200+ RapidFort Customers Protected From PHP2Shell, eMudhra and GitLab Flaws

Curated Images subscribers include leading AI companies, Fortune 500 security and networking vendors, and several of the top 20 U.S. financial institutions

RapidFort, the software supply chain security platform, today announced that more than 200 organizations subscribed to RapidFort Curated Images are protected against three of October's most serious open-source security events: the PHP2Shell remote code execution flaws, the eMudhra certificate authority key compromise, and a maximum-severity GitLab vulnerability. Customers include some of the world's largest AI companies, Fortune 500 security and networking companies, and a few of the top 20 U.S. financial institutions. Beyond its enterprise customers, RapidFort is also protecting public sector customers and partners.

A week of critical disclosures

• PHP2Shell (CVE-2026-109618, CVE-2026-109619). Two critical (CVSS v4.0 9.2) unauthenticated remote code execution flaws in PHP 5.4 through 8.5. Details leaked before PHP's October 21 emergency release, and exploitation attempts were reported as early as October 17.
• eMudhra CA compromise. Private keys for eight eMudhra intermediate certificate authorities were found to be recoverable, allowing forged TLS certificates. Fixes landed across Go (CVE-2026-111943), Java (CVE-2026-91403) and Linux ca-certificates packages. Containers that ship stale trust stores keep trusting forged certificates until they are rebuilt.
• GitLab (CVE-2026-110264). A CVSS 10.0 unauthenticated remote code execution flaw in self-managed GitLab CE/EE reaching back to version 7.0, patched October 21, just nine days after a separate 10.0 fix (CVE-2026-97229).

Fixed at the source, with no code changes

RapidFort Curated Images are near-zero CVE base and third-party container images built on the LTS distributions teams already use. RapidFort continuously patches them as upstream fixes land while keeping original version tags, so customers pick up fixes by pulling the updated image rather than rewriting code or re-baselining. Under RapidFort's standard service levels, CISA KEV-listed vulnerabilities target resolution within one calendar day and critical and high vulnerabilities within seven calendar days of an upstream patch becoming available.

RapidFort followed coordinated vulnerability disclosure practice throughout. As soon as upstream fixes were published and no longer under embargo, patched drop-in replacement images were available to all Curated Images customers across every major LTS distribution, including Ubuntu, Debian, Red Hat and Alpine. Teams pulled the fixed images straight into their existing pipelines, with no code changes and no re-baselining.