Black October 2026: PHP2Shell, eMudhra & the 15-Minute Website Check

Between October 19 and October 22, 2026, PHP shipped an emergency fix for two critical remote code execution bugs, Node.js patched a remote code execution in its Brotli decoder, GitLab patched a CVSS 10.0, and Google, Mozilla and Apple moved to block certificates from an Indian certificate authority whose signing keys turned out to be guessable. One of those keys was the number 4. The security community started calling it Black October. 4chan, several Wikimedia services and Archive.org went offline to patch. If you run a website, at least one part of this week probably touches you. This post explains what happened and which part is a certificate problem, then gives you a 15-minute check you can run on your own domains today.

Black October in 90 seconds

Black October isn't one bug. It's a cluster of disclosures that landed in the same four days:

• PHP2Shell (CVE-2026-109618, CVE-2026-109619). Two use-after-free bugs in PHP core, both rated 9.2 under CVSS v4.0. An unauthenticated attacker can execute code through any PHP install that serves web requests, whether it runs on PHP-FPM, mod_php, php-cgi, FrankenPHP or LiteSpeed. That covers WordPress, Drupal, Joomla, Magento and most shared hosting. The details leaked on October 20 and patches shipped on October 21 at 14:00 UTC.
• Node.js October security release. Ten fixes across every supported line, four of them rated high. The worst is an out-of-bounds write in the Brotli decoder (CVE-2026-111497) that allows remote code execution. The same release also refreshes Node's bundled CA store and OpenSSL.
• eMudhra CA key compromise. Eight intermediate certificates (six for TLS, two for code signing) had private keys small enough to brute-force in 256 guesses. Browsers blocked them within hours. Chrome is now removing the root, and eMudhra is leaving the global SSL/TLS business.
• Also in the same window. GitLab fixed an unauthenticated RCE rated CVSS 10.0 (CVE-2026-110264). A stolen maintainer token was used to push a malicious LiteLLM release (1.107.0) to PyPI and Docker. CISA, the FBI and partner agencies published an advisory on the SafePay ransomware group, which has hit more than 600 victims.

Artificial intelligence connects most of these stories. Researchers from Wiz, Calif and OpenAI used AI tools to find PHP2Shell. OpenAI's Codex Security team reported the Node.js Brotli bug. Mozilla's Dennis Jackson wrote that local AI agents recovered an eMudhra private key on their first attempt from a one-line prompt.

A disclosure wave, not an attack wave

The label suggests the internet was attacked all at once. The timeline says otherwise. Most of these bugs had been there for a long time:

• The PHP2Shell code paths go back more than a decade. Wiz found the bugs on August 19 and reported them on August 24.
• eMudhra's weak keys were generated on April 30, 2025. In June 2025, CRL signatures that didn't match were already being flagged in public.
• SafePay has been active since August 2024.

The time between disclosure and exploitation is what got shorter. Cloudflare's Matthew Prince said attempts went from thousands in the 10 hours before PHP2Shell was announced to tens of thousands within 45 minutes after it. CERT-EU told organizations that can't patch PHP to think about taking those sites offline.

That is the real lesson of Black October. When AI tools can find a bug in an afternoon and turn it into an exploit by evening, an annual pentest and a spreadsheet of certificates are too slow. You need to know your exposure on the day the news breaks.

The certificate story: eMudhra

A certificate authority's intermediate key works like a master key. Whoever holds it can sign a certificate for any domain, and every browser that trusts the chain will accept that certificate. Here is what happened to eMudhra's keys:

1. Key ceremony, April 30, 2025. One step in the script that wraps and unwraps keys produced a second, weak set of P-384 keys next to the strong ones. Both sets had the same labels, and the weak set was published. Each weak private key was effectively all zeroes except the last byte, so it was smaller than 256.
2. October 17, 2026, 18:05 UTC. A researcher scanning public certificate data reported the problem to the Chrome Root Program. Chrome shipped a CRLSet block at 19:45 UTC. Mozilla pushed a OneCRL block that same evening.
3. October 18. eMudhra revoked all eight intermediates. Researcher Flüpke published one of the recovered keys: the private key for EM OV TLS CA - G3C is 4.
4. October 20. Firefox removed the emSign ECC Root CA - G3 root. Chrome announced it would remove the root on October 27. eMudhra announced it is exiting the global SSL/TLS business.

