ATHena

Today feels like a global cybersecurity crisis, and we still don’t know the full impact. Everyone should be paying attention. Governments across Europe took websites offline. Cloud platforms warned of exposed credentials. Malware was found in software downloaded from trusted sources. Several major incidents have come to light within days of each other, with consequences that could reach far beyond the companies involved. I’ve put together the biggest disclosures, who could be affected, and what I’d do right now as an individual, crypto user or company 👇 PHP2Shell: websites and web apps. Two vulnerabilities could let attackers take over vulnerable PHP servers without logging in, including sites built with WordPress, Drupal and other tools. Finland, the Netherlands and France took services offline as a precaution. Emergency patches are available. Website owners need to update PHP itself. Updating plugins alone won’t fix it. PHP advisory Node.js: applications and backend services. Node.js confirmed a vulnerability in its Brotli decompression feature that can allow remote code execution. It affects unpatched versions in the 22.x, 24.x and 26.x release lines. The security release also fixes certificate-validation bypasses and other flaws. Companies need to check the Node.js runtime actually running their services. Updating application packages alone won’t update the runtime. Node.js advisory GitLab: source code and software delivery. A critical vulnerability rated 10/10 could allow attackers to execute code on vulnerable GitLab servers without logging in. That creates a serious risk for systems holding repositories and deployment credentials. Gitlab is already patched. Companies running their own GitLab installations need to update immediately. GitLab advisory eMudhra: the certificates used to trust websites. Eight intermediate CA certificates were issued with dangerously weak private keys, creating a risk of forged certificates. Browser vendors introduced protections. Servers and applications also need the relevant trust-store and runtime updates. LiteLLM + OVHcloud: malware in trusted downloads. LiteLLM version 1.107.0 and affected container images, alongside replaced OVHcloud CLI downloads, contained credential-stealing malware. Developers’ machines often hold access to databases, cloud accounts and production systems. Anyone who ran affected software needs to investigate that access and revoke exposed credentials. Follow the vendor’s recovery instructions before attempting an upgrade on a compromised environment. LiteLLM specifically warns that running pip can trigger the malware again. LiteLLM disclosure Railway, Zeabur, OpenCode: cloud secrets and API keys. Railway warned of possible access to customer secrets, including some decrypted values, and recommended that all users rotate stored secrets as a precaution. Zeabur disclosed an infrastructure breach. Some OpenCode Console users had external provider API keys exposed. Changing your password won’t revoke a stolen API key. Railway disclosure ConnectWise/SkyKick: Microsoft 365 access. Attackers compromised application credentials and used trusted integrations to attempt access to customer environments. Microsoft reported attempts involving more than 2,250 tenants. That’s a targeting figure, not a confirmed victim count. Microsoft investigation PingCAP / TiDB Cloud: internal data stolen. Exposed information included source code, account details, business records and SQL Editor content. PingCAP says its investigation found no evidence that data stored in TiDB was impacted. Viral claims about 10.6 TB and specific customers’ live secrets remain unverified. PingCAP disclosure WordPress: two separate incidents. TeamUpdraft reported compromised connection keys, with malicious plugins and new administrator accounts found on some connected sites. A specific Rank Math PRO release also contained malware. Site owners should check affected versions, download dates and unauthorized changes. Also worth checking: NGINX: security fixes released. Plex, BeyondTrust, PAN-OS, GlobalProtect, SiteGuard, Siemens Software Center: exploitation reports or warnings. Onamae Desktop Cloud, Nikkei, ETS, Bullhorn, Ahold Delhaize: incident disclosures or updates with differing impacts. SBI was investigating suspected customer-data exposure. Cairn, GhostAction, AOMEI, SafePay: new reporting or updates on campaigns, some involving older activity. Microsoft’s October patches also addressed actively exploited flaws. If you’re an individual: Update everything ASAP. Check every mobile and desktop app, browser, extension and operating system through official update tools. If you reuse passwords, change them now, starting with email, banking and other sensitive accounts. Use a password manager, unique passwords and passkeys or strong two-factor authentication. If you use crypto: My advice is to pause nonessential wallet interactions while affected services investigate and fix their systems. If you can’t independently verify what a transaction or signature authorizes, don’t sign it. Check the recipient, amount, contract interactions and permissions. A gas-free signature can still authorize access to assets. Keep long-term holdings separate from your everyday wallet. For multisigs, verify transaction details through independent tools and devices (don't rely on the multisig's site UI, it may not be safe). If you run a company: Map your entire stack now: applications, hosting, cloud services, databases, libraries, containers, developer tools and third-party integrations. Identify the versions actually running and compare them against vendor advisories. Put PHP, Node.js and self-managed GitLab near the top wherever you use them. Prioritize exposed systems with critical vulnerabilities or evidence of active exploitation. Don’t wait for a perfect inventory before fixing a known exposure. Patch and investigate in parallel. Isolate systems suspected of compromise and preserve logs before wiping or rebuilding them. Check for unauthorized access, new accounts, changed permissions and unusual data transfers. Rotate and revoke exposed or potentially exposed credentials, and review sessions, service accounts and third-party application access. Rebuild compromised systems from trusted sources where needed. Verify that patches are actually running in production, including containers and background workers. Act now. Updating closes vulnerabilities. Revoking access and investigating what already happened are just as important.