A cluster of separate cybersecurity disclosures over about 24 hours prompted patches, browser blocks, and investigations. India’s CERT-In warned of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers run code on vulnerable servers; developers released updates with no complete alternative mitigation. CERT-In also flagged compromised private keys for eight eMudhra intermediate certificates generated with insufficient randomness; Google and Mozilla blocked them, and eMudhra revoked them, saying they were not used for end-user certificates and its infrastructure was not breached. Node.js issued patches covering certificate verification, remote code execution, and related changes. LiteLLM disclosed that malicious credential-stealing code was inserted into version 1.107.0 on PyPI and container repos; the releases were withdrawn.
A cluster of separate cybersecurity disclosures over about 24 hours prompted patches, browser blocks, and investigations. India’s CERT-In warned of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers run code on vulnerable servers; developers released updates with no complete alternative mitigation. CERT-In also flagged compromised private keys for eight eMudhra intermediate certificates generated with insufficient randomness; Google and Mozilla blocked them, and eMudhra revoked them, saying they were not used for end-user certificates and its infrastructure was not breached. Node.js issued patches covering certificate verification, remote code execution, and related changes. LiteLLM disclosed that malicious credential-stealing code was inserted into version 1.107.0 on PyPI and container repos; the releases were withdrawn.