PHP released emergency patches a day early this week because the CVE identifiers leaked ahead of the fix, and the exposure reaches the appliances in front of the web server as well as the server itself. Two items sit closer to home: State Bank of India has confirmed customer records in a dark web listing, and eight eMudhra intermediate certificate authority keys proved computable from the public certificates.
1
PHP code execution reaches the appliances, not only the web server — CVE-2026-109618 and CVE-2026-109619
India exposureBoth rate 9.2 on CVSS v4 and both give an unauthenticated attacker code execution. The identifiers leaked on 20 October, so PHP advanced its release to 21 October, and CERT-In rated the pair critical the same day. Apache mod_php is the worst case, because the request lands before any application code runs. The appliance position matters as much as the hosting fleet: Palo Alto Networks reports every PAN-OS and Panorama version affected with no fixed build yet, Fortinet has cleared FortiOS but is still assessing FortiADC, FortiSIEM and FortiSOAR, and Cisco is reviewing 18 products and 13 cloud services with no workaround.
ActionPatch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 7.4 to 8.1 have source backports only and 7.3 and earlier have no fix, so those hosts should come off the internet. Amazon Threat Intelligence logged an exploitation attempt against a honeypot on 17 October, four days before disclosure, so treat unpatched hosts as reachable now.
SourcePHP advisory and CERT-In vulnerability note CIVN-2026-0510, 21 October 2026; Tenable and Help Net Security, 22 October 2026.
2
State Bank of India confirms customer records in a dark web listing
India exposureSBI told the exchanges on 21 October that it had identified 3,897 records holding customer personal information inside a set of roughly 375,000 offered for sale. It calls the count preliminary and does not know the origin. The categories are names, contact details, dates of birth, branch and customer file identifiers, and loan lead metadata; account numbers, balances, passwords, one time passcodes, card details and government identity numbers are not included. The alert reached the bank on 16 October from its threat intelligence provider, CERT-In and the Defence Cyber Agency.
ActionThe documented risk is impersonation of the bank rather than account takeover, so brief branch and contact centre staff before customers begin receiving convincing calls. Because the samples reviewed by reporters were mostly loan related, lenders and aggregators should check which partners and lead generation vendors hold the same attributes.
SourceSBI exchange filing reported by The Hacker News and Bloomberg, 21 October 2026.
3
Eight eMudhra intermediate CA keys recoverable from the public certificates — CIAD-2026-0050
India exposureThe private keys of eight eMudhra intermediate certificate authorities were generated with insufficient randomness and can be computed from the certificates themselves. A researcher reported this on 17 October; Chrome blocked the six TLS intermediates within two hours and the other major root programmes followed by 20 October. eMudhra traces the fault to a key ceremony of April 2025 and says only one of the eight was in production and none issued end entity certificates. CERT-In records no confirmed malicious use and warns that the root removals will themselves disrupt legitimate sites. MeitY says eSign and digital signature services under the Controller of Certifying Authorities are unaffected.
ActionTreat this as an availability problem more than a confidentiality one. Chrome removes the emSign ECC Root CA G3 from around 27 October and Mozilla has already removed it, so any site still chaining to that root needs reissuing this week. Then look past browsers: servers, containers, network appliances and embedded devices carry their own certificate bundles, and each needs updating and a real test.
SourceCERT-In advisory CIAD-2026-0050, 21 October 2026; The Hacker News, 20 October 2026.
4
BeyondTrust Remote Support exploited as a zero-day since late August — CVE-2026-102764
India exposureImproper origin validation in an internal messaging component, rated 9.3, allows a remote attacker to perform file operations on the appliance. Google Mandiant attributes the exploitation to Armory Castle, a China nexus espionage actor also tracked as UNC5221. The earliest known exploitation was on 29 August against one hosted instance and one self managed appliance; the flaw entered the exploited vulnerability catalogue on 16 October with a three day federal deadline. The actor reached root, read stored passwords, API keys and endpoint credentials, moved to downstream systems through the Jump Item list, installed a web shell and a tunneller, and deleted logs.
ActionApply the BT26-05-RS patch. Self managed versions 24.3.1 through 26.2.3 are affected and older builds need upgrading first; SaaS instances were patched on 9 October. Mandiant's position is that any internet reachable appliance on a vulnerable build during that window should be treated as compromised, so rebuild from a known good image rather than patching in place, and assume the credentials for every third party access path it held were readable.
SourceBeyondTrust advisory, Google Mandiant research and CISA alert reported by The Hacker News, 16 October 2026.
5
Seventy thousand credentials taken from exposed Fortinet and Palo Alto devices — CVE-2019-6693, CVE-2025-64446 and CVE-2026-0257
India exposureGroup-IB and NyxLab published research on an operator they track as k0t, assessed as a likely initial access broker. More than 70,000 credentials and related records were recovered, including device logins and LDAP and Active Directory data. The methods are ordinary: scanning, guessing common passwords, a FortiWeb path traversal used to create a rogue administrator, a 2019 default key flaw used to decrypt FortiGate stored secrets, and a GlobalProtect bypass used to forge authentication cookies. Asia Pacific accounts for 37.6 percent of unique domains, which Group-IB attributes to where exposed devices sit rather than to regional targeting; India is not named. Unit 42 separately reports Qilin and Inc ransomware operators exploiting the same GlobalProtect bypass, patched in May.
ActionPatch FortiWeb for CVE-2025-64446 and PAN-OS for CVE-2026-0257, then assume the configuration was read before you did. Enable FortiOS private data encryption so stored secrets no longer sit under the default key, rotate the directory and administrative credentials those devices held, and check for administrator accounts you did not create.
SourceGroup-IB and NyxLab research of 21 October 2026 reported by Daily CyberSecurity; Palo Alto Networks Unit 42 threat brief, updated 20 October 2026. Two of these five are not patching problems. The eMudhra certificates were issued correctly by a trusted authority, and what failed was the randomness behind them. The FortiGate secrets were encrypted under a key that has been public since 2019, which means they were stored rather than protected. A control that is configured, documented and audited can still be doing no work at all, and that is harder to find than an unpatched appliance. — Nirad Threat Research