The eight compromised intermediates:

• TLS (chain to emSign ECC Root CA - G3): EM DV TLS CA - G3B, EM DV TLS CA - G3C, EM OV TLS CA - G3B, EM OV TLS CA - G3C, EM EV TLS CA - G3B, EM EV TLS CA - G3C
• Code signing: EM OV CS CA - G3B, EM OV CS CA - G3C

All eight also exist as cross-signed certificates under Sectigo's AAA Certificate Services root. eMudhra says none of the eight was ever used to issue certificates to websites or users, and that its systems were not breached. That's reassuring, but it doesn't help sites that need to migrate. About 30,800 unexpired certificates chained to the ECC root as of October 21. 99.9% of them were issued through InCommon, the certificate service used by many US universities and research institutions.

Is your site on an eMudhra chain?

The check takes about 30 seconds per hostname. You are looking for two things: the issuer of the leaf certificate, and every intermediate the server sends in its chain.

1. Open the DomainScan SSL Certificate Checker and enter the hostname.
2. On the Certificate tab, read Issuer → CN and O. If the CN starts with EM DV TLS CA, EM OV TLS CA or EM EV TLS CA, you are affected.
3. On the Chain tab, look at each certificate in the path and its issuer. Look for emSign ECC Root CA - G3, or for one of the intermediates above under Sectigo's cross-sign. The Chain tab also shows a missing intermediate, a broken issuer-to-subject link, or an expired chain certificate, which are common mistakes during a rushed replacement.
4. Repeat for every hostname that serves TLS, including www, api, mail, the admin portal and the old marketing microsite. Certificates are issued per host, so the apex being fine says nothing about the subdomains.

If you prefer the terminal, this prints the same issuer line:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates

# Show the full chain the server actually sends
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null \
  | grep -E "s:|i:"

If you are affected: get a new certificate from a CA in a different hierarchy and install it before October 27. About 97% of the affected certificates were issued over ACME, but most ACME clients won't renew outside their normal renewal window unless you force it or the client supports ACME Renewal Information (ARI). Run the renewal by hand. Don't wait for the next cron job. The same automation gap is why the move to 47-day certificates matters: the teams that switched CAs in an afternoon this week already had renewals automated end to end.

New: we now test the CA's key, not just its name

Most SSL checkers, ours included until this week, rate a key by its size. A P-384 key was marked "very strong" whatever its actual value. By that measure, eMudhra's intermediates looked perfect: P-384 keys, valid signatures, trusted chain. A grade of A, with a private key of 4.

So we added the test that actually caught eMudhra. The SSL Certificate Checker now runs three new checks on every certificate in the chain: the site's own certificate, each intermediate and the root.

• Guessable key test. An EC private key is just a number, and the public key is that number multiplied by a fixed point on the curve. We precompute the public keys for the numbers 1 to 256 on P-256, P-384 and P-521 and compare every key in your chain against that table. A match means the private key is known to anyone. That key is marked Compromised and the certificate gets an F.
• Distrusted CA detection. If your chain, or your certificate's issuer, is one of the eight eMudhra intermediates or the emSign ECC Root CA - G3, the Chain tab tells you so, explains why, and tells you to replace the certificate.
• Undersized CA keys. The RSA size rule (under 2048 bits is weak) used to check only the site's own key. It now applies to every intermediate and root as well.

The results show up in a new CA keys & trust status row on the Security Features tab and in the Chain issues panel. On the DomainScan platform, the same checks run with every 6-hour certificate check and raise a critical CA_DISTRUSTED_OR_WEAK_KEY alert by email, Slack, Teams, Discord, PagerDuty or webhook.

Browsers are fixed. Your code isn’t.

Chrome, Firefox and Edge users were protected within hours, because browsers update their revocation lists over the air. Much of the remaining risk sits outside the browser, in software that ships its own list of trusted CAs and may not check revocation at all:

• Go: rebuild binaries with Go 1.27.3 or 1.26.10, which block the affected chains in crypto/x509.
• Python: upgrade certifi to 2026.10.19 or later.
• Rust: upgrade webpki-roots to 1.0.10.
• PHP: Composer ca-bundle 1.6.0 or 1.4.16.
• Node.js: 22.23.4, 24.22.1 or 26.12.1. This same release fixes the Brotli RCE, so it covers both problems.
• NSS: 3.131.1. Also update OS trust stores through your distro (for example Debian DSA-6572-1), and review Java keystores, mTLS trust bundles, load balancers and appliances that you manage by hand.

