Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own

Qualys security intelligence covering multiple October 2026 disclosures and remediation guidance, including critical PHP remote-code-execution vulnerabilities (PHP2Shell), compromised eMudhra certificate authorities, a high-severity Node.js Brotli out-of-bounds write enabling remote code execution, and the BlueHammer Windows Defender local privilege-escalation chain. The most urgent items are PHP2Shell and the Node.js flaw due to remote exploitation potential, while compromised certificates create risks of fraudulent TLS or code-signing operations.