Tech Brief

Wednesday, October 21, 2026

Two trust systems failed in the same 48 hours: the PHP runtime under most of the web, and the CA bundle under every HTTPS client.

Today needs action before anything else. PHP shipped emergency fixes for two critical remote code execution bugs at 14:00 UTC, after the CVE numbers and a proof-of-concept video leaked a day early. Separately, eight intermediate certificates from India's eMudhra turned out to have private keys of one byte each. Node.js, Go and Mozilla all shipped fixes. A backdoored LiteLLM release on PyPI covers the supply-chain side. If you run anything PHP, anything that calls HTTPS from a non-browser client, or LiteLLM, start with "Do this today" at the bottom. The rest of the day was quieter: DuckDB 2.0, a TypeScript 7.1 beta, and a Shopify post about walking away from React Native.

The big story

PHP2Shell, two critical RCEs in PHP core

3 min read

What happened. On October 21 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619 (PHP Foundation, post). Both are rated CVSS 9.2. The 10.0 figure circulating before release was wrong, according to the Foundation. Wiz, which found one of the bugs and named the set "PHP2Shell", says nearly every PHP version back to 5.4 is affected (Wiz). A commenter on r/cybersecurity says branches 5 through 8.1 will not get patches; I did not find that in the sources I read, so treat it as unverified.

Mechanism. Both bugs are memory-safety flaws that trigger when a request dies with a fatal error, typically out-of-memory, and leaves internal state half-initialized or pointing at freed memory. A later request on the same worker then uses that state. Wiz lists four concrete bugs: a use-after-free in the upload-progress unserializer, a stale session-ID pointer that leaks process memory into a PHPSESSID cookie, a use-after-free through a stale fatal-error backtrace, and an OPcache type confusion after an allocation failure. The PHP Foundation says unauthenticated RCE worked against Apache with mod_php on default settings, and also against PHP-FPM through application code paths. Wiz says a Hello World app is enough, and that it demonstrated RCE on current WordPress, Drupal and Joomla container images.

Timeline (UTC). Wiz found its first bug Aug 19 and reported on Aug 24. Calif reported unconditional RCE on Aug 11 and OpenAI reported the same root cause the same day. On Oct 20 around 15:00 the CVE IDs leaked with a wrong severity and release time. The pre-announcement went out at 19:30 and moved the release up a day. Around 20:00 Calif mistakenly published a PoC video. Chainguard published fixed images at 07:41 on Oct 21, before the embargo lifted. Cloudflare had WAF rules live from 03:02 UTC, about nine hours before disclosure (Cloudflare).

What is still unknown. The PHP security team said it had found no functional exploits in circulating PoCs at release time. Wiz reports no confirmed in-the-wild exploitation. Cloudflare says attackers were already mutating payloads against its rules. Whether embedded devices (router UIs, appliances) are exposed is unanswered; one commenter asked specifically about Palo Alto management interfaces, and nobody with authority replied in the thread I read.

Assessment. The technical details matter less than the process signal. The Foundation credits AI-assisted audits (Claude Mythos scanning PHP early in 2026, OpenAI's tooling, Calif's work under a "Patch the Planet" program) and says report volume has risen. Wiz says the exploit chaining was done with frontier models. Expect more bugs of this age and depth to surface, and expect embargoes to leak more often as more parties hold the same findings. Patch windows are getting shorter than deployment cycles. A WAF buys hours, and Wiz itself says updating PHP is the only complete fix.

Discussion: HN PHP 8.2.35 (511 points, 216 comments); pre-announcement thread (1,436 points, 607 comments); Wiz on HN (299 points, 83 comments); r/selfhosted (620 points, 171 comments).

Security

eMudhra's CA keys were one byte long

1 min read

Scott Helme found that the private keys behind eight eMudhra intermediate CA certificates are tiny numbers (4, 56, 66, 115 and so on) on the P-384 curve. Recovering one means multiplying the generator by 1, 2, 3 and so on until the public key matches, at most 255 steps. He did all eight in under a second (Helme). The certificates were created in April 2025 and cross-signed by Sectigo in May 2025, so the exposure window was roughly 17 months. eMudhra blames a ceremony-script bug plus a human mix-up in the signing request, which is the company's account and not independently checked. Mozilla blocked the intermediates through OneCRL less than three hours after the Oct 17 report and shipped Firefox 158.0.1 and NSS 3.131.1 to remove the root (Mozilla).

