eMudhra and PHP not alone, last 24 hours have been absolute cybersecurity chaos for internet

A lot has happened in cybersecurity in the past 24 hours. From eMudhra's weak security keys to ChatGPT finding critical flaws in PHP. India Today Tech has the full rundown.

In Short

• PHP flaws expose 70% of all websites
• eMudhra’s weak security keys put internet on alert
• Other cases involve NodeJS, LiteLLM, Chinese hacking groups

The past 24 hours have been quite busy for the cybersecurity world. The PHP Foundation, which maintains the programming language that powers millions of websites, announced an urgent security update to fix two critical flaws. At the same time, India’s eMudhra was found to have used shockingly weak security keys for issuing certificates for websites.

There have been several more incidents, big and small, making you sit up and notice and ask, what in the world is going on? Government websites have gone offline, data is believed to be at risk, and some platforms have faced cyberattacks. All this and more is happening in the month that is designated as the cybersecurity awareness month of all things. There’s a lot to take in. Here’s a quick rundown of all the biggest headlines.

PHP flaws prompt NSA and FBI warnings

The biggest concern as we speak might be with PHP. Two critical vulnerabilities in PHP, collectively called PHP2Shell, could allow attackers to take control of affected web servers without needing any authentication. Web tracker W3Tech estimates that around 70 per cent of websites use PHP, making it a highly critical issue. The PHP Foundation itself rated the vulnerabilities 9.2 on a scale of 10.

This has led to governments taking notice. The US National Security Agency (NSA) and the FBI have advised organisations to install the latest security update immediately, or take down platforms. “If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” the advisory said.

The vulnerabilities were believed to have gone unnoticed for a decade before OpenAI’s AI model GPT-5.6 Sol found them. While the PHP Foundation issued an emergency security update on October 21, government websites in many countries including Finland and the Netherlands went offline as part of precautionary measures.

eMudhra uses weak security keys

Indian certificate authority eMudhra was found to be using extremely weak private keys for issuing intermediate certificates. Digital certificates act as a website's identity card and support the padlock displayed by browsers to indicate that a connection is secure. Compromised keys could allow attackers to issue fraudulent certificates and impersonate legitimate websites.

A security researcher named Wayne alerted technology companies on October 17. To demonstrate that he had cracked the keys, he created emudhra.we-have-a-problem.com and published a digitally signed message that read: “We have a problem here – Wayne.”

A secure private key would usually contain about 384 bits of complex randomness, producing a 116-digit number that would be impractical for a computer to guess. The compromised eMudhra keys were just single-byte numbers: 4, 56, 66, 115, 155, 156, 230 and 237. Since a single byte can represent only 256 possible values, researchers were able to recover all eight keys in less than a second.

However, companies acted promptly after this came into light. Apple, Google and Mozilla had blocked the certificates in Safari, Chrome and Firefox. Meanwhile Cloudflare deployed emergency fixes across its network.

eMudhra also stated that only one of the eight affected certificates had been deployed in production. None of the certificates were used to issue certificates for individual websites. The CERT-In has also issued an advisory on the incident. Users are advised to update their browser and operating systems to the latest version.

NodeJS fixes critical vulnerabilities

Moving beyond eMudhra, NodeJS, the open-source project that allows you to run JavaScript outside browsers, had its own cybersecurity issues. On Wednesday, NodeJS released security updates that fixed four high-severity vulnerabilities. One of which could allow hackers to remotely run code on systems. While two, that affected TLS certificate, could’ve let an attacker bypass checks intended to verify a server’s identity.

NodeJS users were advised to update promptly for all supported versions. Those on older releases were urged to move to newer versions. The updates also introduced a new certificate store that blocks eMudhra and a list of blocked intermediate certificates.

LiteLLM gets compromised

LiteLLM, an open-source proxy used to route requests to multiple large language model (LLM) providers, was compromised. An attacker injected malicious code in LiteLLM that could allow it to steal system information, browser data, developer secrets, cloud credentials and authentication files used by AI tools.

According to Wiz, the malware used Python startup hooks rather than waiting for an application to import LiteLLM. That is, an unrelated Python command could trigger the malware even if LiteLLM was never opened directly.

LiteLLM said it had removed the malicious releases and images. It advised users who installed them to follow its remediation guidance. This was LiteLLM's second reported cyber incident of the year. The platform also found its systems compromised in March this year.

Railway investigates possible access to customer info

There is more though. Cloud platform Railway said on Wednesday that it had detected anomalous activity involving systems that stored customer environment variables. Its investigation indicated that an unauthorised third party may have obtained the decrypted contents of some of them.

Environment variables can contain sensitive data such as credentials, customer database, and application programming interface keys. Railway said it believed the incident was part of a series of attacks targeting platform companies in an effort to compromise AI inference providers.

The company’s initial assessment suggested that the impact could be limited to a subset of users. However, it recommended that all customers immediately rotate every environment variable and API key stored on the platform, along with private registry credentials, and review service logs for unusual activity.

Microsoft details AI-assisted ConnectWise campaign

At the same time, cyberattacks seem to be increasing, thanks to AI. Microsoft has warned that a China-linked hacking group it tracks as Storm-0940 had used an AI-powered tool to target hundreds of companies worldwide. The campaign gave the attackers deep access to some cloud networks in less than three hours.

Storm-0940 used ARTEX, an open-source penetration-testing framework normally used by security professionals, to automate cyberattacks. The hackers targeted ConnectWise, an IT services company, through its Cloud Backup service rather than attacking customers directly.

The attackers abused trusted digital keys already used by ConnectWise to connect to Microsoft 365 accounts, allowing them to bypass standard login screens. The tool generated 2,900 sign-in attempts a minute and reached more than 2,250 company systems.
The targets included organisations in aerospace, defence, automotive, chemicals, energy, financial services, government, legal services, manufacturing, media, the military, semiconductors, software, technology, think tanks and the non-profit sector.

Companies that use or previously used ConnectWise Cloud Backup were advised to keep connections disabled until official instructions were issued. IT teams were also urged to examine Microsoft 365 security logs for unusual sign-ins and unauthorised administrator roles. Rather than deleting affected applications, organisations were advised to disable them so that evidence needed for an investigation could be preserved.

These incidents do not appear to be in isolation. The past few days have been quite severe for anyone in the cybersecurity industry. The State Bank of India (SBI) also confirmed that a cyberattack had left nearly 3,900 customer records exposed. Previously, CERT-In disclosed that AI agents had managed to breach records of Indian organisations too.

- Ends