cybersecurity

Oh boy.

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.

eMudhra in all their wisdom has come up with the worst press release.

Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base.

They aren't leaving because they're incompetent, it's just not good business. Also don't bully them online:

the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.

Reading the whole thing is a good laugh.

The PHP foundation's write-up if the two critical vulnerabilities that allowed for remote code execution. That cover the work that went into discovering it, external AI-assisted audits, and shortcomings.

The shortcoming included problems with resolving a known OOM issue that was later find to be more serious. They have outlined changes made with how security is handled moving forward. There were also issues with disclosure of the vulnerabilities by vendors. Rumours of the vulnerabilities started to circulate, security research firm, Calif, accidentally released a video of the exploit, and Chainguard broke the embargo by publishing a patch early. Yikes.

Now that the patches are officially out: - Calif released their detailed write-up with a teaser of php3shell, whatever that means. - Calif used GPT Sol so OpenAI had their moment. - Wiz having also discovered this vulnerability around the same time as Calif released their write-up. - Their discovery was powered by Gemini Argon and it is now Google's turn to bask in the sun. - Lobste.rs user, Yogurt, linked to the code change that fixes these vulnerabilities. It's large! - This entire ordeal was messy, ShellSharks gathers somes observations of their own.

Between the eMudhra certificate compromise and two critical PHP vulnerabilities it's been a hectic day and probably will be until the weekend. While I haven't been too affected I'm glad I run a simple home lab so there's both much to worry about there.

Don't have much else to say but I wanted to note this down somewhere and Jeff Geerling's post resonated.

Lina writes about about how E.164 international phone numbers can be mapped to a domain number under e164.arpa. They were able to find a disused nameserver used for the country codes and the challenge to report this issue ensues.

I discovered this through HackerNews.