"Whoa, 5 major security alerts in just 24 hours—this is absolutely wild! PHP, Node.js, Railway, LiteLLM all triggered alarms one after another. From website backends, server runtime environments, cloud deployment platforms, to AI tool supply chains—issues popped up at nearly every layer. Some vulnerabilities don’t even require a username or password and could allow attackers to remotely execute code. Here’s a roundup of the October 21 outbreak: ① **PHP2Shell**: PHP exposed two severe CVSS 9.2 vulnerabilities (CVE-2026-109618, 109619). Attackers could potentially control affected servers without logging in. PHP is widely used in platforms like WordPress. The official team has urgently released patched versions. ② **Node.js TLS certificate validation vulnerability**: Writing IP addresses in full-width characters or other special formats could bypass hostname verification. It’s like a security guard mistaking a fake ID for a real one, allowing untrusted connections to pass. ③ **Node.js Brotli vulnerability**: Handling malicious compressed data could lead to out-of-bounds memory writes, which in severe cases could be exploited for remote code execution. Node.js has urgently released security updates: 22.23.4, 24.22.1, and 26.12.1. ④ **Railway hacked**: This cloud platform, widely used by developers to deploy websites and AI services, discovered attackers might have accessed customer environment variables. Some encrypted data might even have been decrypted. This could include database passwords, cloud service credentials, and AI API keys. Railway is urging users to rotate their keys immediately and has paused deployments during the investigation. ⑤ **LiteLLM supply chain attack**: This popular component for unified calls to OpenAI, Anthropic, and other models had its 1.107.0 version injected with malicious code to steal credentials and load remote code. Attackers manipulated the release process using stolen developer credentials. The malicious PyPI package was live for about 104 minutes, while the Docker image was affected for a longer period. The affected versions have been pulled by the official team. In the AI era, I feel like this level of security risk is just the beginning! #CyberSecurity #TechNews #AI #PHP #NodeJS #Railway #LiteLLM #SupplyChainAttack #DevOps #CloudComputing #AItools