WAF Weekly: php2shell, trust failures, AI offense, Oct 16-23

A hole in PHP took government sites offline, eight certificate keys proved trivially guessable, and an AI agent platform ran mass intrusion. Some call it Black October. We group by mechanism, not victim.

php2shell: the hole inside PHP

php2shell is a pair of unauthenticated remote code execution flaws inside PHP itself, CVE-2026-109618 and CVE-2026-109619, patched October 21. PHP runs on 69.3 percent of sites with a known server-side language. The takedowns were precautionary, not breach responses. The UK reported 32 services unavailable, with Germany, France, Belgium, Finland and the Netherlands pulling sites too. Attackers exploited the flaws four days before disclosure. Cloudflare logged millions of attempts. PHP's own guidance says to cap decoded request size, field count and nesting depth at the proxy level. That is a WAF job, and with mod_php the edge control is the only gate before application code. This is our seatbelt argument in miniature.

NGINX and GitLab: the layer everyone runs

NGINX 1.30.6 and 1.31.7 fix three memory corruption flaws that F5 rates critical at 9.2. All five fixes need non-default directives, so exposure is a subset of installs. The vendor twist: F5's own NGINX App Protect was in scope. GitLab patched CVE-2026-110264, a CVSS 10.0 integer overflow in its regex compiler, present since 7.0 shipped in 2014. It allows unauthenticated code execution under undisclosed conditions, no confirmed exploitation. Both sit in the layer everyone runs, where application-level fixes do not apply.

HTTP/3: one connection, thousands of times the memory

FoxIO found that seven of ten HTTP/3 implementations enforce no usable limit on decoded header size. One unauthenticated connection can make a server allocate 15 to 4,000 times the memory received, OOMing or pinning a default-configured server. This is DoS, not a crash. Cloudflare quiche and quic-go, which underpins Caddy, Traefik and cloudflared, are fixed, plus LiteSpeed lsquic. Bun, h3 and aioquic were not. HTTP/3 runs over UDP, so traffic reaches the origin before usual filtering applies. A WAF must terminate HTTP/3 and decode QPACK itself to see this class, which puts its own stack in scope and makes HTTP/3 handling a concrete evaluation criterion.

eMudhra: keys that were never random

Eight eMudhra intermediate certificate keys were trivially guessable, not cracked. A faulty April 2025 key ceremony generated P-384 keys with values below 256, one of them the integer 4. Recovering them from public certificates took under a second, enabling forged TLS certificates for any domain. Mozilla, Google, Apple and Microsoft blocked them within days, and eMudhra is exiting the global TLS business. About 30,000 certificates need replacing. A WAF is nowhere in this path. Revocation hit browsers in hours, not static CA bundles and embedded tooling.

UpdraftCentral: validly signed backdoors

Attackers stole UpdraftCentral connection keys from plugin maker TeamUpdraft and used them to backdoor WordPress sites. Commands signed with genuine private keys pass every site-side check. Patchstack logged 99 backdoor plugin names, and Nethemba showed fully patched sites fell anyway. UpdraftPlus 1.26.13 and 2.26.13 revoke keys issued before the breach. The commands arrive as ordinary POST requests, so a Wordfence-class or Patchstack-class control can block the endpoint, restrict it by IP, and catch the admin accounts and plugin installs that follow. No signature can flag a validly signed command.

Cairn: AI agents running offense

Criminals are running Cairn, an open source AI agent platform, as an autonomous pentest engine. One cluster spanned 1,100 projects, with Reuters reporting 100-plus companies breached at about 50 dollars per site. The traffic is ordinary web exploitation: SQL injection, admin panel abuse, webshell uploads. A WAF sits directly in the path. What changed is volume and autonomy, the theme of our post on model-found zero-days and the coming exploit explosion.

WAFplanet take

Black October is real, and calm is the right register. Three of the five failure classes are attacks a WAF structurally cannot stop. php2shell, NGINX and GitLab are runtime flaws that reward patch automation and edge hardening. The eMudhra story lives outside HTTP, and supply chain attacks arrive with valid signatures. A WAF still earns its place, but the seatbelt argument now covers a month, not one CVE. Compare providers on request size budgets and HTTP/3 termination, not signature counts.

We also read

• Palo Alto GlobalProtect bypass CVE-2026-0257 exploited by Qilin and INC since June: helpnetsecurity.com
• 333 Tor exit relays hijacked to intercept SSH credentials: arstechnica.com
• Railway told developers to rotate secrets after possible access to stored environment variables: thehackernews.com
• Cloudflare on php2shell protections ahead of the patch: blog.cloudflare.com
• Cloudflare introduced full transaction detection for its WAF: blog.cloudflare.com
• AWS on WAF mitigations for php2shell: aws.amazon.com
• Check Point on php2shell and CloudGuard WAF rules: blog.checkpoint.com
• Fastly on both php2shell CVEs: fastly.com
• Wordfence on php2shell testing against WordPress: wordfence.com
• Wordfence Argus found a high severity PHP object injection in Duplicator: wordfence.com