Two Critical Flaws in PHP Itself, a Backdoor in a Claude Code Update, and a CRA Law Passed in Germany

PHP has released emergency fixes for two critical remote code execution flaws, together called PHP2Shell. Reporting on 21 October 2026 described exploit attempts emerging. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The flaws let an attacker without an account run code on a web server. They sit in the PHP runtime, not in an application, so keeping your application code up to date does not close this gap. The PHP project says all installations serving web requests are at risk and only updating provides a complete fix.

For healthcare and MedTech teams, the question is which deployed services depend on an affected runtime, including those managed by a supplier. If a patient-facing service or a product support portal runs PHP, check the runtime behind it rather than relying on an assurance that the application is patched.

Get the running PHP version for each web-facing deployment and prioritise exposed systems for an update to the fixed release in their branch. Ask suppliers to confirm the deployed version, then verify it after the change. Coordinate testing around clinical and operational dependencies, but do not treat application-level controls as a substitute for the runtime update.

1. LiteLLM 1.107.0 delivered a credential stealer and a backdoor through PyPI and Docker

   The compromise reported on 21 October affects both PyPI wheels and Docker images for LiteLLM 1.107.0. The package has since been quarantined on PyPI, but that does not remove anything already deployed.

   If your team uses LiteLLM in clinical AI services or device development, check installed versions, container images and build records. Treat a match as an incident investigation, not just a dependency update: isolate affected environments, establish which credentials were reachable and rotate them. Read the report.

2. Eight eMudhra intermediate certificate keys can be recovered in seconds

   Cisco's 28 October advisory describes a compromise uncovered between 17 and 20 October. An error in eMudhra's April 2025 Key Generation Ceremony left the private keys for eight intermediate certificates vulnerable to brute-force recovery within seconds.

   For hospitals and device makers, the immediate question is which systems trust these certificates. Check Cisco's affected-product list and assess certificate dependencies before changing trust stores. Cisco says products not listed in its advisory are not affected according to its review; that is not a finding about the rest of your estate. Read Cisco's advisory.

3. A crafted VPN request can reload affected Cisco firewalls without authentication

   CVE-2026-76418 affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software. Logic errors when secondary authentication is configured on a tunnel group allow an unauthenticated remote attacker to trigger an unexpected device reload, causing denial of service. Cisco rates it High severity.

   If these firewalls support hospital remote access or device support connections, check the tunnel-group configuration and deployed software against the advisory. Cisco has released updates and says there are no workarounds. Record the fixed release and maintenance window rather than leaving this as a generic patching ticket. Read the advisory.

4. An attacker targeted Alpine Linux's GitLab a week after a critical fix was released

   Alpine Linux disclosed the attempt on 28 October and found no evidence that it succeeded. CVE-2026-97229, CVSS 10.0, can allow code execution on a GitLab server through a crafted regular expression in a CI configuration.

   If you run GitLab for medical device software development, verify remediation on the running server and review CI activity for suspicious configuration changes. The distinction matters: this was an exploitation attempt, not a confirmed compromise of Alpine. Read the report.

5. Oracle's October security update needs a product-by-product check

   Oracle published its October 2026 Critical Security Patch Update Advisory on 20 October, addressing vulnerabilities across multiple product lines. If Oracle products sit within your hospital infrastructure or manufacturing environment, map the advisory to your inventory and assign applicable updates to named owners. Read Oracle's advisory.

1. A malicious Claude Code update used the legitimate publisher identity

   Researchers found a trojanised version of Anthropic's official Claude Code extension on the Cursor Marketplace. Version 2.1.313 was distributed as a legitimate update and attempted to install a persistent SSH backdoor. For device software teams, the practical check is whether that version reached any developer workstation. Check installation history, investigate affected systems for persistence, and remind engineers that a recognised publisher name is not proof an update is safe.

   Read the report

2. AI-generated login pages can take more than a password

   Generative AI is making fake login screens easier to build and tailor to individual staff. Some phishing pages also capture MFA codes or hijack authenticated sessions. In your next briefing for clinicians and MedTech staff, make the distinction clear: a familiar-looking page and an MFA prompt do not establish that a login is genuine. Practise opening services through a known bookmark rather than a message link, and reporting a suspicious login even after authentication has completed.

   Read the report

3. AI agents helped accelerate the ConnectWise Cloud Backup attack

   Microsoft attributed the supply chain compromise to Storm-0940, a China state-aligned actor. The attackers used ARTEX, a Go-based agentic AI penetration testing framework, to speed up scanning and exploitation. If your organisation or service provider uses ConnectWise Cloud Backup, ask for an exposure assessment and the evidence behind it. The useful awareness message is not that AI creates a new class of access, but that it can help attackers work through existing weaknesses faster.

   Read the report

4. Three attacks in Japan show AI taking different roles in offensive operations

   TrendAI analysed three exposed server environments used by attackers and found AI either directing activity or assisting a human operator. For healthcare security teams, use this as a tabletop prompt rather than evidence of targeting in your sector: can your team recognise and escalate rapid scanning and exploitation without first deciding whether a person or an agent is behind it?

   Read the report

BEFORE YOU CLOSE THIS

Four things worth doing this week.

1. Get the PHP runtime versions for your web-facing services, including those managed by suppliers. Confirm deployment of the emergency fixes: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for the corresponding branch. An application update is not a substitute for updating the runtime.

2. Check package inventories and Docker images for LiteLLM 1.107.0. If you find it, isolate affected environments, investigate the backdoor and rotate credentials that were accessible. Record where it ran, not just whether it is still installed.

3. Ask whoever owns certificate trust to check Cisco's eMudhra advisory against your deployed products. Document any affected trust relationships and the steps needed to remove that trust without interrupting clinical services.

4. Pick one product or service and compare its SBOM with what is actually deployed. Use ENISA's practical guidance to identify gaps, then assign an owner to keep that inventory current.

The common thread this week is knowing what sits underneath the service you rely on. A runtime version, a package inside an image, a trusted certificate. Those details can look like housekeeping until they become the first questions an incident team needs answered.

Thanks for making time to read this issue.

There is plenty competing for your attention. My goal is to bring you the news that actually affects your day to day, and make it clearer what needs checking now and what needs planning for.

I hope this gives you a useful starting point for the week ahead.

See you in the next one.
Andrew.