The internet is having a very bad cybersecurity week
Within a single day, several unrelated security problems came to light and kept security teams occupied. PHP disclosed two critical remote code execution flaws, Node.js released a security update fixing four high-severity issues, a malicious LiteLLM version showed up in public package and container registries, and an Indian certificate authority was found to have eight intermediate keys that anyone could guess. Every one of these problems affects a different layer of the stack, and seeing them together shows how many points of exposure a single server or container image can have at once.