Two infrastructure failures, one week.
PHP2Shell (CVE-2026-109618/109619, CVSS 9.2): unauthenticated RCE in PHP. PoCs out the same day as patches. Fix: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — then check for prior exploitation.
eMudhra: CA keys so weak one was literally the number 4. Recoverable in seconds. Chrome removes the root Oct 27 — ~30,800 certs at risk.
Two problems, two responses.
🔗 https://threataft.com/articles/php2shell-emudhra-infrastructure-failures-different-responses
ThreatAftPHP2Shell RCE and eMudhra CA Incident: Security GuidePHP2Shell RCE flaws and eMudhra's compromised CA keys demand separate responses. Patch PHP, update trust stores, and audit certificate dependencies.