Browsers are mostly fine: they block these intermediates and Chrome saw no certificates chaining to them in Certificate Transparency logs. The risk sits in everything else. curl, Python, Node, Go and Java read a CA bundle from disk and typically skip revocation and CT. Helme forged api.stripe.com and Linux and macOS clients accepted it. Verdict: update ca-certificates, certifi, Node and base images this week; frozen-firmware devices stay exposed until the certificates expire in 2039. Discussion: HN (557 points, 246 comments), r/cybersecurity (2,662 points, 311 comments, mostly gallows humor and "this is why the CA model is broken").

LiteLLM 1.107.0 on PyPI is a credential stealer

1 min read

SafeDep reports that litellm 1.107.0 was on PyPI for about two hours (uploaded 11:39 UTC, gone by 13:40) (SafeDep). It installs a .pth file that runs at every Python start, even if litellm is never imported. The payload harvests SSH keys, cloud credentials, CI secrets, AI tool tokens and the LiteLLM proxy's stored provider keys, and posts them to a lookalike domain. A second component polls hourly for follow-up code. The attacker's GitHub account has been deleted, so the loader currently finds nothing, but hosts that ran it earlier may already hold second-stage code. SafeDep believes BerriAI's private release pipeline built the wheels from modified source; only BerriAI's logs can confirm that. Clean versions per SafeDep: 1.106.2 and the 1.107.0 rc1/rc2. If you ever installed 1.107.0, rotate everything on that host. HN: 65 points, 24 comments.

Node.js ships ten CVEs, one a Brotli RCE

1 min read

Releases 22.23.4, 24.22.1 and 26.12.1 fix four High issues: an out-of-bounds write in the Brotli decoder that permits remote code execution, two TLS hostname-check bypasses involving IP-address parsing, and dns.resolve truncating names at a NUL byte (Node.js). The release also drops the eMudhra intermediate. EOL lines are affected and not patched. Upgrade; if you serve user-controlled compressed data, do it first.

curl will make low-severity reports public

1 min read

From Oct 26, curl asks reporters to file LOW and MEDIUM issues on public GitHub; only HIGH and CRITICAL stay private on HackerOne. Daniel Stenberg says over 90% of submissions are quickly judged below HIGH, and a flood of AI-generated reports is straining the maintainers (blog). The trade-off he names is a slightly longer exploit window for minor bugs. Other maintainers will copy this.

AI / LLM

Anthropic's attack-surface reduction study

1 min read

Anthropic used Claude to inventory 17,000+ configuration options across 25 open-source projects (5M+ lines) and flagged 493 issues, such as pre-authentication code reachable in default builds (Anthropic). In OpenSSH, about 4,500 lines of experimental ML-DSA-44 code were reachable before authentication; the fix, shipped in 10.6, removed roughly a fifth of the pre-auth code. Anthropic labels this preview data, and most findings were not directly exploitable. The idea fits today's PHP story well: shrink what an unauthenticated request can reach before the next unknown bug lands. Vendor research, so read the 493 as "candidate issues". HN: 108 points, 72 comments.

Qwen3-Coder and the "US persona" result

1 min read

Hirundo reports that Qwen3-Coder-30B-A3B produced more hackable apps when the system prompt named a US defense contractor than a Chinese one: 70% versus 59% (p=0.03), on 190 apps per prompt (Hirundo). A copy with the model's political alignment removed showed no such gap. Hirundo sells that remediation, the test is one model on one task, and the authors say they cannot establish intent. Interesting, unreplicated, commercially motivated. HN: 204 points, 104 comments.

