Security news.
Critical software supply chain compromises and active zero-day exploitations dominate today's security landscape, highlighted by an ongoing attack on the LiteLLM pipeline and pre-patch exploitation of core PHP vulnerabilities. Infrastructure security also faces high scrutiny following the compromise of intermediate certificate authority keys and new remote code execution flaws affecting enterprise edge devices, Linux servers, and development platforms. Security teams are urged to immediately audit dependencies, rotate exposed secrets, and apply the latest security patches.
LiteLLM Pipeline Hacked to Distribute Info-Stealer Malware
Attackers compromised the LiteLLM release pipeline via suspected leaked GitHub tokens, pushing malicious PyPI packages and Docker images designed to steal credentials and environment variables.
PHP 'PHP2Shell' Exploitation Began Days Before Official Patches
Threat actors began actively exploiting critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619) in core PHP four days before upstream security fixes were released.
Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Arista Networks deployed urgent updates addressing an actively exploited zero-day vulnerability affecting on-premises deployments of VeloCloud Orchestrator.
eMudhra Exits Global TLS Business After 8 Intermediate CA Keys Compromised
Indian CA eMudhra will withdraw from public SSL/TLS issuance after researchers successfully recovered eight easily guessable intermediate CA private keys, leading major vendors to block the certificates.
GitLab Issues Fix for Maximum-Severity Remote Code Execution Bug
GitLab released security patches remediating a critical Regular Expression Compiler vulnerability that allows unauthenticated remote attackers to execute arbitrary code on vulnerable instances.
Unpatched Linux KSMBD RCE Flaws Disclosed on Public Lists
Two unpatched CVSS 9.0 vulnerabilities affecting the in-kernel SMB server KSMBD were publicly published, including a pre-authentication flaw (ZDI-CAN-33774) and an RDMA-specific bug.
Node.js Fixes High-Impact Brotli Remote Code Execution Vulnerability
Security updates across Node.js versions 22.x, 24.x, and 26.x resolve 10 security bugs, spearheaded by an arbitrary code execution flaw in the bundled Brotli decompression library.
Railway Discloses Intrusion and Urges Environment Secret Rotation
PaaS provider Railway warned of unauthorized third-party access to customer environment variable stores, advising impacted developers to rotate potentially decrypted secrets immediately.