PHP2Shell vulnerabilities put millions of sites at risk.

This report summarizes several high-impact security incidents: critical "PHP2Shell" RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting all PHP web deployments with observed exploitation attempts and Mirai-based targeting; eMudhra issued intermediate certificates with extremely weak private keys causing widespread revocations; the open-source LiteLLM project was compromised and a malicious PyPI/Docker release (credential harvester + RAT) was downloaded ~49,000 times with reported credential abuse; Quest Diagnostics disclosed unauthorized access to a lab services system potentially exposing patient PII; and GitLab patched a maximum-severity RCE (CVE-2026-110264). Immediate actions urged include applying patches, revoking/rotating impacted keys and credentials, and treating affected systems as compromised.