PHP2Shell Was Under Attack Before the Patch: How to Triage This Week's Five Disclosures

Between October 17 and 22, 2026, serious security issues surfaced in PHP, GitLab, Node.js, the Unbound DNS resolver, and certificate authority eMudhra. Four shipped fixes on the same day, October 21, leaving security teams to fit five separate responses into a single week.

Ranked by severity score alone, the GitLab vulnerability would come first. A better ranking puts PHP at the top, because someone tried to exploit it four days before a patch existed.

Pre-disclosure exploitation is attacker activity against a vulnerability before its fix or advisory is public. Amazon Threat Intelligence observed a PHP2Shell exploitation attempt against its MadPot honeypots on October 17, while the vulnerabilities were still under embargo, and PHP did not release its fix until October 21. Anyone running PHP was exposed before there was anything to install.

That gap should change two habits. Patches should be ranked first by observed attacker activity and second by severity score, and threat hunts should start from the earliest known exploitation rather than the disclosure date. The rest of this post applies that ranking to all five.

Which of These Should You Patch First?

PHP and GitLab need attention now. The eMudhra incident has a fixed date because Chrome removes the affected root on October 27. Node.js and Unbound matter only if your environment uses the vulnerable feature, so the first step for those two is confirming whether it does.

Priority	Issue	Severity	Exploitation reported	Fixed in	Act
1	PHP2Shell (CVE-2026-109618, CVE-2026-109619)	CVSS 3.1 9.8 (NVD)	Attempts since October 17; no confirmed compromise	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35	Now
2	GitLab (CVE-2026-110264)	CVSS 3.1 10.0 (GitLab)	None; unverified proof-of-concept claims	19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13	Now
3	eMudhra intermediate CA keys (no CVE)	High (NopalCyber assessment)	None confirmed; keys are public	Trust store and certificate updates	Before October 27
4	Node.js Brotli decoder (CVE-2026-111497)	CVSS 4.0 9.2 (Google)	None in the wild; code execution shown in research	Node.js 22.23.4, 24.22.1, 26.12.1	This week, if exposed
5	Unbound DNS-over-QUIC (CVE-2026-97206)	CVSS 3.1 7.5 (NLnet Labs)	None	Unbound 1.26.2	Next maintenance window, if exposed

Patch Now: Two Paths to Code Execution on Your Servers

PHP2Shell and the GitLab vulnerability both let an unauthenticated attacker run code on a server. The difference is timing: PHP2Shell is already under attack, while GitLab reports no exploitation so far.

PHP2Shell (CVE-2026-109618, CVE-2026-109619)

The two vulnerabilities let a crafted web request run code inside PHP itself, even when the application has no vulnerability of its own, and NVD scores both 9.8. Apache mod_php carries the most risk, because PHP reports a demonstrated exploit there that fires before any application code runs.

All supported PHP branches are affected until updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and so are 8.1 and older, which no longer receive official releases. PHP also runs inside commercial products, where it is not always visible to the teams that operate them. Palo Alto Networks states that all PAN-OS and Panorama versions are affected through the management web interface, and no fixed release had shipped as of October 23. QNAP lists affected network storage firmware and apps, with fixes still in progress, and advises keeping those devices off the internet until they arrive.

What to do: Update the PHP runtime itself and restart every worker, since updating WordPress or a plugin does not touch PHP, and PHP states that no mitigation is complete on its own. Until Palo Alto ships a fix, restrict PAN-OS management access to trusted internal addresses. Attempts are continuing at scale. Amazon reports broad exploitation attempts, and Wordfence has blocked more than 74,000 related exploit and probing attempts on the sites it protects. Neither reports a confirmed compromise, but log searches should still reach back to October 17. NopalCyber's PHP2Shell advisory lists the indicators of compromise, detection guidance and interim mitigations for environments where patching has to wait.

GitLab (CVE-2026-110264)

An integer overflow, triggered when GitLab compiles a specially crafted regular expression, can give an unauthenticated user code execution on the server. GitLab scores it 10.0, the highest of the five. The practical stakes come from what the server holds. Source code, CI/CD variables and access tokens all live there, so an attacker who runs code on it can reach whatever those secrets unlock.

Self-managed Community and Enterprise editions from version 7.0 onward are affected, while GitLab.com and GitLab Dedicated are already patched. Instances on GitLab's October 12 releases still need this update, because those releases addressed a separate vulnerability. No exploitation has been reported. Public repositories claiming to contain proof-of-concept code have appeared since disclosure, but their claims have not been independently verified.

