Self-Hosted Weekly: Week 43, 2026. PHP2Shell, eMudhra Keys, GitLab Again

This week, most of the damage came from code your app depends on rather than the app itself. A pair of bugs in PHP's own core let attackers in without logging in, and the fixes shipped a day early after a leak. Eight certificate authority keys turned out to be guessable. GitLab shipped its second CVSS 10 fix in nine days, and attackers have been planting web shells through a Nextcloud add-on since September. Here's what mattered.

1. PHP2Shell: two critical PHP flaws, patched a day early

On October 21, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 and both reachable without authentication. The release was moved up a day after the flaws leaked on October 20, and according to The Hacker News, watchTowr was reporting "active exploitation attempts" within half an hour of the release. Amazon says its honeypots logged an attempt on October 17, four days before disclosure, per Help Net Security.

Our take: The only real mitigation is updating PHP. Disabling session upload progress only partly covers one of the two bugs, and does nothing for the other. Pick 8.3 or newer, since 8.2 reaches end of life on December 31. If you run PHP on Elestio, our advisory covers which images are rebuilt and how to apply the update.

2. Eight eMudhra CA keys could be guessed

A researcher reported on October 17 that eight eMudhra intermediate certificates (six for TLS, two for code signing) had P-384 private keys that an attacker could recover by testing just 256 candidate values. Mozilla and Chrome blocked them the same day, eMudhra revoked them on October 18, and Apple followed on October 22. eMudhra says most of them were never used in production and that it has found no evidence they issued certificates to end users. The full timeline is in the Mozilla bug thread.

Our take: Up-to-date browsers are covered. Your containers might not be. Tools that don't check revocation keep trusting these intermediates until their own certificate bundle is updated, and most container images ship their own bundle. Docker Desktop 4.96.3 (October 22) says the certificates could have been used to "intercept TLS connections" from the Docker CLI and daemon. Immich 3.3.5 and Authentik 2026.8.5 both shipped certificate updates for it. Update ca-certificates on your hosts, and pull new images rather than restarting old ones.

3. GitLab ships a second CVSS 10 fix in nine days

GitLab's October 21 patch fixes CVE-2026-110264 (CVSS 10.0), another integer overflow in the regular expression compiler that "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server." The flaw affects every version back to GitLab 7.0, and this time the fixes go further back than the October 12 release did. Fixed releases: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. One of the two high-severity fixes lets a user take over an LDAP-backed account when SAML and LDAP auto-linking are both enabled.

Our take: Patching last week doesn't cover you this week. Update GitLab again, and if you were stuck on an older line that the October 12 release didn't cover, now you have a fix. The patch includes database migrations, so single-node instances will see downtime.

4. Nextcloud's built-in Collabora server has been exploited since September

Collabora's advisory for CVE-2026-110447 (CVSS 9.2) was only published on October 14, but attacks started showing up in logs around September 10. It's an unauthenticated command injection in the Built-in CODE Server app (richdocumentscode), and it only works while the built-in server is down, for example during a restart, an upgrade or a crash. The fix is version 26.4.303, and Collabora is explicit: "It is not sufficient to disable the app."

Our take: If your Nextcloud uses the built-in CODE app, update it or remove it, then look for stray shx*.php files, which Collabora told admins to clean up. Standalone Collabora servers aren't affected.

5. Traefik ForwardAuth could hand one user's identity to another

GHSA-hrpp-p4fc-wwf8 (High, CVSS 7.0) is fixed in Traefik 3.7.16 and 2.11.60 (October 20). ForwardAuth sends every client's auth subrequests through a shared connection pool. With NTLM or Negotiate, which authenticate the connection rather than the request, one user's authenticated connection can be reused for someone else's request.

Our take: This is only urgent if ForwardAuth points at a Windows-auth backend. Everyone else should still upgrade, because 3.7.15 (October 15) fixed three more advisories.

6. OpenCode's hosted Console leaks AI provider keys

OpenCode disclosed on October 17 that attackers reached a legacy system behind its hosted Console and exposed linked AI provider keys for 1.4% of Console users, TechCrunch reports. Anthropic and Google blocked the exposed keys, and OpenAI is refunding charges. The open-source app and CLI weren't affected: "those keys never come to us," co-founder Dax Raad wrote.

Our take: The open-source tool was fine. The hosted dashboard sitting next to it was the target. Keep provider keys on infrastructure you control, put a spending limit on each one, and give each tool its own key so that revoking one doesn't break everything else.

7. Bitwarden's store apps go commercial

Bitwarden announced on October 9 that "starting in the next release," the apps in the app stores, and the direct downloads on its website, will be commercially licensed builds. The GPLv3 code stays on GitHub, but "some future components will be published under the commercial license and will exist only in that build." Staff say there's "no change to self-hosting," and that third-party community servers aren't affected either.

Our take: Nothing breaks today. If you run Vaultwarden, you still use the official Bitwarden clients. What's worth watching is which future client features end up commercial-only.

8. Forgejo 17 arrives, and 16 dies next week

Forgejo v17.0 (October 15) adds # and ! autocompletion, an overhauled Git LFS area and more Actions controls. One breaking change: absolute links inside repositories "are now resolved with respect to the root of the repository." v17 is supported until January 28, 2027. v16 reaches end of life on October 29.

Our take: If you're on 16, upgrade within a week, and check any READMEs that use absolute links. For new instances where you'd rather upgrade less often, v15 LTS is supported until July 2027.

What we're watching next week

Certificate bundle updates. As of October 20, Debian and Node.js hadn't yet shipped their eMudhra fixes, per BleepingComputer. Watch for them.

Kubernetes 1.34 end of life on October 27. After that, 1.34 gets no more patches.

Ubuntu's kernel fix. As of October 23, Ubuntu's tracker still lists CVE-2026-80521 as vulnerable on 24.04 and 26.04, with a fix in progress.

The bottom line

Updating your apps wasn't enough this week. PHP, the certificate bundles inside your images and GitLab's regular expression engine all needed fixing too. Patch PHP and GitLab today, pull fresh images to pick up the certificate fix, and check Nextcloud for the built-in CODE app before the weekend.

Thanks for reading ❤️ See you next Friday 👋