Spooky Season with PHP, Node.js, and KVM

Hello and welcome to our October newsletter!

Halloween is coming up this weekend, and some of our colleagues will surely be roaming the streets in costume - but October was spooky enough even without it.
The reason: a number of nasty security vulnerabilities across multiple languages, applications, and operating systems, which kept us on our toes especially last week.

That’s why today’s newsletter is a bit different - a security special, so to speak! Maybe one or two of the reports passed you by, or we can give you some more background information to put the events into context. In this newsletter you’ll find short summaries of the various “highlights” of October, along with further links so you can form your own opinion.

And even though the topic is serious, the usual applies: enjoy reading!

---

PHP

---

PHP2Shell: Remote Code Execution in the PHP Runtime

PHP kicks things off with CVE-2026-109618 and CVE-2026-109619, which made headlines in the middle of last week: the two vulnerabilities affected all current and older PHP versions up to and including 5.4, regardless of the specific application - because the problems were in the PHP runtime itself. mod_php was hit hardest, as the exploits could be carried out before any application code was even executed.

Despite good coordination and advance notices from the PHP Foundation, the publication of the CVEs was hectic: days earlier, Cloudflare and AWS, among others, reported observed attempts to exploit the vulnerabilities, a company that was aware of the vulnerabilities violated the imposed embargo, and numerous website operators took their sites offline while waiting for the patches.

NWS was affected as well: two of our popular Managed Services - Managed Icinga and Managed Nextcloud - are PHP applications and had to be secured and patched; in addition, there were numerous customer setups maintained by our MyEngineers®. We did everything we could to apply the patches as quickly as possible, and in the meantime we did not observe any attempted attacks on NWS.

You can find more information about PHP2Shell at the following links:

• Blog post by the PHP Foundation:
  Today’s PHP Security Release, and How We’re Strengthening PHP Security
• Background by Phoenix Security:
  800 Systems affected PHP Core RCE (CVE-2026-109618, CVE-2026-109619): Two Critical Remote Code Execution Flaws Patched October 21

---

Node.js

---

Node2Shell: Remote Code Execution via the brotli Decoder

As if one web technology weren’t enough, CVEs in Node.js were also disclosed last week: the releases for Node.js 22/24/26, also published on October 21, contained patches for 10 CVEs, including a remote code execution via the brotli decoder bundled with Node.js, tracked as CVE-2026-111497.

Some say that users of Node.js, NPM, and the like are used to frequent patches - either way, in many cases the runtime on servers, in the cloud, or in container images had to be replaced or updated here, too. At least, unlike with the PHP vulnerabilities, no successful attacks were known even a day after publication.

In addition to the brotli vulnerability, the dependencies c-ares, ca-cert (due to compromised eMudhra certificates - more on that later), OpenSSL, SQLite, and undici were also updated because of publicly known vulnerabilities.

You can find more information and a list of the patched CVEs in the Node.js project’s announcement.

---

eMudhra CA

---

Chain of Trust: Compromise of eMudhra CA Keys

Another story from October was the compromise of eight intermediate Certificate Authority (CA) keys belonging to the Indian company eMudhra. They weren’t stolen, but they could be guessed: after a failed key ceremony in April 2025, the 8 keys contained values with very low entropy (4, 56, 66, 115, 155, 156, 230, and 237). All eight keys could be guessed in under a second.

Google, Mozilla, Apple, Microsoft, as well as numerous Linux distributions and programming languages declared the keys invalid within a short time, but some applications on common operating systems are still potentially vulnerable to man-in-the-middle (MITM) attacks, e.g. curl and git on my macOS 27.0.1.

You can find out whether applications installed on your system are vulnerable with the CLI tool emBarrass on GitHub, or read up on the background of this incident here, including a check of whether your browser still trusts the certificates: eMudhra Intermediate CA Compromise

---

KVM

---

PwnEscape: KVM Guest-to-Host Escape

Even before the PHP vulnerabilities, PwnEscape (CVE-2026-99999) kept us busy in October, a vulnerability in the Linux networking stack that allowed a full escape from guest to host systems. For us as a cloud provider, vulnerabilities like this, which potentially affect our customers’ VMs, are of course particularly sensitive. KVM setups on systems with an x86 CPU architecture were affected - the most common setup.

The vulnerability allowed VMs to modify IP packets after they had already been validated by the hypervisor; this made it possible for VMs to read and modify the memory of the KVM host in order to execute their own code. Many cloud providers therefore had to roll out the patches provided for the distributions they use, or cover the vulnerability in a different way temporarily.

Since activating the patch would have required a reboot of the affected hypervisors, we deployed an eBPF program on our hypervisors as an immediate measure after the CVE became known, which mitigated exploitation of the vulnerability until we were able to properly patch the hypervisors shortly afterwards. For this exploit as well, we did not observe any attempted attacks at NWS.

You can find more information on the vulnerability and how it came about or could be exploited here:
Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

---

GitLab

---

GitLab: Unauthenticated Remote Code Execution

With CVE-2026-110264, another vulnerability with a “perfect” CVSS score of 10.0 came rolling in: Onigmo, the regex engine used by GitLab, was vulnerable in all GitLab versions of the past 12 years, and only patching affected GitLab instances could provide a remedy. So our MyEngineers® got to work once more and updated the Managed GitLab instances we operate as quickly as possible.

You can find an overview and discussion of the affected GitLab versions, including upgrade paths for your environment, here:
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

---

What remains?

---

This particularly spooky October is coming to an end, and of course we ask ourselves: what’s next?

For almost all of the vulnerabilities listed in this newsletter, AI played a major role in their discovery and validation; for affected users, the consequence is a significantly shorter reaction time after vulnerabilities are published, and a generally higher volume of events that require an immediate response.

At NWS, we did not observe any attempts to exploit any of these vulnerabilities last month, and we were able to react promptly each time, coordinating and applying patches. Nevertheless, we will of course continue to invest in securing and proactively monitoring the NETWAYS Cloud and our Managed Services, because we’re almost certain: right now we’re just enjoying the calm before the next storm.

To keep learning about security and monitoring for our environment, we’re also traveling to several trade shows and conferences: by the time you see this newsletter, we’ll be talking with CISOs, security engineers, and other service providers at IT-SA in Nuremberg about current topics around security, compliance, and sovereignty. And in mid-November we’ll be at OSMC as a sponsor, where we’ll be looking at new approaches to monitoring the NETWAYS Cloud.

For OSMC, you can still get your ticket with 15% off using our sponsor code NWS15@OSMC_2026 on the OSMC website.

---

CLI Quick Win

---

Vulnerability and Secret Scanning with Trivy

For many of October’s vulnerabilities, the first question was “Are we affected?” - and the answer can sometimes be hard to find: in containers, on Kubernetes, and in user applications, there are often dependencies hiding that you don’t immediately have on your radar.

With Trivy you can scan container images, file systems, Git repositories, VM images, and Kubernetes environments for known vulnerabilities, misconfigurations, and secrets, and have reports and SBOMs generated.

You can find more information about Trivy on GitHub.

---

---