IT Daily Roundup: October 21, 2026
1. PHP releases emergency patches today for two critical RCE flaws, watchTowr rates them CVSS 10
PHP announced two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. PHP rates them at CVSS 9.2; watchTowr puts both at 10. Fixed versions are due today at 14:00 UTC. Exact affected release lines will be published alongside the patches, but watchTowr says the impact spans PHP 5, 6, 7, and 8. No active exploitation has been confirmed so far, though watchTowr reproduced CVE-2026-109618 and is holding back technical details.
Why this matters: A large share of websites and e-commerce stores run PHP. If you manage WordPress, WooCommerce, Magento, or any custom PHP application, today's patch is not something to push to next week. The steps are simple: update PHP on the server and verify the application still works.
2. Qilin and INC ransomware groups exploit Palo Alto PAN-OS flaw to bypass MFA
The Qilin and INC ransomware groups are actively exploiting CVE-2026-0257 (CVSS 7.8) in PAN-OS and Prisma Access. The flaw lets an attacker bypass multi-factor authentication and open an unauthorized VPN session. The patch has been available since May 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on May 13. A third group, Settra, is also using the same flaw according to ReliaQuest.
Why this matters: If your organization runs a Palo Alto firewall and skipped the May patch, three active ransomware groups are scanning for exactly that gap. Check your PAN-OS version against Palo Alto's fixed release list. Then go through your VPN logs for any gateway sessions from unfamiliar sources.
3. eMudhra loses private keys for eight certificate authorities, browsers block them the same day
A security researcher reported on October 17 that the private keys of eight eMudhra intermediate certificate authority certificates had been compromised. Chrome pushed a CRLSet block the same day; Firefox added the certificates to OneCRL, and version 158.0.1 includes it directly. Apple and Microsoft blocked the certificates on October 19 and 20, respectively. Go released patched versions 1.27.3 and 1.26.10. Python certifi, Rust webpki-roots, and Homebrew ca-certificates have all received updated root bundles. No fraudulent certificate issued before the block has been found so far.
← All postsWhy this matters: The right action depends on your setup. TLS certificates issued through eMudhra need to be replaced. Go projects should be rebuilt with version 1.26.10 or 1.27.3. Python, Rust, and Homebrew tooling in CI/CD pipelines should be verified against the updated root bundles. Browser users get the block automatically and have nothing to do.