PHP Flaws, Node.js Vulnerabilities, and a Compromised AI Tool Cap a Rough Cybersecurity Day

Cybersecurity teams faced a wave of simultaneous security crises on Wednesday, October 21, 2026, as critical vulnerabilities and active compromises hit widely used software platforms in quick succession.

The most disruptive incident involved the programming language PHP, where AI-discovered vulnerabilities were severe enough to take government websites offline around the world, according to Reuters. The U.S. National Security Agency advised organizations running PHP to either apply updates immediately or take affected systems offline until they could.

Separately, Node.js disclosed that four high-severity vulnerabilities had been patched in its latest release. One flaw allowed remote code execution, while two others enabled a TLS validation bypass — a technique that could allow attackers to impersonate legitimate servers by circumventing identity verification checks.

Also on Wednesday, LiteLLM — a widely used open-source proxy for routing requests to multiple AI model providers — announced via X that an attacker had injected malicious code into its software. The compromised packages were published to PyPI, Docker Hub, and GitHub Container Registry. The malicious code included an information stealer targeting cloud credentials, passwords, and AI service credentials, as well as a remote access trojan capable of executing commands on compromised systems. LiteLLM said it has since removed the malicious releases and published remediation guidance.

In a fourth incident, Indian certificate authority eMudhra had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security professionals described the fallout as a massive cleanup effort and “bigger than Heartbleed,” a reference to the critical 2014 OpenSSL vulnerability.

These events follow other recent breaches, including a compromise of TiDB Cloud announced Monday, active exploitation of four patched Plex Media Server flaws known as Plex2Shell, and a critical zero-day in BeyondTrust’s Remote Support product that had been exploited since August.

While the incidents are unrelated, their near-simultaneous emergence underscores the mounting pressure on cybersecurity teams — a challenge that may intensify as AI tools could make it easier for attackers to exploit newly discovered vulnerabilities.