Rekt - Is the Internet Rekt?

What it is

A Rekt News analysis (October 2026) that separates verified facts from hype across the month's security headlines. Its main case is PHP2Shell, two PHP flaws that both scored 9.2 out of 10 and allow unauthenticated code execution. It then covers eMudhra's weak CA keys, the Railway and PingCAP credential breaches, Anthropic's exploit-chain claims, and Newton's published-key wallet demo.

What is confirmed on PHP2Shell

• PHP shipped emergency patches on 21 October. The NSA advised taking systems offline if they could not be updated at once.
• Adel Ka (Perplexity) recorded thirty-five shell processes launched by Apache workers on 24 October, across three honeypots and from two IP addresses. The targets were PHP 8.4.26 under Apache mod_php with a single worker. Ka said this does not measure reliability against other builds, worker counts or applications.
• Trail of Bits reported a working exploit against an unmodified MediaWiki.
• CISA added both bugs to the KEV catalog on 26 October. The remediation due date for federal civilian agencies was 29 October.
• Unit 42 reported on 29 October that attackers chained PHP2Shell with a Linux kernel vulnerability to get root on internet-exposed PAN-OS management interfaces. Dream researchers separately reported a chain that compromised 25 servers.
• Germany's cyber agency saw attacks but no successes, and found the bug harder to weaponize than expected.

Retracted or unverified claims

• Unit 42 withdrew its attribution of a European government compromise to PHP2Shell on 25 October.
• Sophos corrected an earlier report on 22 October: its telemetry showed scanning and a few failed attempts, not a successful compromise.
• Wiz's "70% of the Internet" figure rests on PHP's share of websites, not a count of exploitable deployments. Wiz's own writeup says version, configuration and application differences can break the exploit.
• Many outages (DigiD and MijnOverheid in the Netherlands, French prefecture sites, Japanese banks and airlines) were precautionary, not attacker takedowns.

Other incidents

• eMudhra: Scott Helme recovered all eight intermediate CA private keys in under a second, because every value was below 256. A script flaw in the 30 April 2025 key ceremony was the preliminary cause. Firefox and Chrome blocked the affected certificates, and Mozilla removed the root. CERT-In said no malicious exploitation was confirmed as of 21 October.
• Railway: Disclosed 21 October. Attackers decrypted a subset of encrypted environment variables, affecting at most 1.85% of workspaces. Taylor Monahan linked about $371,000 in crypto drains on at least 19 EVM chains to keys stored on Railway. Railway's report, including its 26 October update, did not confirm this.
• PingCAP: A compromised GitHub account gave access between 9 September and 7 October. Customers should replace any credentials they sent to PingCAP support.
• Anthropic: Its 27 October claim of five attack chains with little human involvement is largely unverified. Google and Apple credit individual Chrome and WebKit fixes, which do not confirm the full chains. Anthropic also sells access through its Cyber Verification Program.

Newton's demo

Newton published an owner key for a Safe wallet on Sepolia (0x79a726e58FA5851a83Cf934d27fE1bdde4F0885e) holding test USDC. A guard blocks ordinary owner transactions. The one allowed path is USDC transfers capped at 10 USDC, each needing a TOTP bound to recipient, amount and attempt. Newton signs the approval, and the wallet verifies it before funds move. The authority now rests with Newton's permissioned operator network and whoever can change the policy. Newton's CTO Dennis Won concedes administrators remain a risk. He recommends separating configuration and withdrawal roles, and using timelocks.

What to do

• Patch PHP, or take unpatchable systems offline as the NSA advised.
• Track patch uptake with Infrawatch's PHP2Shell Patch Uptake Tracker. It measures patching, not exploitation.
• Rotate secrets held on Railway. Replace any credentials sent to PingCAP support.
• Keep signing keys out of servers and deployment pipelines. Where a signature alone authorizes spending, consider an extra approval layer.

Caveats

The page is an opinion piece by an anonymous author. The full extent of PHP2Shell compromise is unknown. Newton's demo is one approach, not proof that these breaches would have been prevented. The page gives no CVE number for PHP2Shell except CVE-2026-109618, which it ties to the out-of-memory problem.