PHP critical fixes after a leak, eMudhra CA keys, SafePay ransomware | Cyber Security News Oct 21

PHP ships fixes today for two critical flaws whose details leaked ahead of disclosure, and a certificate authority's signing keys turned out to be guessable, one of them the number four. Also: a joint advisory on SafePay ransomware, a hijacked account that swapped OVHcloud's CLI downloads for a stealer, and a test account with the password Password1. Fixes were checked against the vendor's advisory or release notes where one exists, and against the researchers' report where not. Today's question: How does your team find accounts that should have been deleted? Reply in the comments or at [email protected].

1. PHP fixes two leaked critical flaws today - CVE-2026-109618, CVE-2026-109619 - Do: Find every copy of PHP you run - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

2. eMudhra CA keys were trivially guessable - CVE-2026-111943 - Do: Update the CA bundles outside your browsers - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ

3. SafePay: 600 victims via passwords, old flaws - CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 (+ 2 more) - Do: Require MFA on every VPN login - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

4. OVHcloud CLI releases carried a secret stealer - Fixed: 0.16.0 - Do: Turn on release immutability for your GitHub repositories - https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/

5. Zeabur shuts down after second breach - Do: Rotate every secret you stored on Zeabur - https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/

6. OpenCode silently patched a code-execution flaw - Fixed: 1.18.33 - Do: Upgrade OpenCode on Windows developer machines - https://github.com/anomalyco/opencode/releases/tag/v1.18.33

7. Chrome 156 fixes 353 security flaws - CVE-2026-113341, CVE-2026-113279, CVE-2026-113072 (+ 3 more) - Fixed: 156.0.8078.47/.48 - Do: Push the Chrome update and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

8. Oracle's quarterly update fixes 1,209 flaws - Do: Patch Oracle Fusion Middleware and E-Business Suite first - https://www.oracle.com/security-alerts/cpuoct2026.html

9. A 2012 Password1 test account let ransomware in - Do: Disable accounts that haven't signed in for a year - https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139