What a brutal day today... Major vulns people are struggling to fix right now - PHP2Shell allows unauthenticated remote code execution on affected PHP servers. CISA is advising organizations to patch or take affected systems offline (this is absolutely nuts, basically the majority of websites w/known server-side language ~70% are being told to immediately upgrade or shut down). There’s also a disclosure controversy: Chainguard co-founder Dan Lorenc released patched builds over six hours early. The PHP Foundation says that exposed the fix for attackers to study and Dan says existing leaks and reports of active exploitation justified making the builds available to everyone. - Node.js just patched ten vulnerabilities, including remote code execution through its Brotli decoder and separate TLS validation bypasses. There are so many codebases built on Node that a lot of teams now need to check whether they’re affected - One of eMudhra’s (an Indian certificate authority whose certificates are trusted by browsers) certificate authority private keys was literally 4. Eight keys were trivially recoverable since April 2025. - GitLab also recently patched a 10/10 vulnerability allowing unauthenticated code execution. Researchers dream of scoring a 10/10 CVSS score, and this one was on a version control system running half of all F100s. Major exploits and breaches - LiteLLM is a widely used library for connecting applications to AI models. Its 1.107.0 release on PyPI was compromised and shipped with a credential stealer and a backdoor. People installing what looked like a normal update were downloading malware. - Railway disclosed that attackers may have accessed customer environment variables and decrypted some of them, potentially exposing API keys and database passwords. They’re asking all users to rotate stored secrets. - OpenCode disclosed a breach affecting 1.4% of Console users a few days ago, tied to what it describes as a large-scale distillation attack. I’d just started using OpenCode, so this one hit a little to close to home. - State Bank of India confirmed that personal and loan data belonging to 3,897 customers surfaced on the dark web. - PHP2Shell is already being targeted too. AWS observed exploitation attempts dating back to October 17. Also the CEO of Cloudflare said they've seen it be attempted millions of times within several hours of the release. I mean serious what the fuq...