The past 24 hours have brought several major cybersecurity developments. The PHP Foundation has released emergency updates to fix two critical vulnerabilities, while Indian certificate authority eMudhra has faced scrutiny over dangerously weak security keys. Meanwhile, Node.js has patched high-severity flaws, an AI development tool called LiteLLM has been compromised, and cloud platform Railway is investigating a possible customer data exposure.
These developments come alongside warnings about AI-assisted cyberattacks targeting organisations worldwide and a separate breach involving State Bank of India (SBI) customer records. Although the incidents are not necessarily connected, their combined impact highlights the risks facing websites, businesses and digital services.
- Critical PHP vulnerabilities trigger government warnings
PHP, a programming language used by approximately 70% of websites, according to W3Techs estimates cited in the original report, has issued an emergency security update for two critical vulnerabilities collectively called PHP2Shell.
The flaws could allow attackers to execute malicious code on affected web servers without authentication. The PHP Foundation rated them 9.2 out of 10 for severity.
According to the report, OpenAI’s GPT-5.6 Sol model identified vulnerabilities believed to have existed for around a decade. The PHP Foundation released fixes on October 21.
The US National Security Agency (NSA) and FBI urged organisations to install the updates immediately. Systems that cannot be patched should be taken offline until they can be secured. Government websites in Finland and the Netherlands reportedly went offline as a precaution.
- eMudhra’s weak security keys threaten website trust
Indian certificate authority eMudhra was found to have used eight dangerously weak private keys for intermediate digital certificates.
These certificates help browsers verify website identities and establish secure HTTPS connections. If an attacker obtains a certificate authority’s private key, they may be able to issue fraudulent certificates and impersonate legitimate websites.
Security researcher Wayne alerted technology companies on October 17 and demonstrated the weakness by publishing a digitally signed message on a website created for the demonstration.
The affected keys corresponded to just eight single-byte values: 4, 56, 66, 115, 155, 156, 230 and 237. Since a single byte can represent only 256 possible values, researchers recovered the keys in less than a second.
Apple, Google and Mozilla blocked the affected certificates in Safari, Chrome and Firefox, while Cloudflare deployed emergency fixes. India’s cybersecurity agency CERT-In also issued an advisory.
eMudhra stated that only one of the eight certificates had been deployed in production and that none had been used to issue certificates for individual websites. Users have been advised to update their browsers and operating systems.
- Node.js patches four high-severity vulnerabilities
Node.js, which allows developers to run JavaScript outside web browsers, released security updates addressing four high-severity vulnerabilities on October 21.
One flaw could potentially allow remote code execution, while two others affected Transport Layer Security (TLS) certificate verification. TLS helps systems establish secure connections and verify server identities.
Node.js advised users to update supported versions and migrate from outdated releases. The updates also introduced a certificate store blocking eMudhra and other listed intermediate certificates, extending protection against the certificate authority incident.
- LiteLLM compromise puts developer credentials at risk
LiteLLM, an open-source tool that routes requests across different AI models, was compromised after malicious code was introduced into its software releases.
Security firm Wiz reported that the malware could steal system information, browser data, developer secrets, cloud credentials and authentication files used by AI tools.
The attack used Python startup hooks, meaning malicious code could execute when a Python environment started, even if LiteLLM itself was not directly opened.
LiteLLM removed the malicious releases and images and advised affected users to follow its remediation guidance. The incident was reportedly the platform’s second cybersecurity compromise of 2026, following another incident in March.
- Railway investigates possible exposure of customer secrets
Cloud platform Railway detected suspicious activity involving systems storing customer environment variables. Its initial investigation indicated that an unauthorised third party may have accessed the decrypted contents of some variables.
Environment variables can contain database credentials, API keys and other secrets that applications use to access services.
Railway said the impact might be limited to a subset of customers and suspected the incident could be part of a broader campaign targeting platform providers to compromise AI inference services.
The company advised all customers to rotate stored environment variables, API keys and private registry credentials, and review service logs for unusual activity. The full extent of the potential exposure remained under investigation.
- Microsoft uncovers AI-assisted attacks on hundreds of organisations
Microsoft reported that Storm-0940, a China-linked hacking group, used an AI-assisted tool to target hundreds of organisations worldwide.
The campaign involved ARTEX, an open-source penetration-testing framework allegedly used to automate attacks against ConnectWise, an IT services company, through its Cloud Backup service.
The attackers reportedly abused trusted digital keys used by ConnectWise to connect to Microsoft 365 accounts, bypassing standard login screens. The tool generated approximately 2,900 sign-in attempts per minute and reached more than 2,250 company systems. Some targets reportedly experienced deep access to cloud networks in under three hours.
Affected sectors included defence, aerospace, energy, financial services, government, manufacturing, technology and nonprofits, among others.
Microsoft advised organisations using or previously using ConnectWise Cloud Backup to keep relevant connections disabled until official instructions were issued. IT teams were also urged to investigate suspicious sign-ins and unauthorised administrator roles. Affected applications should be disabled rather than deleted to preserve evidence for investigations.
- SBI confirms exposure of nearly 3,900 customer records
Separately, State Bank of India confirmed that a cyberattack had exposed nearly 3,900 customer records, which were subsequently posted on the dark web, according to earlier reporting.
CERT-In has also warned that AI agents had accessed confidential information belonging to Indian organisations. Such agents can interact with connected applications and databases, creating risks when they have excessive permissions or inadequate oversight.
These incidents have not been established as part of the same campaign as the PHP, eMudhra, LiteLLM or Railway cases.
What these incidents reveal
The incidents affect different layers of the internet, from website identity certificates and programming languages to developer tools, cloud platforms and corporate accounts. Their consequences range from vulnerabilities that could be exploited to compromised software and potentially exposed credentials.
Organisations should prioritise security updates, replace compromised credentials, review access permissions and investigate suspicious activity. Users should keep their browsers and operating systems updated and follow security guidance from affected service providers.
The broader concern is how much modern digital infrastructure depends on interconnected systems. A weakness in a single trusted component can create risks for thousands of organisations and users, making timely detection and coordinated responses essential.