DeepSeek open-sources DeepInfer

1 min read

DeepSeek released an inference framework built mostly on vLLM, Apache 2.0, with FlashMLA, DeepGEMM, expert parallelism and speculative decoding (repo). It supports NVIDIA SM100 and Huawei Ascend 950. Only DeepSeek-V4.1-Flash is listed, it documents offline inference only, and the README says a full service also needs a KV cache layer, prefill/decode disaggregation and load balancing that are not in this release. Throughput numbers exist only in chart images, so I could not verify them. A Reddit post claims 600K tokens/s on 8×B300; that is a single unverified post. HN: 2,281 points, 874 comments.

Hardware pressure

1 min read

r/LocalLLaMA (496 points, 193 comments) is passing around a report that Samsung has sold out all 2027 HBM capacity, with HBM prices up 200% and double-digit DRAM increases. I did not open the primary report. Commenters split: one camp says local inference no longer pays back against cheap cloud MoE serving, the other says privacy and ownership are the whole point. A separate thread (673 points) cites a report that ByteDance, Alibaba and Tencent ordered over $35B of Nvidia chips; also unread at the source.

Programming

DuckDB 2.0 LTS

1 min read

DuckDB 2.0 "Cinnamon Teal" is out, supported until at least October 2027 (announcement). It adds async I/O for Parquet and CSV on object storage, a first-class VARIANT type, triggers, a PEG parser, and an agent mode that cut the output a model must read by 59% in their TPC-H test. Breaking: x -> x + 1 lambdas are off by default (use lambda x: x + 1), and files written by 2.0 cannot be read by older versions. The team suggests mission-critical users wait for the November patch release. Test on a copy before moving any shared database file. HN: 143 points, 13 comments.

TypeScript 7.1 beta

1 min read

Mostly speed and memory on the native compiler. Microsoft's table for --noEmit shows mui-docs from 22.2s to 11.9s and 8.1 GB to 4.1 GB; vscode only improves 1.2x (post). New: import attributes in ambient modules, import source, ES2026 target. One breaking change to check: narrowed type parameters inside distributive conditionals no longer satisfy the original constraint, so some generics will error. Benchmarks are Microsoft's. A webdev poster compared four Rust-based checkers against tsc 7.0 on two codebases (64 points, 12 comments); I did not open it.

The Future of CSS

1 min read

Josh Comeau's walk through Interop 2027 is the most-upvoted pure web-platform piece today (HN 522 points, 221 comments). I only read the headline and thread titles, so I cannot summarize it (link).

Shopify and e-commerce

Shop app leaves React Native

1 min read

Shopify published numbers for moving the Shop app from React Native to Swift and Kotlin (Shopify Engineering). The stated reason is that coding agents changed the economics of two codebases, not that React Native was slow. Reported results: Android cold start 4,433 ms to 2,233 ms, Android release size 293 MB to 184 MB, crash-free sessions 99.5% to 99.95%, and 12 weeks from proof of concept to store release with six core engineers. iOS size grew 1 MB and iOS build times did not improve. All figures are company-reported with little methodology. Shopify says agents worked best with an existing implementation to port from, which matters: this is a port, not greenfield. If you maintain a cross-platform app with a mature reference, the "rewrite with agents" estimate just got cheaper to test. daily.dev surfaced the story again today.

Merchants

1 min read

r/shopify's top post (84 points, 62 comments) is a merchant reporting chargeback money recovered on disputes lost years ago; I only saw the title. r/ShopifyDevs returned no posts. I found no Shopify platform or API news today, and this section is thin for that reason.

SaaS and indie business

Anthropic IPO numbers, with a warning

1 min read

r/ClaudeAI (1,045 points, 378 comments) discusses a WSJ report of draft IPO papers: $16.3B revenue in six months, an $80.7B paper loss, about $450B in compute commitments. The thread's top correction is that roughly $72B of the loss is a non-cash charge tied to convertible notes. I could not open the WSJ piece. My search returned different figures (about $4.6B revenue and a $42B loss for 2025, citing Reuters), so the numbers conflict and I would not quote either. The part that holds across both: most of the loss is accounting for financing instruments, and the large commitments are multi-year.

