Today we are in a security nightmare: - Railway may have exposed customer environment variables and API keys - SBI confirmed that customer records ended up on the dark web - eMudhra's certificate keys were extremely weak (one was literally just the number 4) - LiteLLM shipped a compromised version that steals credentials and includes a backdoor - PHP released two critical remote code execution vulnerabilities (PHP2Shell) - Node.js issued urgent security patches for a Brotli decoder remote code execution flaw, plus TLS and DNS issues and blocked the compromised eMudhra certificates - Rajasthan gov systems were allegedly linked to the exposure of a large set of identity records - OpenCode confirmed a breach that exposed AI provider API keys (OpenAI, Anthropic, Google) for a portion of Console users - Plex Media Server vulnerabilities (Plex2Shell) are being actively exploited in the wild to install malware on unpatched servers - GitLab fixed a critical CVSS 10.0 unauthenticated remote code execution flaw in its CI/CD regex compiler