One more point. The attack this incident made possible was a forged certificate for your domain, signed with a stolen intermediate key. CAA records don't stop that, because CAA is only checked by an honest CA at issuance time. Certificate Transparency does help: Chrome requires Signed Certificate Timestamps (SCTs) from public logs, so a forged certificate either shows up in a log or gets rejected by Chrome. The DomainScan Certificate tab shows how many SCTs your certificate carries, and the Overview tab links to its crt.sh log entries. Search crt.sh for your domain this week and look for any issuer you don't recognise.

PHP2Shell and Node.js: the patch list

These are server-side fixes. Plugin, theme or CMS updates do not apply them.

• PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Branches 7.4, 8.0 and 8.1 received source patches only, with no official builds. CybelAngel counted about 2.24 million internet-facing PHP hosts. Of the hosts that report a version, 59% run a branch with no official fixed release.
• Node.js: 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and older get no fix.
• GitLab: apply the October 21 patch release (CVE-2026-110264, CVSS 10.0).
• LiteLLM: if 1.107.0 was ever installed, treat the machine as compromised. Uninstalling the package does not remove the dropper, so rotate every credential that machine could reach.

After you patch, confirm that the PHP process serving requests is the new version. A common failure is upgrading the CLI binary while PHP-FPM keeps running the old one until it is restarted.

What an outside scan can (and can’t) see

No external scanner, including ours, can prove from the internet that your PHP binary is patched. Anyone who sells you that kind of certainty is overselling. An outside scan does answer three useful questions within minutes:

1. Which hosts do you actually have? PHP2Shell affects every PHP host, including the staging box someone forgot about in 2021. Subdomain discovery gives you the list to patch from.
2. Are you telling attackers what you run? Headers like X-Powered-By: PHP/8.1.27 or Server: Apache/2.4.41 (Ubuntu) make every mass scan easier. The Security Headers checker flags Server and X-Powered-By version leaks. Hiding them doesn't fix anything, but it moves you out of the easiest target lists, and a leaked version tells you where an old branch is still running.
3. Is your TLS layer something you'd defend in a post-mortem? Check the issuer, the chain, whether TLS 1.0/1.1 are still on, whether TLS 1.3 and forward secrecy are available, HSTS, CAA and CT. The SSL checker grades all of these and explains what's pulling the grade down.

The 15-minute check

Run this for your primary domain now, then for every other domain you own:

1. Inventory (3 min). Run Subdomain Finder on the apex. Mark every host that serves a web app, especially anything running PHP or Node.
2. Issuer and chain (4 min). Run SSL Certificate Checker on each TLS host. The CA keys & trust status row should be a pass. It fails on any eMudhra intermediate, the emSign ECC Root CA - G3 root, or a guessable or undersized key anywhere in the chain. Fix anything that is missing an intermediate or has a chain certificate expiring within 30 days.
3. Protocol hygiene (2 min). In the Protocols tab, TLS 1.0 and 1.1 should be off, TLS 1.3 on, and forward secrecy present. A grade of A or better is a reasonable target, and A+ requires preload-eligible HSTS, TLS 1.3 and CT.
4. CAA (1 min). Look up your CAA records. If you have none, any public CA may issue for your domain. Add records for the CAs you actually use. That won't stop a stolen-key forgery, but it closes the much more common mistaken-issuance route. If you're new to CAA, read the explainer.
5. Version leaks (2 min). Run Security Headers on each web host. Any X-Powered-By: PHP/… showing 7.4, 8.0 or 8.1 goes to the top of your upgrade list.
6. Patch and re-verify (3 min to start). Upgrade PHP, Node.js and trust bundles using the versions above, then re-run the SSL check and confirm the new certificate and chain are the ones being served.

After the week ends

Black October will end. The pattern won't. AI-assisted research is finding more bugs, and exploits follow within hours. Certificate lifetimes are getting shorter. CAs can lose browser trust within a week. The teams that handled this week well knew, before the news broke, which certificate was on which host, who issued it, and when that changed.

