@xbquan: In less than 24 hours, four major bombshells hit the internet one after another. @grok Have we entered an era of extreme cyber insecurity?! This little furball has picked the four most serious incidents and put them in chronological order 1. 10/21 22:04 | A high-risk vulnerability that lurked in PHP for 14 years About 70% of websites worldwide run on PHP. Two vulnerabilities…
Four major cybersecurity incidents came to light in less than 24 hours: a high-severity remote code execution vulnerability that had remained hidden in PHP for 14 years (discovered using AI in an OpenAI-led effort, with a patch already released); Node.js fixing 10 vulnerabilities at once; Indian certificate authority eMudhra having its weakly generated private keys cracked, threatening the HTTPS chain of trust; and a breach of cloud platform Railway that may have exposed all customer API keys.
In less than 24 hours, four major security bombshells hit the internet. @grok Have we entered an era of wildly insecure internet?!
This little furball has picked the four most serious incidents and lined them up chronologically:
1. 10/21 22:04 | High-risk vulnerabilities hidden in PHP for 14 years
Around 70% of websites worldwide run on PHP.
Two vulnerabilities let hackers remotely take control of servers without logging in, with a severity score of 9.2.
This discovery was led by OpenAI, with researchers using AI to uncover the flaws. PHP maintainers wrote the patches, which were released by 22:00.
But details leaked early, and Cloudflare has already seen attackers exploiting them.
Even worse: PHP 8.1 and older versions are no longer officially supported, leaving those websites completely exposed.
2. 10/21 23:31 | Node.js fixes 10 vulnerabilities in one go
A huge number of websites, microservices, and many AI agent tools are built on Node.js.
The most serious flaw is in the decompression module and also allows remote code execution. OpenAI helped discover this one too.
If you use Node.js, upgrade immediately!
3. 10/21 23:39 | Indian certificate authority eMudhra’s private keys were mathematically recovered
That little padlock in your browser relies on guarantees from certificate authorities like this one.
eMudhra had eight intermediate certificates whose private keys were generated so weakly that security researchers were able to calculate them directly.
With those private keys, attackers can forge “legitimate” certificates for any website, rendering the HTTPS padlock meaningless!!!
Chrome, Firefox, Apple, and Microsoft have already issued emergency blocks. Make sure your browser and operating system are up to date.
4. 10/22 05:11 | Cloud platform Railway hacked; potentially all customer secrets exposed
Railway is a cloud platform many developers use to deploy their projects.
Someone broke into the system that stores secrets. Customers’ Stripe, Anthropic, OpenAI, and other keys stored there may already have leaked, and some people have received exposure alerts.
The platform urgently suspended all builds and deployments and told everyone to rotate their keys immediately.
The problem is, with deployments suspended, many apps can’t be redeployed even if their developers want to change the keys.
Four incidents, four layers:
The website engine, the application foundation, the HTTPS chain of trust, and the keys stored in the cloud.
Almost overnight, every one of them took a hit.
A tweet lamenting that today was the worst day in the history of internet security: PHP dropped two critical vulnerabilities on the same day, allowing attackers to execute code remotely without logging in, and details leaked before patches were even released, affecting major systems such as WordPress, MediaWiki, Magento, Joomla, and Laravel. The author faithfully translated the original post into Chinese, preserving its style.
Retweeting Takaichi's urgent call about two critical security vulnerabilities in PHP, reminding website operators that widely use PHP to take immediate action tonight.
Two severe vulnerabilities disclosed in PHP affect nearly 20 years of versions, knocking major sites like Wikipedia, WordPress-backed platforms, Internet Archive, and Cloudflare-protected services offline and forcing some old Japanese mobile games to permanently shut down.