⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

This week's cybersecurity digest is dominated by a wave of critical remote-code-execution bugs nicknamed with the "2Shell" pattern. The PHP Foundation patched two unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), which triggered millions of scanning attempts per Cloudflare, though no successful exploitation has been confirmed yet; some sites went offline as a precaution. Separately, four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), chained as Plex2Shell, are already being actively exploited to deploy cryptominers, prompting CISA to add them to its KEV catalog, while Google's Brotli library received a fix for CVE-2026-111497 (Node2Shell/HTTP2Shell) affecting Node.js, Bun, Envoy, Istio and other dependents. GitLab also patched a maximum-severity CVE-2026-110264 (CVSS 10.0) regex-compilation RCE tied to Ruby's Onigmo engine. Beyond RCE chaos, eMudhra exited the TLS certificate business after eight intermediate CA certificates were found to use weak private keys, forcing Apple, Python and other ecosystems to block the affected roots, while LiteLLM suffered a supply-chain compromise after a leaked master key let attackers push a malicious package version bundling credential-stealing and backdoor code into version 1.107.0.