>[email protected]

Over the past day, you might have seen online some things about the current "internet doomsday" that's happening, due to things like the recent PHP RCEs that have been discovered, the eMudhra CA scandal, the GitLab RCE that allegedly affects 12 years of releases, Node.js getting in on the fun with some surprise emergency patches, or LiteLLM being compromised on some package distribution platforms. But what does any of this actually mean? What is an RCE? What is PHP? What is a CA? Why are there so many strange nerdy acronyms and why should I care? I'll go over all of that jargon in this article, so strap in and prepare to have your mind overloaded with a bunch of rather uninteresting technical knowledge, and why seemingly half of the internet has been on fire over the past few days.

Required knowledge

Before I get into all the chaos that's been happening, it's important that you actually know what these things actually are. Feel free to skip this section if you're already technically minded and are familiar with concepts like RCEs and zero-days.

• RCE - short for "remote code execution", a critical vulnerability that allows an attacker to remotely run malicious code on a target machine, e.g. servers.
• PHP - a server-side scripting language for web development, typically used for adding user interactivity and input to otherwise static websites. If you've ever filled out a form online, chances are it was powered by PHP.
• CA - short for "certificate authority", a trusted organization that can issue out certificates that can be used to verify the identities of things online and enable encrypted connections across the net. I had to get an SSL certificate to let you securely access mazymetroplex.online!
• GitLab - a platform that people use to host their code and projects on, using the version control system. If you've heard of GitHub, its like that, just a little bit different.
• Node.js - a JavaScript runtime software that lets you run JavaScript code outside of the context of a web browser.
• LiteLLM - I wont lie, I wasn't familiar with this one until all the recent security drama (I'm not particularly tapped in when it comes to large language models and locally hosting them). LiteLLM is basically an AI gateway that lets you interact with lots of different LLM providers with one interface. Boring.
• CVE - short for the "common vulnerabilities and exposures" system, a reference method for known IT vulnerabilities.

PHP2Shell - The main course

In early August of 2026, a researcher at the security firm Calif, Ryan Austin, discovered the RCE exploits in PHP as a part of an initiative by OpenAI (the people behind ChatGPT) called "Patch the Planet", aiming to find vulnerabilities in crucial open-source software, powered by machine learning and AI agents. This discovery was reported to the PHP dev team, and around late September, the PHP security team acknowledged the vulnerabilities and began work to engineer a patch.

By mid October, attackers had already begun abusing the vulnerabilities before they had even been publicly disclosed, highlighting the severity of the exploits. Then, at 04:12 UTC on the 20th of October, the embargo broke. For context, when severe vulnerabilities like this are discovered, there is typically a very strict agreement between the security researchers that discovered it, the software developers and maintainers of the target, and any other relevant parties that aims to keep the technical details of the exploit a secret until a fix has been prepared. This is to stop hackers and attackers from immediately taking advantage of the exploit before it's been fixed, and attacking millions of machines across the globe.

Now with the full details of the exploit being widely available online, the PHP team abandoned their initial disclosure schedule, and put an emergency notice on their website giving notice about a security patch releasing the next day. What followed afterwards was absolute chaos. Major websites were going down for "emergency maintenance" left right and center, and lots of critical web infrastructure was left completely offline. An estimated 70% of all websites in the world are powered by PHP, so the scale of this exploit is incredibly large.

Another issue is that PHP only patched versions of PHP that released from the end of 2022 onward. That means that any website powered by a PHP server version from earlier than the end of 2022 hasn't been patched and is still vulnerable. This has led to fears that much of the old internet will be lost to time, since its a lot easier to just take a website offline than to manually update and patch it to the latest software versions, especially for older projects that have already been mostly abandoned by their former developers and just left to rot on the open web.

As of me writing this article, all recent versions of PHP have had emergency security patches released, and major security organizations have estimated the number of exploitation attempts across the world to already be in the millions, and lots of big websites and companies still have their websites and infrastructure offline while they work to patch things and mitigate the vulnerabilities. But the fun doesn't end there, since the PHP2Shell shitstorm isn't the only major internet security fail that's happened recently!

eMudhra - what if our private key was 4?

An Indian certificate authority called eMudhra recently had a bit of a slip up! In April of 2025, a faulty script for key generation was accidentally used, and created a set of 8 incredibly weak key pairs with tiny integer values, being the following:

4, 56, 66, 115, 155, 156, 230, 237

For context, a normal 384-bit private key should look something like this:

7b3f9a2c8e1d4b60a5f7c3b9e2d8a4f1
0c6b5a3e7d9f2c8b1a0e4d7c6b5a3e9f
2d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a

As you can see, there's a bit of a discrepancy there! This is quite bad, because since the keys could be recovered from public certificates, they could be used by anyone to issue certificates for any website, with browsers automatically trusting them as legitimate. The issue was reported on the 17th of October 2026, and major browsers like Firefox and Chrome blocked the certificates within hours, with Apple and Microsoft following suit in the following days.

On the 20th of October, Mozilla removed the root certificate that had issued the faulty keys from Firefox, and Google announced they would do the same on Chrome, however this issue is far from fixed, since lots of other software like Linux distributions, various applications, and embedded devices like your smart refrigerator ship with their own copies of root certificates, meaning the vulnerability could still be lurking for a long time to come.

The security fails never end!

On top of these two major fumbles that have caused incredible amounts of damage across the internet, even more stuff has gone wrong! GitLab very recently had to put out an emergency security update fixing yet another RCE vulnerability that affected self hosted instances of GitLab from the last 12 years, and Node.js also got in on the fun, with their dev team also releasing an emergency security patch to fix some vulnerabilities that, say it with me folks, could lead to yet another RCE! Seriously this has been a terrible week for cybersecurity.

On top of all that, on the 21st of October LiteLLM suffered a supply chain attack on PyPI, the Python package index. The attack hijacked a release of LiteLLM to stealthily include a backdoor and credential stealer, targeting API keys for major AI platforms like OpenAI and Anthropic. Even while I finish writing this article, I'm seeing reports of several Linux kernel vulnerabilities accidentally being posted to the public kernel mailing list. What are we doing people!

Why should I care?

In this new age of the internet with AI running rampant across the world, when exploits and vulnerabilities like these are discovered it can be MUCH more severe than it used to be even just a few years ago. With the power of locally hosted large language models, any attacker can spin up a machine that runs hundreds of independent AI agents to sweep across the web and find vulnerable targets, attempt to run exploits and attack said targets, and possibly cause severe damage by stealing databases of user data, installing trojans and other malware, or just completely obliterating any vulnerable server entirely.

It's a dangerous time that we're living in, so it's important to stay vigilant and keep up to date with the latest cybersecurity news and what to be aware of. If you're an end user at home, make sure you update your browsers and stay safe! If you're a server admin or IT professional, PLEASE update your PHP server infrastructure if that applies to you and make sure you aren't vulnerable to PHP2Shell, along with making sure everything else is secure. Thank you for reading my first article! I hope this was useful somehow, or at least was an interesting read :)

Please feel free to leave any comments or feedback below!