eMudhra and PHP2Shell: Two Major Vulnerabilities in One Day. Announcing Early Light.

Last updated October 22, 2026.

eMudhra and PHP2Shell dropped in the same day. Browsers fixed one in hours. Most containers will take months.

On Tuesday, the security world learned that eight certificate authority keys belonging to eMudhra could be recovered by anyone. With one of those keys, an attacker can sign a certificate for any website, and a lot of software will accept it as real. Chrome and Firefox blocked the keys within hours of the report, and Apple followed, because a browser can push a blocklist to billions of people at once.

Nothing else works that way. A container keeps the trust store it was built with. Java, Python and Node.js each carry their own. Every one of those copies waits for someone to find it and rebuild it.

One of them presented exposure for us

DefectDojo's released container images trusted the compromised eMudhra root. We started on it at 6 PM Mountain time on Tuesday. Our first fix merged 29 minutes later. Within two hours, fixes across 27 repositories were written and tested, and DefectDojo 3.4.201 shipped for Community Edition and Pro that night.

Hours later, PHP2Shell

On Wednesday morning, the PHP team shipped an emergency release for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine itself, now known as PHP2Shell. They don't depend on your application code, so any PHP that serves web requests is in scope. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Sensei now finds and fixes both in DefectDojo Pro 3.4.202, which shipped Wednesday night.

The slow part isn't the fix

For most teams, the fix is a package upgrade or a new base image. The slow part comes first: answering "where are we exposed?" before anyone can start. Which images still trust the bad keys? Which servers run a PHP build without the patch? Which of last month's builds are still in production?

To answer that for ourselves, we wrote a scanner for eMudhra on Tuesday night and another for PHP2Shell on Wednesday morning. Two vulnerabilities in a day meant two new tools, and the next one would mean a third.

Meet Early Light

So today we're announcing Early Light: one free, open source engine, with a new detector for each new vulnerability. When the next one drops, you don't go hunting for a new tool, vet it and learn its flags. You update Early Light and run the command you already know.

Our goal is to be the fastest detection in security every time a new vulnerability drops. It's powered by Sensei and the Dojo community, and anyone can contribute a detector.

A scanner you run during an incident has to be right, so Early Light decides on evidence, never on a name or a version string alone. The eMudhra detector matches certificates by their exact public key. The PHP2Shell detector checks a packaged PHP against its vendor's own backport data, so a patched Ubuntu build that still reports an old version number comes out fixed, not vulnerable. When Early Light can't prove something either way, it says so and tells you what to check, instead of quietly calling you safe.

curl -fsSL https://raw.githubusercontent.com/DefectDojo/earlylight/main/install.sh | sh
brew install defectdojo/tap/earlylight                # or with Homebrew

earlylight scan image your-registry/your-app:latest   # a container image
sudo earlylight scan fs /                             # this machine
earlylight scan repo .                                # the images your code builds on and deploys
earlylight scan host example.com                      # a live TLS server

The install script checks every binary against the release's signed checksums. You can also go install github.com/DefectDojo/earlylight/cmd/earlylight@latest, download a binary for Linux, macOS or Windows from the releases page, or run the container image ghcr.io/defectdojo/earlylight in CI. To check every pull request, add the Early Light GitHub Action, which puts findings in GitHub code scanning. Results come out as text, JSON or SARIF, and the SARIF goes straight into DefectDojo.

Early Light ships today with two detectors:

• eMudhra finds anything that still trusts the compromised keys: system certificate bundles, Python's certifi, Java keystores, Node.js and Go binaries, and copies inside jar, war, zip and tar files. Point it at a live server and it tells you whether that server's certificate came from one of the compromised CAs. The advisory site at emudhra.we-have-a-problem.com keeps the current patch table for every runtime.
• PHP2Shell finds every PHP runtime on a machine or in an image, including PHP-FPM, the Apache module and static builds, and tells you which ones still lack the fix. Point it at a source tree and it checks the base images your code pulls. earlylight fix --dry-run . shows the image updates that would fix them.

The code is on GitHub at DefectDojo/earlylight under the BSD 3-Clause license.

Detection for everyone, fixes for our customers

Open source users get the fastest detections we can ship. Our commercial customers get autonomous detection and fixes.

In DefectDojo Pro 3.4.202, Sensei finds both vulnerabilities in your repositories. For PHP2Shell, it checks the images your Dockerfiles, Compose files, Kubernetes manifests, Helm values and CI files pull, and moves each one to a fixed PHP release. For eMudhra, it finds trust in the compromised keys in certificate bundles, vendored certifi, keystores, binaries, Go version pins and the images you deploy. Where a change is safe, Sensei makes it. Where it isn't, such as a keystore or a compiled binary, it gives you the exact steps.

With Early Light powering Sensei, our goal is a fix within two hours of a new vulnerability dropping.

Fight AI with AI

The time between a disclosure and a working exploit keeps shrinking. Defenders need detection and fixes that move just as fast.

Fight AI with AI.

Try Early Light on GitHub