Cybersecurity firm Aquila I issued an advisory on 22 October 2026 that flags three separate developments with potential to affect web applications, digital certificate trust and AI software supply chains. The advisory draws attention to
- two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a reported CVSS score of 9.2 each;
- a reported compromise of the private keys for eMudhra intermediate certificate authority (CA) keys affecting digital trust; and
- a software supply chain attack that manipulated LiteLLM packages and associated Docker images used by AI projects.
What the PHP flaws mean for web applications
Aquila I says the two PHP flaws could allow unauthenticated attackers to execute arbitrary code or access sensitive application memory. The advisory identifies vulnerable PHP releases as versions below 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The firm notes that unsupported older releases may also still be exposed.
Because PHP powers many server‑side web applications, vulnerable deployments can create risks that extend beyond individual apps to servers and connected systems. Aquila I recommends organisations verify PHP versions in use, apply the vendor patches for the referenced releases and investigate any signs of exploitation.
Implications of the eMudhra intermediate CA key report
The advisory includes a report that the private keys for an eMudhra intermediate certificate authority were compromised. A breach of CA private keys can enable the issuance of fraudulent digital certificates, undermining TLS/HTTPS trust, code‑signing and other PKI‑based protections used across enterprise systems.
Organisations that rely on certificates chaining to eMudhra intermediates should validate the revocation and status of their certificates, confirm guidance from eMudhra and their own PKI teams, and consider short‑term mitigations such as certificate pinning where feasible and consistent with operational constraints.
Supply chain risk targeting LiteLLM packages and Docker images
Aquila I also describes a supply‑chain attack that affected LiteLLM packages and related Docker images used in AI development and deployment. Malicious changes to widely used packages or container images can introduce backdoors, credential theft mechanisms or other persistence methods into downstream AI systems and infrastructure.
The advisory urges organisations to monitor dependency integrity, verify image provenance, and audit build pipelines and runtime environments for unexpected behaviour or unauthorised credentials access. Aquila I’s broader recommendation is to prioritise remediation across affected technology environments and to investigate potential compromise promptly.
| Risk area | Details cited by Aquila I |
|---|---|
| PHP vulnerabilities | CVE-2026-109618, CVE-2026-109619; CVSS 9.2; versions below 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Certificate authority | Reported compromise of eMudhra intermediate CA private keys; potential for fraudulent certificates |
| Supply chain | Attack on LiteLLM packages and Docker images affecting AI dependencies and images |
Aquila I’s advisory stresses three immediate actions for organisations: assess exposure to the listed vulnerabilities and components, investigate systems for indications of compromise, and prioritise remediation for high‑risk findings. The advisory underlines the need for continuous vulnerability assessment, certificate validation and supply‑chain monitoring as organisations expand digital and AI infrastructure.
Enterprises and administrators should consult the full Aquila I advisory for technical guidance and confirm vendor advisories and updates for PHP, eMudhra and LiteLLM related components before taking mitigation steps.
