CRACI: Vulnerabilities and supply chain incidents https://craci.com/vulnerabilities Critical vulnerabilities and supply chain incidents that reach software builds: affected versions, fixes and how to check your builds. en Wed, 11 Nov 2026 00:00:00 GMT Shai-Hulud: the npm worm and how to check whether your builds are affected https://craci.com/vulnerabilities/shai-hulud https://craci.com/vulnerabilities/shai-hulud Wed, 11 Nov 2026 00:00:00 GMT A self-spreading worm that infects npm packages, runs at install time, steals npm, GitHub and cloud credentials, and uses them to publish infected versions of more packages. Check every build in each wave's window for the affected versions, treat any job that installed one as compromised and rotate its secrets, and clear CI and npm caches. CVE-2026-45321 npm PHP2Shell: unauthenticated RCE in PHP and how to check whether your builds are affected https://craci.com/vulnerabilities/php2shell https://craci.com/vulnerabilities/php2shell Wed, 11 Nov 2026 00:00:00 GMT Two memory-safety bugs in PHP itself let an unauthenticated web request execute code on any PHP installation that serves web requests. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, rebuild and redeploy every image, and set PHP's interim mitigations where you can't yet. CVE-2026-109618 CVE-2026-109619 PHP Container images