--- title: The internet is having a very bad cybersecurity day description: Multiple cybersecurity incidents hit around the same time. AI discovered critical PHP vulnerabilities, and the NSA advised organizations to patch immediately... canonical: https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The internet is having a very bad cybersecurity day | daily.dev og:description: Multiple cybersecurity incidents hit around the same time. AI discovered critical PHP vulnerabilities, and the NSA advised organizations to patch immediately... og:url: https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk og:image: https://api.daily.dev/og/posts/l2S5qexYk.png og:image:alt: The internet is having a very bad cybersecurity day og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The internet is having a very bad cybersecurity day **[TechCrunch](https://daily.dev/sources/tc)** · 3 min read · 0 upvotes · 0 comments ## Summary Multiple cybersecurity incidents hit around the same time. AI discovered critical PHP vulnerabilities, and the NSA advised organizations to patch immediately or take systems offline, while government websites went offline. Node.js patched four high-severity flaws, including one remote code execution bug and two TLS validation bypasses. LiteLLM was compromised with malicious packages pushed to PyPI, Docker Hub, and GHCR containing an infostealer and remote access trojan. Indian certificate authority eMudhra had private keys compromised, and security pros said the cleanup job was 'bigger than Heartbleed'. TiDB Cloud disclosed a breach, Plex Media Server flaws were being exploited, and BeyondTrust warned customers to patch a zero-day. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities were just patched in Node.js's October security release? Node.js patched four high-severity vulnerabilities in its October 2026 security release. One allowed remote code execution, and two others permitted a TLS validation bypass that could let attackers bypass checks meant to verify a server's identity. The flaws were disclosed in an official Node.js security advisory. _Teams rolling out Node.js patches can track fast-moving runtime security releases on daily.dev._ ### What happened in the LiteLLM supply chain attack? An attacker compromised LiteLLM, a popular open source proxy for routing requests to multiple LLM providers, and injected malicious code into releases published to PyPI, Docker Hub, and GitHub Container Registry. The malicious code included an information stealer targeting cloud credentials, passwords, and AI service credentials, plus a remote access trojan. LiteLLM removed the malicious releases and published remediation guidance. _Anyone depending on LiteLLM or similar AI infrastructure can follow supply chain incidents like this on daily.dev._ ### Why is the eMudhra certificate authority breach being compared to Heartbleed? Indian certificate authority eMudhra had its private keys compromised, potentially letting attackers issue fraudulent certificates and impersonate legitimate websites. Security professionals called the resulting cleanup effort bigger than Heartbleed, the critical 2014-era OpenSSL vulnerability, because of the scale of trust revocation and certificate reissuance required across the internet. _Engineers assessing TLS trust chain risks can follow CA compromise fallout as it develops on daily.dev._ ## Similar posts on daily.dev - [When One Vulnerability Breaks the Internet and Millions of Devices Join In](https://daily.dev/posts/when-one-vulnerability-breaks-the-internet-and-millions-of-devices-join-in-rmhnf223x) · Security Boulevard · 0 upvotes · 0 comments - [Security patches need patches now that attackers have AI](https://daily.dev/posts/security-patches-need-patches-now-that-attackers-have-ai-jxjf652el) · The Register · 2 upvotes · 0 comments - [This Week In Security: The Supply Chain Has Problems](https://daily.dev/posts/this-week-in-security-the-supply-chain-has-problems-e5yi4rj1g) · Hackaday · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#php](https://daily.dev/tags/php), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The internet is having a very bad cybersecurity day","url":"https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk"},"datePublished":"2026-10-21T19:06:23.838Z","dateModified":"2026-10-23T04:54:19.345Z","description":"Multiple cybersecurity incidents hit around the same time. AI discovered critical PHP vulnerabilities, and the NSA advised organizations to patch immediately...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a51480df04c25a63526cd6507cb9fe2e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a51480df04c25a63526cd6507cb9fe2e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,nodejs,php,litellm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"The internet is having a very bad cybersecurity day"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-internet-is-having-a-very-bad-cybersecurity-day-l2s5qexyk#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities were just patched in Node.js's October security release?","acceptedAnswer":{"@type":"Answer","text":"Node.js patched four high-severity vulnerabilities in its October 2026 security release. One allowed remote code execution, and two others permitted a TLS validation bypass that could let attackers bypass checks meant to verify a server's identity. The flaws were disclosed in an official Node.js security advisory. Teams rolling out Node.js patches can track fast-moving runtime security releases on daily.dev."}},{"@type":"Question","name":"What happened in the LiteLLM supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"An attacker compromised LiteLLM, a popular open source proxy for routing requests to multiple LLM providers, and injected malicious code into releases published to PyPI, Docker Hub, and GitHub Container Registry. The malicious code included an information stealer targeting cloud credentials, passwords, and AI service credentials, plus a remote access trojan. LiteLLM removed the malicious releases and published remediation guidance. Anyone depending on LiteLLM or similar AI infrastructure can follow supply chain incidents like this on daily.dev."}},{"@type":"Question","name":"Why is the eMudhra certificate authority breach being compared to Heartbleed?","acceptedAnswer":{"@type":"Answer","text":"Indian certificate authority eMudhra had its private keys compromised, potentially letting attackers issue fraudulent certificates and impersonate legitimate websites. Security professionals called the resulting cleanup effort bigger than Heartbleed, the critical 2014-era OpenSSL vulnerability, because of the scale of trust revocation and certificate reissuance required across the internet. Engineers assessing TLS trust chain risks can follow CA compromise fallout as it develops on daily.dev."}}]} ```