What to do: Upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab has not published a workaround, but it has released detections for self-managed instances. If code execution is suspected, the server should be treated as compromised and its secrets rotated. NopalCyber's GitLab advisory covers those detections, along with the logs to collect and the hunting steps that follow.

Fix Before October 27: The eMudhra CA Keys

The eMudhra incident sits apart from the other four. It has no CVE of its own and no single patch, but it does have a date: Chrome removes the affected root on October 27.

Eight eMudhra intermediate certificate authorities (CAs), six for TLS and two for code signing, were created with private keys that are integers below 256. Anyone can recover those keys from the public certificates, and at least one has already been posted online.

Browsers are largely protected. Chrome and Firefox blocked the keys on October 17, and Google found no TLS certificate from these CAs in Certificate Transparency (CT) logs before its block. The exposure sits instead with anything that relies on a static CA bundle that has not yet been updated, including command-line tools, language runtimes, CI/CD runners, containers and embedded devices. Code-signing checks on Windows also warrant review, since Microsoft trusts the affected code-signing root directly. No malicious use has been confirmed. Because the keys are public, updating trust stores now is the safer course.

What to do: Update operating system and application trust stores, then rebuild container images and Go programs so they pick up the change. If certificate errors appear afterward, keep verification enabled and trace each error to the certificate behind it. If your own site's certificate chains to emSign ECC Root CA - G3, replace it before Chrome removes that root on October 27. eMudhra, for its part, announced on October 22 that it is leaving the global SSL/TLS certificate business. NopalCyber's eMudhra advisory lists the fingerprints of all sixteen affected certificates and the fixed versions for each major runtime.

Patch If You Use the Vulnerable Feature

The last two carry real risk, but only under specific conditions. Checking whether those conditions exist in your environment should come before scheduling the work.

Node.js Brotli Decoder (CVE-2026-111497)

The Node.js releases that update the CA store for eMudhra also fix an out-of-bounds write in the bundled Brotli decoder. Node.js states the issue permits remote code execution, and Google scores it 9.2 under CVSS 4.0. Release lines 22.x, 24.x and 26.x are affected, and end-of-life lines will not receive a fix.

Exposure depends on how an application handles compressed data. The risk applies when an application, or a library it uses, decompresses attacker-controlled Brotli data, for example through node:zlib or a fetch() call that receives a response from an untrusted server. No exploitation in the wild has been reported. On October 22, however, researchers demonstrated code execution against the official, unmodified Node.js 24.22.0 image on Linux arm64, though not on every attempt. The patched 24.22.1 release rejects the same input.

What to do: Upgrade to 22.23.4, 24.22.1 or 26.12.1 and rebuild container images on a patched base image, which also brings in the eMudhra CA update. Any other software that bundles Brotli needs Brotli 1.0.10, 1.1.1, 1.2.1 or later. NopalCyber's Brotli advisory explains how to confirm whether a given Node.js build is patched.

Unbound DNS-over-QUIC (CVE-2026-97206)

A remote client can trigger a QUIC path migration that makes Unbound use freed memory and crash, which NLnet Labs scores 7.5 with availability as the only impact. Unbound 1.22.0 through 1.26.1 is affected when built with DNS-over-QUIC (DoQ) support and running more than one thread. Unbound defaults to a single thread, so a resolver on default settings is not exposed to this vulnerability. No exploitation has been reported.

What to do: Upgrade to 1.26.2, or apply the NLnet Labs patch to 1.26. if an upgrade isn't practical. NopalCyber's Unbound advisory points to the Unbound statistics that show whether a resolver is serving DoQ traffic.

What This Week Means for Security Teams

Four fixes landing on one day is, above all, a test of inventory. With a clear view of where PHP, GitLab, Node.js, Unbound, and older CA bundles run, a week like this becomes a scheduling exercise, and the next disclosure starts from a known map.

PHP2Shell adds a second lesson. When exploitation comes before disclosure, a patched server isn't necessarily clean. The hunt has to begin where the attacks did.

NopalCyber's Attack Surface Management continuously maps internet-facing assets, including PHP stacks, GitLab instances and firewall management interfaces, so the inventory exists before the next disclosure does. NopalCyber MXDR can also hunt an environment back to October 17 for PHP2Shell activity. To talk through either, contact the NopalCyber team.