That is what continuous certificate monitoring does. On the DomainScan platform:

• Every monitored certificate is re-checked every 6 hours.
• An issuer change raises a high-severity alert. That fires when your migration off a distrusted CA lands, and also when a certificate from a CA you didn't expect appears on your host.
• A distrusted CA or a guessable key anywhere in the chain raises a critical alert, including on the very first check of a newly added domain.
• A broken chain or a missing certificate raises an alert straight away, which catches the failed-replacement problem described above.
• Expiry warnings go out at 30, 14, 7, 3 and 1 days.
• Alerts go to email, Slack, Microsoft Teams, Discord, PagerDuty or a webhook.

Related reading: why the HTTPS padlock doesn't mean a site is safe, how one expired certificate cost Ericsson £100M, and what an SSL certificate actually is.

FAQ

What is Black October?

"Black October" is the name the security community gave to a cluster of major disclosures between October 19 and October 22, 2026. It includes the PHP2Shell RCEs (CVE-2026-109618 and CVE-2026-109619), a Node.js Brotli RCE, a CVSS 10.0 GitLab flaw, the eMudhra CA key compromise and the LiteLLM supply-chain attack. Many of these bugs were found with AI-assisted tools.

How do I check if my SSL certificate was issued by eMudhra?

Run your hostname through an SSL checker and read the issuer. If the issuer CN is EM DV, OV or EV TLS CA - G3B or G3C, or the chain ends at emSign ECC Root CA - G3, you need a replacement certificate from another CA before October 27, 2026. The DomainScan SSL Certificate Checker shows the issuer and the full chain for free.

My certificate is from Let's Encrypt, DigiCert or Sectigo. Am I affected by eMudhra?

Not by the distrust, unless your chain includes one of the eMudhra intermediates cross-signed under Sectigo's AAA Certificate Services root. Check the Chain tab to be sure. You should still update the CA bundles in your own software (certifi, Go, Node.js, Composer, Java) so that your outbound connections reject the compromised intermediates.

Can DomainScan tell if a certificate authority's key is weak?

Yes, for the class of flaw behind eMudhra. The SSL checker compares every EC key in your certificate chain against the public keys of the private keys 1 to 256 on P-256, P-384 and P-521. It flags RSA CA keys under 2048 bits and recognises the distrusted eMudhra and emSign CAs. Any hit marks the key as Compromised and grades the certificate F. Platform users also get a critical alert.

Can an online scanner tell me if I'm vulnerable to PHP2Shell?

Not reliably. An outside scan can find your PHP hosts and catch version strings leaked in headers like X-Powered-By. Only checking the running PHP version on the server confirms the fix. Patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Would a CAA record have protected me from the eMudhra problem?

No. CAA tells honest CAs whether they may issue for your domain. An attacker holding a stolen intermediate key never asks. Certificate Transparency is the control that matters here, because Chrome rejects certificates without valid SCTs, so a forged certificate has to show up in public logs. CAA is still worth having to prevent mistaken issuance.

Is eMudhra's Digital Signature Certificate (DSC) or eSign affected?

According to MeitY, no. The compromise is limited to eMudhra's global TLS and code-signing intermediates. The DSC and eSign services regulated by India's CCA are not affected.

Sources

• The Hacker News. eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable. thehackernews.com (retrieved 2026-10-23).
• Rescana. eMudhra CA Key Compromise: Chrome and Firefox Have Blocked It, Non-Browser Clients Need Updates Now. rescana.com (retrieved 2026-10-23).
• The Register. Indian certification authority eMudhra's private keys compromised. One of them was the number 4. theregister.com (retrieved 2026-10-23).
• Business Today. "Impact has been very limited": MeitY on eMudhra security incident. businesstoday.in (retrieved 2026-10-23).
• Canadian Centre for Cyber Security. AL26-026: Critical vulnerabilities impacting PHP. cyber.gc.ca (retrieved 2026-10-23).
• CybelAngel. 2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming. cybelangel.com (retrieved 2026-10-23).
• Yahoo Tech. Black October Is a Disclosure Wave. The Label Hides the Clock. tech.yahoo.com (retrieved 2026-10-23).
• 404 Media. AI Is Changing Everything About Hacking. No One Knows What Happens Next. 404media.co (retrieved 2026-10-23).
• Konfirmity. Node.js October 2026 security releases. konfirmity.com (retrieved 2026-10-23).