Founders' threads

1 min read

r/SaaS had nothing above 38 points; the top question was why beginners fail (53 comments). The only item with a signal for builders is a post asking whether anyone is testing ChatGPT Ads for acquisition (6 points, 4 comments). Skip.

Quick hits

  • Go patches CVE-2026-111943 to distrust the eMudhra intermediates (daily.dev "Happening Now"; no primary page opened).
  • Meta Muse reportedly exposes private data when users share conversations (Ars Technica, HN 299 points; page blocked here, headline only).
  • Krebs: feds suspect a ransom negotiator ran the ShinyHunters extortion site (KrebsOnSecurity, HN 248 points; headline only).
  • Palo Alto firewall OS reportedly under attack by multiple ransomware groups since June (r/cybersecurity, 133 points; title only).
  • Google open-sourced TorchTPU, a native PyTorch backend for TPUs (repo, HN 371 points).
  • Mistral released Voxtral 3 (Mistral, HN 747 points; not opened).
  • OpenAI published "Patch the Planet" on coordinated disclosure as agents find vulnerabilities (OpenAI, HN 98 points; page returned 403).
  • Plex media server flaws are reportedly being exploited to install malware (Ars Technica, headline only).
  • Mastodon 5.0 and OpenBSD 8.0 shipped (Lobsters, 39 and 97 points).
  • PingCAP disclosed unauthorized access to cloud resources (notice, Lobsters; not opened).

Worth a long read

  • Eight Bits of Trust. A clear walk-through of how a CA key can be recovered by counting, and a practical audit of which of your clients ignore revocation and CT. Read it before your next CA-bundle discussion.
  • Using Claude to reduce the attack surface of code. Worth reading for the method (reachability before authentication) regardless of what you think of the vendor.

By the numbers

  • 1 bytesize of each compromised eMudhra private key, at most 255 guesses (Helme).
  • < 3 hoursfrom Mozilla receiving the eMudhra report to OneCRL distribution (Mozilla).
  • ~2 hourstime litellm 1.107.0 was on PyPI (SafeDep).
  • 12 weeksShopify's reported time from proof of concept to a native Shop app in stores (Shopify).
  • 59%reduction in output an LLM must read with DuckDB's agent mode, on their TPC-H test (DuckDB).

Do this today

Sources and coverage
  • Reddit MCP (get_top_posts, day, limit 15): 12 of 14 subreddits returned posts. r/ExperiencedDevs and r/ShopifyDevs returned "No posts found". Several subreddits returned fewer than 15 posts. Comment threads read for five posts: r/cybersecurity eMudhra, r/selfhosted PHP, r/LocalLLaMA HBM, r/ClaudeAI IPO, r/cybersecurity "PHP stuff".
  • Hacker News: top 40 from Firebase; Algolia queries for shopify, llm, vulnerability (all three succeeded). The shopify query returned nothing relevant.
  • Lobsters: hottest.json, 25 stories.
  • daily.dev: For You feed and "Happening Now" read in ego-browser. I did not open the ai, webdev and security tag pages.
  • X (ego-browser, read-only): home timeline read; a search page for Shopify and one for CVE/zero-day were opened but only the home timeline output was captured, so Shopify, LLM, AI agents and SaaS searches were not read. This is a coverage gap.
  • Primary sources read: PHP Foundation, Wiz, Helme, Mozilla, SafeDep, Node.js, DuckDB, Hirundo, Anthropic research, DeepInfer README, TypeScript blog, Shopify Engineering, Cloudflare, curl blog.
  • Failed: openai.com returned HTTP 403; WebFetch refused arstechnica.com ("unable to fetch"). php.net was not fetched; PHP version numbers come from the PHP Foundation post.
  • Discussion-thread or headline only: Anthropic IPO figures, HBM and Nvidia order reports, Go CVE, Meta Muse, Krebs/ShinyHunters, Palo Alto, Voxtral 3, TorchTPU, Comeau CSS, Plex, PingCAP, the Rust TypeScript checkers post, and the Shopify chargeback post.