Global Cybersecurity Crisis Hits PHP, Node.js, LiteLLM and eMudhra
Critical PHP and Node.js flaws, poisoned LiteLLM packages and compromised eMudhra keys force urgent patches and takedowns across the internet worldwide.
Summary
On Wednesday, October 21, 2026, AI-discovered critical PHP vulnerabilities coincided with government website outages worldwide. The U.S. National Security Agency told organizations using PHP to update immediately or take affected systems offline until they could. Node.js, the open-source JavaScript runtime, patched 4 high-severity flaws in its latest release, including 1 enabling remote code execution and 2 allowing TLS validation bypasses that could defeat server identity checks.
LiteLLM, an open-source proxy routing requests among LLM providers, said Wednesday afternoon on X that an attacker injected malicious code into releases published through PyPI, the Python Package Index, Docker Hub and GHCR, the GitHub Container Registry. The payload included an information stealer targeting cloud credentials, passwords and AI service credentials, plus a remote access trojan capable of executing commands. LiteLLM removed the malicious releases and images and issued remediation guidance. Compromised private keys at Indian certificate authority eMudhra could let attackers issue fraudulent certificates and impersonate legitimate websites, creating a cleanup security professionals compared in scale to Heartbleed, the OpenSSL vulnerability.
The unrelated incidents follow TiDB Cloud’s breach announcement on Monday, October 19, active exploitation of 4 patched Plex Media Server flaws collectively called Plex2Shell, and BeyondTrust’s warning last week about a critical Remote Support zero-day exploited since August. Their rapid succession strains security teams, while AI could help attackers exploit newly discovered vulnerabilities faster.
Positives
- The NSA issued immediate guidance for PHP users to update affected systems or disconnect them until remediation was possible.
- Node.js patched 4 high-severity vulnerabilities in its latest release, including remote code execution and TLS validation bypass flaws.
- LiteLLM removed the malicious releases and container images from PyPI, Docker Hub and GHCR.
- LiteLLM published remediation guidance for users who installed the compromised releases or images.
- The 4 Plex Media Server flaws grouped as Plex2Shell had already received patches before attackers began exploiting them.
Risks & concerns
- Government websites worldwide went offline after AI discovered critical vulnerabilities affecting PHP.
- LiteLLM’s compromised packages contained an information stealer and remote access trojan targeting credentials and enabling command execution.
- eMudhra’s compromised private keys could support fraudulent certificates and impersonation of legitimate websites.
- BeyondTrust’s critical Remote Support zero-day had been exploited since August before last week’s patch warning.
- TiDB Cloud’s breach and active Plex2Shell exploitation added to several unrelated security emergencies arriving in rapid succession.
- AI could shorten the time attackers need to exploit vulnerabilities after discovery.