Critical security vulnerabilities discovered in PHP and Node.js prompted emergency software updates and temporary website shutdowns worldwide on October 21, 2026. Government agencies and cybersecurity organizations warned that attackers could exploit the flaws to execute malicious code, bypass security checks, and access sensitive information.
The incidents coincided with separate security breaches involving AI software provider LiteLLM and Indian certificate authority eMudhra. The US National Security Agency (NSA) advised organizations using vulnerable PHP installations to update immediately or take affected systems offline until they could be secured.
AI-Discovered PHP Vulnerabilities Force Websites Offline
Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without authentication. Both received a severity score of 9.2 under the Common Vulnerability Scoring System.
The vulnerabilities were discovered using AI-assisted security research and affected PHP, a programming language widely used in website development. PHP developers released security updates on October 21 to address the flaws.
Government websites across several countries were temporarily taken offline as administrators addressed the risks. The NSA advisory warned that organizations unable to install updates should disconnect affected systems until mitigation measures were available.
Node.js Patches Remote Code Execution and TLS Flaws
Node.js released security updates on the same day addressing four high-severity vulnerabilities, including a flaw that could permit remote code execution. Two other vulnerabilities could allow attackers to bypass Transport Layer Security (TLS) certificate validation, potentially weakening checks used to verify server identities.
The fixes were released for Node.js versions 22, 24, and 26. Developers were advised to update affected installations to prevent exploitation of the identified weaknesses.
LiteLLM Supply Chain Attack Exposes Credentials
AI software provider LiteLLM also confirmed that attackers had inserted malicious code into version 1.107.0 of its open-source software. The compromised release appeared on Python Package Index (PyPI), Docker Hub, and GitHub Container Registry.
According to LiteLLM’s security disclosure, the malicious code included an information stealer targeting cloud credentials, passwords, and AI service credentials. A separate remote access component could allow attackers to execute commands on compromised systems.
LiteLLM removed the affected releases and advised users who installed them to follow its remediation guidance. The company also revoked compromised developer credentials after identifying unauthorized changes to its release pipeline.
eMudhra Certificate Breach Prompts Security Response
Indian certificate authority eMudhra disclosed that private keys associated with eight intermediate digital certificates had been compromised. The weakness could allow attackers to create fraudulent certificates and impersonate legitimate websites.
According to Google’s security disclosure, the affected keys were generated with insufficient randomness, making them vulnerable to forgery. Google subsequently blocked trust in the compromised certificates to protect Chrome users.
The incidents followed other security problems involving TiDB Cloud, actively exploited Plex Media Server vulnerabilities known as Plex2Shell, and a critical BeyondTrust Remote Support flaw. The companies involved issued security advisories and updates addressing their respective incidents.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.