PHP and GitLab Ship Emergency RCE Fixes While Weak CA Keys Shake TLS Trust

October was an unusually punishing month for open-source security. According to ipt's OSS October 2026 updates, published on dev.to, the PHP runtime and GitLab both required emergency patches for critical remote code execution flaws, while a certificate authority incident exposed how fragile TLS trust can be outside the browser.

PHP2Shell: two runtime flaws fixed under pressure

On October 21, PHP shipped emergency releases for a pair of critical vulnerabilities collectively known as PHP2Shell. The first, CVE-2026-109618, corrupts memory while the engine handles an out-of-memory condition. The second, CVE-2026-109619, stems from stale global state that still references memory belonging to earlier requests. The roundup reports that both can produce unauthenticated remote code execution under certain conditions, with working exploits demonstrated against Apache's mod_php and PHP-FPM also affected.

Because the bugs live in the interpreter rather than any framework, patching application dependencies accomplishes nothing until the runtime itself is updated, whether a server runs Symfony, Laravel or WordPress. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

A third, narrower issue, CVE-2026-115560, was disclosed on October 23 and was not covered by the emergency releases. It requires an unusual mix of session configuration and application behaviour, and PHP recommends disabling session.upload_progress.enabled in affected setups until a fix arrives. The PHP Foundation's announcement also acknowledges that limited resources and difficult security decisions slowed the response — a sobering note for one of the web's most widely deployed runtimes.

GitLab: two regex overflows rated 10.0

On October 12, GitLab patched CVE-2026-97229, an integer overflow in the compiler that handles regular expressions in CI/CD configuration. A carefully crafted regex in a pipeline file could trigger remote code execution on the GitLab server itself. Nine days later the company disclosed CVE-2026-110264, a second integer overflow in the same compilation path that reaches a much wider range of versions, potentially back to GitLab 7.0. Both carry the maximum CVSS score of 10.0.

There are prerequisites, notably for the first flaw, which requires the attacker to introduce malicious CI/CD configuration. Even so, GitLab confirmed exploitation may be possible without authentication in some circumstances. Attacks against the first vulnerability have already been observed, and CISA catalogued it on October 29. Fixes landed on October 12 and October 21 in versions 19.5.1, 19.4.3, 19.3.6 and several older supported branches, and self-managed administrators are urged to upgrade immediately and review GitLab's published detection rules. The stakes are high: a compromised instance typically holds source code, pipeline secrets, deployment credentials and container registries, making it a gateway to everything built through it.

eMudhra: intermediate keys that could be rebuilt

Researchers found that eight intermediate certificate authorities operated by eMudhra were generated with cryptographically weak keys, weak enough that the private keys could be reconstructed from information visible in the public certificates. That would let an attacker mint fraudulent certificates that appear to come from a trusted CA. eMudhra revoked the affected intermediates and browser vendors shipped protections; according to the company, none of them had issued end-entity certificates.

The harder problem is software that does not behave like a browser. Many TLS clients in containers, proxies and application runtimes consume static CA bundles while skipping revocation checks and Certificate Transparency. Istio, for instance, published an advisory and refreshed its dependencies and CA bundles: internal mesh mTLS is unaffected, but outbound connections using publicly trusted CAs can be. The roundup's practical warning bears repeating — refreshing a Kubernetes node's trust store is not enough if containers ship their own stale certificates, so affected runtimes and images need updating too.

Other open-source news from October

NVIDIA open-sourced its complete Run:ai GPU orchestration platform under Apache 2.0 on October 13. Its components — the KAI Scheduler with gang scheduling, quotas, fair sharing and topology-aware placement, a GPU Fractioning Operator, resource management tooling and the Workload Map — can be adopted independently, though GPU sharing still depends on NVIDIA technology and the packaged Community Product carries additional licence terms. An October 19 advisory also revealed that Open Policy Agent's signature verification for signed policy bundles can be bypassed under certain conditions, while llm-d reached version 1.0 and Pi emerged as a lightweight alternative for building extensible AI agents.

Why it matters

All three security stories erode the same thing: trust in layers beneath your own code. PHP2Shell sits under every framework written in the language, GitLab sits at the centre of the build pipeline, and the eMudhra incident sits under TLS itself. Two of the three are already in CISA's Known Exploited Vulnerabilities catalog, which makes patching remediation rather than prevention. The CA episode also shows that browser-grade defences do not automatically extend to the containers and proxies making most connections inside a datacentre. Anyone running PHP, self-managed GitLab, or software with its own trust store should treat October's updates as urgent, not optional.