⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

PHP2Shell is the name given to two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. They could allow an attacker to execute code on a vulnerable system remotely, without authentication. That means the attacker would not need a valid account first.

The danger is amplified because PHP is used widely across the web. After public disclosure, attackers and researchers began scanning for exposed systems. Cloudflare reported millions of exploitation attempts, showing how quickly interest spread. However, the article states that no successful exploitation had been observed at that time.

The PHP Foundation released patches for both flaws. Even without confirmed successful attacks, organizations faced pressure to identify vulnerable systems and update them quickly. Several websites went offline temporarily as a precaution, because the possible impact was severe and defenders could not assume that every attack attempt would fail.

Remote code execution means an attacker can make a computer or server run their chosen instructions from another system. “Unauthenticated” means the attacker does not need to log in or provide valid credentials first. Together, those properties remove two major barriers to exploitation.

For PHP2Shell, the article says attackers could reach this level through two PHP vulnerabilities. A criminal scanning the internet could look for vulnerable PHP systems and try to trigger the flaws remotely. If the attempt worked, the attacker could potentially control the affected process or use it to perform further actions.

This combination demands urgent attention because exposed systems may be reachable at scale. Cloudflare detected millions of exploitation attempts after disclosure, although no successful exploitation had been observed. Patching, identifying affected systems, and limiting exposure therefore mattered even before confirmed compromise appeared.

The phrase “millions of exploitation attempts” indicates a very broad wave of activity after PHP2Shell was disclosed. It does not mean millions of systems were compromised. It means Cloudflare observed attackers trying to exploit the vulnerabilities at a massive scale.

The likely mechanism, based on the article, was automated scanning and repeated exploitation attempts against internet-facing targets. The article describes hackers scanning for targets and says Cloudflare detected millions of attempts. Because PHP is widely used on the web, many organizations could have had reason to check their systems quickly.

The immediate reality was serious but not conclusive: no successful PHP2Shell exploitation had been observed to date. Still, the volume made the threat urgent. Organizations needed to patch, investigate exposure, and watch for signs of compromise, while security teams managed many other critical flaws at the same time.

Taking a website offline is a defensive choice when a serious vulnerability may be reachable from the internet. It stops normal access to the affected service, but it can also prevent attackers from reaching the vulnerable code while teams investigate and apply fixes.

PHP2Shell combined two critical flaws with unauthenticated remote code execution. PHP is also widely used on the web, and Cloudflare detected millions of exploitation attempts after disclosure. Those facts created a credible risk for exposed organizations, even though the article reports no successful exploitation at that point.

The outages therefore reflected caution rather than proof of compromise. Some operators judged temporary disruption safer than leaving potentially vulnerable systems online. The episode also shows why defenders must act before an attack is confirmed: widespread scanning, limited patching capacity, and the severity of possible consequences can make precautionary controls necessary.

The provided article mentions a leaked key and a software supply-chain attack, but it does not name LiteLLM or describe that incident’s mechanics. The explanation here is therefore general, not a reconstruction of facts from the article. A master key is a high-privilege credential, so whoever obtains it may be able to perform actions reserved for the software owner.

In a typical supply-chain attack, an attacker uses a stolen release, repository, package, or signing credential to insert harmful code into software that others download. People can be affected without deliberately importing the targeted project if the compromised component reaches them through another dependency, tool, service, or distribution channel. The exact LiteLLM path is not stated in the source.

The broader lesson is that trust can travel through software relationships. A single compromised key may affect downstream users who never chose the original project directly. Organizations therefore need to protect high-value keys, review dependency paths, and verify software integrity, although those specific controls are not detailed in the article.

A certificate authority uses private keys to support trust in digital certificates. If those keys are extremely weak, an attacker may be able to recover or break them. The attacker could then create certificates that appear to come from the affected authority.

The article says eight eMudhra intermediate CA certificates used “ridiculously weak” private keys. That weakness potentially allowed bad actors to break the keys and issue trusted certificates for arbitrary domains. A certificate for an arbitrary website could undermine the browser’s normal warning system by appearing valid.

Major browsers responded by blocking the affected certificate authorities and certificates. Apple began blocking specified certificates on its devices, and Python updated several packages to remove the emSign root CA from their bundles. The development led eMudhra to exit the certificate-issuing business, showing how one weak-key problem can damage trust across many systems.

A shared library provides code that many products and services reuse instead of building independently. If that library contains a serious security flaw, every product that includes the vulnerable code may need review and patching. The risk is multiplied by the library’s reach.

The article describes a critical flaw in Google’s Brotli decoder, CVE-2026-111497. It could lead to unauthenticated remote code execution. The issue was also addressed in libbrotli and in projects that rely on Brotli, including Python, C++, Node.js, Bun, Envoy, and Istio. The flaw was also called Node2Shell and HTTP2Shell.

This does not mean every listed product was automatically compromised. It means each affected project needed to address its use of the vulnerable decoder. The incident shows why maintainers must coordinate fixes across dependency chains, and why users may need updates from several different vendors after one foundational library flaw appears.