Yesterday, 21 October, the Internet was having a bad day, from a cybersecurity perspective. Government websites around the world went offline, Reuters reported, after AI discovered critical security vulnerabilities that impacted the programming language PHP. The issues were severe enough that the US National Security Agency (NSA) advised organizations using PHP on their systems to either immediately update or take their systems offline until they could.[1]
But the PHP update wasn’t the only headache cybersecurity folks were facing on the 21st. Node.js, the open-source JavaScript runtime environment, also dropped a security surprise of its own when it shared that four high-severity vulnerabilities were just patched in its latest release. One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server’s identity.
In addition, LiteLLM, a popular open-source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code, the company shared in a post on X on October 21st afternoon. The malicious artifacts were published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry), the post noted.
The malicious code was said to include an information stealer that targeted cloud credentials, passwords, and AI service credentials, in addition to a remote access trojan that could allow hackers to execute commands on compromised systems.
LiteLLM said it has now removed the malicious releases and images and advised anyone who installed them to follow the remediation guidance it provided. And wait, there’s more! An Indian certificate authority, eMudhra, had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security pros have called this a massive cleanup job and one that’s “bigger than Heartbleed.” (The latter is a reference to the critical security vulnerability in the OpenSSL cryptographic software library).
These issues come on the heels of other security breaches and hacks, including the breach of the cloud-native database-as-a-service, TiDB Cloud, which the company announced on the 20th Other hackers have been exploiting four patched Plex Media Server flaws, collectively called Plex2Shell. And last week, cybersecurity company BeyondTrust warned customers to patch a critical zero-day in its Remote Support product, which had been exploited since August.
Though the issues were unrelated to each other, their back-to-back arrival highlights the challenges cybersecurity teams now face. This is particularly important as AI could make it easier for attackers to exploit vulnerabilities once discovered.
This article used AI to craft the contents and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/
Comments