The October 22 advisory highlights critical PHP vulnerabilities, compromised digital certificate authority keys and a software supply chain attack targeting LiteLLM, urging organisations to assess exposure and strengthen security controls.
As organisations expand their digital infrastructure and adopt artificial intelligence, vulnerabilities across web applications, digital trust systems and AI software dependencies are creating new cybersecurity challenges. A critical security advisory issued by Aquila I on October 22, 2026, has highlighted three developments that could expose enterprises to remote code execution, fraudulent digital certificates and the theft of sensitive credentials.
The advisory covers two critical PHP vulnerabilities, the reported compromise of eMudhra intermediate certificate authority (CA) private keys, and a supply chain attack involving LiteLLM packages and Docker images.
Together, these developments underscore the importance of continuous vulnerability assessment, certificate validation, software supply chain monitoring and rapid incident response. Aquila I recommends that organisations assess their exposure, investigate potential compromise and prioritise remediation across their technology environments.
PHP2Shell: Critical Vulnerabilities Raise Web Application Security Concerns
The first development concerns two critical PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. According to the Aquila I advisory, both vulnerabilities carry a reported CVSS severity score of 9.2 and could allow unauthenticated attackers to execute malicious code or access sensitive application memory.
The advisory identifies affected PHP versions as those below 8.5.12, 8.4.27, 8.3.36 and 8.2.35, respectively. Unsupported older versions may also remain exposed.
PHP is widely used to build and operate web applications. Vulnerabilities in exposed PHP deployments can therefore create risks extending beyond individual applications, potentially affecting the servers, data and connected systems that support them.
Depending on the affected environment and the successful exploitation of a vulnerability, the consequences could include application compromise, unauthorised data access and potential server takeover.
Aquila I recommends that organisations identify internet-facing PHP applications, validate installed versions and urgently apply the relevant security updates. Security teams should also investigate potentially vulnerable systems and prioritise remediation according to exposure and business criticality.
eMudhra Certificate Authority Key Compromise Threatens Digital Trust
The second development concerns the reported compromise of eight eMudhra intermediate certificate authority private keys, attributed in the advisory to critically weak key generation.
According to the report, some P-384 private keys had values below 256, potentially making them recoverable almost instantly. The reported weakness raises concerns about the integrity of digital certificates associated with affected certificate chains.
Certificate authorities play a central role in establishing trust across digital communications. Their certificates help browsers and other systems verify website identities and establish encrypted connections. If an intermediate CA’s private key is compromised, attackers may be able to misuse it to issue fraudulent certificates, depending on the key’s authority and the applicable trust controls.
Potential consequences include website impersonation, fraudulent HTTPS certificates and attempts to intercept encrypted communications.
The advisory states that Mozilla has blocked affected certificates in Firefox and that the Indian Computer Emergency Response Team (CERT-In) has issued an advisory.
Aquila I recommends that organisations inspect externally exposed SSL/TLS certificates and identify certificate chains linked to the compromised intermediates. Businesses should also review certificate validity and trust status, investigate relevant dependencies and coordinate necessary certificate replacement or revocation with the responsible providers.
The incident highlights a broader security consideration: encrypted connections alone do not guarantee trust if the certificate infrastructure used to authenticate endpoints has been compromised.
LiteLLM Supply Chain Attack Targets AI Infrastructure
The third development involves a reported compromise of LiteLLM’s software release pipeline. According to Aquila I, attackers distributed malicious packages capable of stealing large language model (LLM) API keys, cloud credentials and application secrets, with additional remote code execution capabilities.
The advisory identifies litellm==1.107.0 and specific Docker images distributed on October 21, 2026, as affected.
LiteLLM is used in AI application environments to connect with and manage interactions across large language models. Software supply chain compromises affecting such components can create risks across the broader AI infrastructure, particularly when applications have access to sensitive credentials or cloud resources.
