PHP2Shell, GitLab RCE, eMudhra CA failures in one week: why patching can't keep up
WeldPond · x · 2026-10-24
Veracode co-founder Chris Wysopal recounts a week of failures across three stack layers: PHP2Shell (core PHP RCEs affecting every release of the past decade, powering 70% of websites), a CVSS 10.0 unauthenticated GitLab RCE (30M+ users, half the Fortune 100), and eMudhra's eight intermediate CA keys weak enough to be reverse-engineered.
- 2026 Verizon DBIR: only 26% of critical vulnerabilities were fully remediated in 2025, down from 38%; AI-built software widens the gap
- Exploitation has overtaken credential abuse as the top initial access vector for the first time
- Core argument: the advisory→ticket→patch-window process can't keep up in the AI-built software era; resilience must be built in
More from Safety
- AI agents are attacking the internet: 2,900 logins a minute across 2,250 orgs — Exponential View (Azeem Azhar) · 2026-10-24
- CISO survey: AI security spend to grow from $9B in 2026 to $65B by 2030 — BenBajarin · 2026-10-24
- Railway publishes preliminary report on Oct 21 security incident, users urged to act — kingslyj · 2026-10-24
- Moonshot explains its capped-cyber-capability strategy for K3.1 Pro open weights — cephaloform · 2026-10-24
- Moonshot says K3.1 Pro's offensive cyber capability is deliberately capped below frontier — dejavucoder · 2026-10-24
- Researcher links recent lone-actor attacks to abliterated DeepSeek 4.1 Flash via ARTEX — MatthewMcAteer0 · 2026-10-24