The Internet Is on Fire (Patch These Now)

In five days, almost every layer developers build on got hit: weak eMudhra certificate keys (one was the number 4), PHP2Shell, a Node.js Brotli RCE, a CVSS 10 GitLab flaw, a poisoned LiteLLM release on PyPI, Plex2Shell attacks, Railway and OpenCode key exposures, and an SBI data leak. Here's what happened at each layer, and what to update and rotate today. Sources: eMudhra keys (Help Net Security): https://www.helpnetsecurity.com/2026/10/21/emudhra-certificates-private-keys-compromised/ PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5 Node.js security release: https://