https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: Packagist. en https://vanemmerik.ai/supply-chain/2026-10-25/#php2shell-unit42-agentic-intrusion vea-sc-2026-10-25-php2shell-unit42-agentic-intrusion Sun, 25 Oct 2026 21:57:00 +0000 Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief (Oct 23, 12:30 PT) with a case in which attackers, apparently driven by an agentic AI platform, ran recon through a web shell at a European government body and obtained password hashes and MFA secrets within two hours of initial exploitation, then tried NTLM relay into Active Directory. The brief does not name the exact CVE used in that case, so treat it as strong but not definitive evidence that PHP2Shell has moved from attempts to real break-ins; our Oct 24 entry said none had been confirmed. Evening update: The Hacker News also reports that CYFIRMA tied a scanning campaign, with moderate confidence, to a suspected North Korea-linked actor probing 216 unpatched hosts in 12 countries (single source so far), and that ReliaQuest has published log artifacts for detection. Fixed PHP releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); a third flaw, CVE-2026-115560, still awaits a regular release, and neither main CVE was in CISA KEV as of this watch. What to do: Assume unpatched internet-facing PHP may already be compromised: patch, then hunt for web shells and unexpected outbound connections from PHP hosts since Oct 17, and rotate credentials those hosts could reach. https://vanemmerik.ai/supply-chain/2026-10-24/#php2shell-no-confirmed-compromise-aslr-bypass vea-sc-2026-10-24-php2shell-no-confirmed-compromise-aslr-bypass Sat, 24 Oct 2026 21:53:00 +0000 Two days into mass scanning for CVE-2026-109618 and CVE-2026-109619, no successful in-the-wild compromise has been confirmed: Sophos withdrew an earlier report of one, Wordfence and Hunt.io saw only failed attempts, and Sansec now says public exploits fail on default PHP settings. That window may not last. VulnCheck reports a working exploit for CVE-2026-109618 that leaks memory to defeat ASLR on x86-64 with error display off, the usual production setup; it is limited to its paying customers for now. Amazon's honeypots logged an attempt on Oct 17, four days before disclosure, so log reviews should start there. Fixed releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); PHP 8.1 and older get no fix, and neither CVE was in CISA KEV as of Oct 23. What to do: Keep patching to the fixed PHP releases and rebuild PHP base images; for end-of-life PHP, block multipart uploads at the edge if you can, and hunt for POST bodies containing PHP_SESSION_UPLOAD_PROGRESS from Oct 17 onward. https://vanemmerik.ai/supply-chain/2026-10-24/#emudhra-trust-store-updates vea-sc-2026-10-24-emudhra-trust-store-updates Sat, 24 Oct 2026 21:53:00 +0000 The eight eMudhra intermediate CA keys disclosed on Oct 20 were generated so weakly that anyone can recover them, which means a network attacker could mint certificates those intermediates sign; exposure dates back to April 2025, though no misuse has been found. Browsers block them already, but package managers, CI jobs and API clients that carry their own CA bundle keep trusting the chain until updated. Fixed bundles: certifi 2026.10.19, pip 26.2.2, uv 0.13.4, Node.js 22.23.4/24.22.1/26.12.1, Go 1.27.3/1.26.10, rustls-webpki 0.103.16, webpki-roots 1.0.10, composer/ca-bundle 1.4.16/1.6.0, plus Ubuntu, Debian, Alpine, Fedora and Wolfi ca-certificates. Bun, FreeBSD and Java's JDK cacerts were still unfixed or unconfirmed on Oct 23, and container images keep the old roots until rebuilt. What to do: Bump certifi, pip, uv, Node.js, Go and Rust webpki crates to the fixed versions, rebuild container images on patched base images, and check Java and Bun services separately; the system bundle should contain no emSign entries after updating. https://vanemmerik.ai/supply-chain/2026-10-23/#php2shell-cve-2026-109618 vea-sc-2026-10-23-php2shell-cve-2026-109618 Sat, 24 Oct 2026 03:05:00 +0000 PHP shipped emergency releases on Oct 21 for two critical flaws that let an attacker without an account run code on a server. Exploit attempts reported since then number in the millions, with attackers trying to install Mirai botnet malware. On Oct 23 PHP flagged a separate, lower-risk session issue that the emergency builds do not fix; it only affects unusual session-handler configurations. What to do: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, including container base images. As a stopgap (and to cover the Oct 23 issue), set session.upload_progress.enabled=0.