If malicious code executes within an affected environment, exposed secrets could potentially enable unauthorised access to AI services, connected cloud infrastructure or other applications. The extent of the impact would depend on the affected deployment, its permissions and the credentials available to the compromised component.
Indicators for Investigation
Aquila I has highlighted several indicators that security teams can use during investigations:
- Domain: litellm[.]dev
- Files: cook.pth, cook.py and sitecustomize.py
- Additional file: /tmp/remote_code_loader.lock
- Docker image digest: sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e
Organisations using LiteLLM should validate deployed package versions and container image digests against trusted sources. They should also investigate suspicious outbound network connections, examine relevant system and application logs, and rotate credentials that may have been exposed.
Where compromise is suspected, teams should follow their incident response procedures to isolate affected environments, assess the scope of access and verify that remediation has removed the malicious components.
The incident demonstrates how AI infrastructure can inherit security risks from the software components and dependencies on which it relies. As enterprises increasingly integrate AI into business-critical workflows, dependency monitoring and secrets management are becoming important elements of AI security.
How Aquila I Can Help Organisations Assess Exposure
In response to these developments, Aquila I has outlined how its Unified Cyber Defence Platform can support organisations in assessing potential exposure across the three threat categories.
The company’s proposed approach combines external vulnerability assessment, certificate trust analysis and AI infrastructure threat hunting.
- External Vulnerability Assessment
For the PHP vulnerabilities, Aquila I can help organisations scan internet-facing applications, discover PHP deployments and identify potentially vulnerable software versions.
The objective is to help security teams establish which exposed assets require attention and prioritise remediation based on their potential risk.
- External Certificate Trust Assessment
For the eMudhra incident, Aquila I can assess publicly exposed domains and SSL/TLS certificates to help identify affected certificate chains and potential digital trust exposure.
This can support security teams in identifying certificates that require further investigation and coordinating appropriate corrective action.
- AI Supply Chain Threat Hunting
For the LiteLLM incident, Aquila I says its AI Security Operations Centre (AISOC) and AI Security Detection and Response (AISDR) capabilities can help correlate available AI infrastructure telemetry, software dependency inventories, package versions, container digests and network activity.
Such analysis can help organisations investigate potential compromise, identify suspicious activity and assess possible credential misuse.
The effectiveness of this assessment depends on the telemetry, asset inventories and integrations available within each organisation’s environment. External scanning can identify certain exposure indicators, but determining whether an attack has succeeded may require internal forensic analysis and incident response.
Why Unified Cybersecurity Assessment Matters
The three developments affect different parts of the enterprise technology stack, but they share a common challenge: security teams must identify exposure quickly and translate technical findings into actionable remediation.
Vulnerable web applications can provide an entry point for attackers. Compromised certificate authority keys can undermine the trust used to authenticate digital services. Malicious software dependencies can expose AI applications and the credentials that connect them to business systems.
Addressing these risks requires more than isolated security checks. Organisations need visibility across external assets, certificate infrastructure, software dependencies, cloud environments and AI workloads, supported by processes that connect detection with investigation and remediation.
A unified approach can help security teams establish priorities, reduce investigation delays and allocate resources to the systems most likely to face material risk.
Conclusion
The Aquila I advisory highlights how cybersecurity risks are evolving across traditional web infrastructure, digital trust mechanisms and emerging AI systems. The reported PHP vulnerabilities, eMudhra certificate key compromise and LiteLLM supply chain incident each require targeted investigation and timely corrective action.
For organisations potentially affected, immediate priorities include validating software versions, reviewing certificate chains, checking AI dependencies and container images, investigating suspicious activity, and rotating potentially compromised credentials.
Aquila I’s proposed response combines external exposure assessment with AI infrastructure monitoring and threat hunting to help organisations identify potential risks and prioritise remediation.
As enterprise technology environments become more interconnected, continuous validation and coordinated incident response will remain central to reducing the impact of emerging cyber threats.
By : Vanshika Tayal
