php2Shell, LiteLLM supply-chain hijack and a CVSS 10.0 GitLab bug cap 'cybersecurity's most serious 48 hours'
alishbaimran_ · x · 2026-10-23
A viral post rounds up what's being called the most serious 48 hours in cybersecurity history:
- php2Shell: reportedly leaves 70% of the internet vulnerable; NSA advising some US companies to take production systems offline
- eMudhra: the Indian root CA relied on weak cryptographic keys (one was literally the number 4), enabling man-in-the-middle attacks on any website
- LiteLLM: release pipeline hijacked; v1.107.0 distributed malware — attackers stole inference API keys and installed RCE backdoors
- Railway: exposed customer environment variables like cloud credentials and inference keys, part of an alleged model-distillation attack targeting labs' inference output
- GitLab: disclosed a CVSS 10.0 vulnerability enabling arbitrary code execution on every version since 2014
- JPMorgan, Bank of America, Wells Fargo and Morgan Stanley reportedly taking emergency action
More from Infra
- TokenGate e2e-learns to drop tokens on the fly, opening a new frontier for LLM prefill — CShorten30 · 2026-10-23
- $126B could carpet the entire 494-mile California high-speed rail route in $100 bills — john__allard · 2026-10-23
- TTR-Compressor: test-time regression with closed-form solutions beats pooling for sequence compression — SphereLab · 2026-10-23
- Dragonfly files CFTC comment letter urging standardized compute derivatives markets — AccBalanced · 2026-10-23
- Liquid Inference launches token Reservations: lock in fixed prices for 1-12 months with competing providers — AccBalanced · 2026-10-23
- MiniMax H3 video generation launches on Japan's ai& platform from $0.0125/second — DavidBennett__ · 2026-10-23