Black October: PHP2Shell embargo leak, LiteLLM backdoor and eMudhra keys

Between 17 and 24 October 2026, PHP shipped emergency patches for two pre-auth RCEs rated CVSS 9.2 (CVE-2026-109618 and CVE-2026-109619), affecting versions from 5.4 up. The release was moved a day earlier after an embargo leak; LiteLLM 1.107.0 on PyPI carried a backdoor via a master key left unrevoked since May, and eMudhra had eight intermediate keys derivable from public certificates.

• CVE-2026-109618 and CVE-2026-109619: CVSS 9.2, unauthenticated RCE in PHP-FPM, mod_php, php-cgi
• Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; branches 7.4–8.1 got only partial backports
• LiteLLM 1.107.0 backdoor was live on PyPI roughly 11:39–13:23 UTC on 21 October, images until 14:20
• LiteLLM master key leaked to a public repo on 27 May and stayed unrevoked for 136 days