Agent mode in the CLI

• It switches on automatically when a coding agent runs the CLI.
• It emits compact Markdown, JSON errors and cost estimates.
• The team measured 59% less output in its TPC-H tests.

Extensibility

• A new PEG-based parser is now the default, and extensions can add their own grammar.
• C API v2 is available for testing.
• Organizations can host and sign their own extension repositories.

New SQL features

• Triggers, which can be used for incremental materialized views.
• `$variable` shorthand and data-modifying CTEs.
• `NEAREST` joins for top-k similarity search.
• Nested schemas and JSON mutation functions.

Breaking changes

• Versions before 2.0 can't read 2.0 database files.
• A C++17 compiler is now required.
• ICU is replaced by a native implementation.
• The single-arrow lambda syntax is disabled by default.
• Amalgamation builds are deprecated.
• macOS x86_64 is being phased out.

Upgrade advice: Shadow-test before switching production, or wait for the November patch release.

---

Today's priorities:

1. Patch PHP.

2. Refresh CA bundles and rebuild container images.

3. Check every Python environment for LiteLLM 1.107.0.