The internet is having a very bad cybersecurity day
- ID
- 37987
- Status
- summarized
- Published
- 22 Oct 2026, 3:03 AM
- Fetched
- 22 Oct 2026, 3:09 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 8.5
- Created
- 22 Oct 2026, 3:10 AM
- Tags
- Audience
- developersvibe_codersai_ml_learnersai_agent_userssaas_startup_founders
What happened
TechCrunch rounds up several security incidents on October 21, 2026: government websites went offline after AI discovered critical PHP vulnerabilities, prompting NSA advice to update PHP systems or take them offline; Node.js patched four high-severity flaws, including remote code execution and TLS validation bypasses; and LiteLLM had malicious releases/images published to PyPI, Docker Hub, and GHCR that stole cloud, password, and AI service credentials and included a remote access trojan. Separately, Indian certificate authority eMudhra had private keys compromised, potentially enabling fraudulent certificates and website impersonation, with one security pro calling the cleanup 'bigger than Heartbleed.'
Why it matters
PHP users should update immediately or take systems offline per the NSA advice; Node.js users should move to the release containing the four patches; and anyone who installed the affected LiteLLM artifacts should follow its remediation guidance and rotate cloud, password, and AI-provider credentials because the malware targeted those. The eMudhra key compromise is a certificate-trust cleanup issue, not just a vendor incident.
Discussion angle
LiteLLM is the AI-specific supply-chain hit: how should teams pin and verify packages, and limit blast radius for AI-provider keys when PyPI, Docker Hub, and GHCR artifacts can be poisoned?