PHP patches two RCE bugs
PHP patches two RCE bugs, eMudhra’s CA key was the number 4, and LiteLLM shipped a stealer
On Wednesday's HN front page, PHP shipped fixes for two bugs that let a single unauthenticated request run code on your server. Every PHP install that serves web requests is exposed: PHP-FPM, Apache with mod_php, FrankenPHP and LiteSpeed. Apache with mod_php is the worst case.
Update PHP now
Update PHP to one of these four releases
On Apache with mod_php, the attack runs before any application code.
Both bugs sit in code almost every request touches. In one, a request that hits the memory limit at the wrong moment leaves half-built data behind, and PHP later treats it as valid. In the other, a fatal error leaves state pointing at memory from an earlier request, and the next request on that worker uses it. Linux distributions got the patch early, so check your vendor's packages first. PHP 8.1 and older are out of support, so they need a backport or an upgrade.
Until you can patch
Until you patch, settings only narrow the way in
A three-line nginx rule blocking multipart uploads
If you can't patch a server yet, three settings block specific paths: an unlimited memory limit, a small maximum post size, and upload progress tracking switched off. Each one needs every worker restarted, and each leaves other paths open. In the thread, dofm blocked multipart uploads with a three-line nginx rule on a server they couldn't take offline, and it held off automated attacks until the patch shipped. Limits at the web server reduce exposure. Only the update removes it.
Two years to a fix
The memory bug surfaced in 2024 and shipped a day early
The memory bug first showed up in 2024, during PHP's first outside audit in years. The security team decided by consensus, couldn't agree on a fix, and the work stalled for months. On the same day in August, the security firm Calif and OpenAI each reported its root cause, and Calif had it running code remotely. On Tuesday the CVE numbers leaked, and the release moved up a day. Chainguard published patched images more than six hours before that, which handed attackers the fix to study early.
eMudhra's one-byte CA keys
eMudhra’s CA private key was the number 4
The certificate authority eMudhra created eight intermediate certificates in April 2025, and every private key was a single byte. A key on this curve should be a random 384-bit number. One of these was 4, and all eight fall in under a second on a laptop. Chrome and Firefox now block them. Curl, Python, Node and Go trust the CA bundle on disk and skip revocation checks, so update your CA certificates package, certifi and Node, and rebuild your container images. Routers and printers with frozen firmware will trust these keys until 2039.
Muse share links
Meta’s Muse put each shared chat’s title in a public hostname
6,800 share links found with one passive DNS query. Sharing is paused.
Meta's Muse agent made a web link for every conversation a user shared, and put the conversation's title in the subdomain. Opening the link triggers a DNS lookup, and passive DNS services keep those names where anyone can search them. One query turned up about 6,800 shared links, among them loan applications and a company's revenue review. Meta has paused sharing. In the thread, omoikane drew the lesson for anyone building share links: keep anything meant to stay unguessable out of the subdomain.
LiteLLM 1.107.0
LiteLLM 1.107.0 ran a credential stealer in every Python process
import cook
The LiteLLM 1.107.0 wheels on PyPI installed three extra files. One is a path file, which Python runs at startup, so the stealer fires in every Python process on the machine, even ones that never import LiteLLM. It takes SSH keys, cloud credentials, CI secrets and the provider keys in a LiteLLM proxy database, and a background process fetches new code every hour. PyPI has pulled the release, and 1.106.2 is clean. If cook.pth is in your site packages, rotate every credential on that machine. Which LiteLLM version does your lockfile pin?
