eMudhra key weakness and PHP flaws trigger security action

Apple, Google and Mozilla blocked affected certificates from Indian certificate authority eMudhra, while the PHP Foundation issued an emergency update on October 21 to address two reported critical vulnerabilities. India Today’s October 22 report described the actions alongside separate security incidents involving cloud platforms, developer software and AI tools.

The eMudhra case concerns the trust infrastructure used to authenticate websites. The company said only one of eight affected intermediate certificates had entered production and none had been used to issue certificates for individual websites—a material qualification to the potential impersonation risk.

eMudhra keys put certificate safeguards under scrutiny

According to the report, a security researcher identified as Wayne alerted technology companies on October 17 that private keys associated with eight eMudhra intermediate certificates were exceptionally weak. The keys reportedly consisted of single-byte values, leaving only 256 possibilities, and were recovered in less than a second.

Intermediate certificates help establish the chain of trust between certificate authorities and websites. Access to their private keys could potentially enable fraudulent certificates and website impersonation; the report did not establish that such impersonation had occurred.

Alongside the browser blocks in Safari, Chrome and Firefox, Cloudflare reportedly deployed emergency protections. CERT-In also issued an advisory, and users were advised to update their browsers and operating systems.

PHP and NodeJS issue security fixes

The report described two PHP vulnerabilities, collectively labelled PHP2Shell, that could allow an unauthenticated attacker to take control of affected web servers. It attributed a severity rating of 9.2 out of 10 to the PHP Foundation and said an emergency patch was released on October 21.

It also reported that the US National Security Agency and FBI urged organisations to update immediately or temporarily take affected systems offline if mitigation was not possible. Government websites in Finland and the Netherlands reportedly went offline as a precaution, rather than as confirmed victims of an attack.

Separately, NodeJS released fixes on October 21 for four high-severity vulnerabilities. The reported risks included remote code execution and weaknesses in TLS certificate checks that could undermine verification of a server’s identity. Users were urged to update supported releases or migrate from older versions. The updates also incorporated blocks on affected eMudhra certificates.

LiteLLM and Railway warn of risks to credentials

LiteLLM, an open-source tool that routes requests to different large language model providers, reportedly distributed compromised releases containing code capable of stealing system information, browser data, developer secrets and cloud credentials.

The report cited security company Wiz as saying the malware used Python startup hooks. That mechanism meant an unrelated Python command could activate it without an application directly importing LiteLLM. LiteLLM said it had removed the malicious releases and images and directed affected users to its remediation guidance.

Cloud platform Railway, meanwhile, said it detected unusual activity involving systems holding customer environment variables on October 21. Its investigation indicated that an unauthorised party may have obtained decrypted contents from some of those variables, which can hold credentials and API keys.

Railway’s initial assessment suggested a subset of users might be affected. Nevertheless, it recommended that all customers rotate environment variables, API keys and private registry credentials stored on the platform, and inspect service logs. Its suggestion that the incident formed part of attacks aimed at AI inference providers remained the company’s assessment.

Microsoft describes attacks through a trusted cloud connection

The report also cited Microsoft’s account of a campaign attributed to Storm-0940, a group Microsoft describes as China-linked. Microsoft said the attackers used ARTEX, an AI-enabled penetration-testing framework, to automate activity through ConnectWise Cloud Backup.

According to that account, attackers abused trusted digital keys used to connect the service to Microsoft 365, avoiding conventional login screens. The campaign reportedly generated 2,900 sign-in attempts a minute and reached more than 2,250 company systems. Those figures describe reported activity and reach, not a confirmed count of organisations whose data was stolen.

Organisations that use or previously used ConnectWise Cloud Backup were advised to leave connections disabled pending official instructions and examine Microsoft 365 logs for unusual sign-ins or administrator roles. The guidance favoured disabling affected applications rather than deleting them, preserving evidence for investigation.