In October 2026, highly dangerous vulnerabilities were discovered that compromised numerous services used across the internet. The most critical of these involved PHP; although the details were not intended to become public until October 21, they were leaked on a well-known hacker forum several days earlier.

This article reports serious recent vulnerabilities:
- PHP vulnerabilities.
- Gitlab.
- Github (LiteLLM).
- Emudhra (Digital Certificates).
- npm, javascript and node.js (Nebula AI).

PHP VULNERABILITIES
PHP is a programming language that runs primarily on servers to manage dynamic web pages, databases, login systems, APIs, and other website functionalities. These two PHP vulnerabilities allow an attacker to execute commands on a server without needing to log in. The Common Vulnerability Scoring System (CVSS), which assesses the severity of a vulnerability based on factors such as the ease of exploitation over the internet and the potential scale of damage, assigned these a score of 9, indicating an "extremely critical" level of danger.

The two flaws in PHP are:
1) CVE-2026-109618: An error in memory management that can lead to the execution of unauthorized code when PHP exceeds its memory limit.
2) CVE-2026-109619: A situation where an internal state remains accessible even after the associated memory has been freed, enabling an attack on the PHP process.

Both vulnerabilities can lead to Remote Code Execution (RCE), allowing an attacker to run commands or execute code of their choosing on the server.

Key risks include:
- Website modification: Replacing legitimate pages with phishing pages or fraudulent payment screens.

- Malware distribution: Injecting malicious scripts or downloadable files into web pages.

- Data theft: Gaining access to emails, user databases, stored passwords, and other sensitive information held on the server.

- Account compromise: theft of sessions and credentials, which can lead to unauthorized access to accounts.

- Service disruption: deletion of data and tampering with applications.

Although these vulnerabilities do not allow for the extraction of wallet "seed phrases," they do enable "DNS hijacking", a type of attack previously observed on platforms such as Compound and Curve Finance within the DeFi space.

Specifically, they could allow an attacker to:
- Install malicious code.

- Sign transactions other than those intended.

- Modify recipient addresses, transaction parameters, approval requests, or scripts loaded by the website.

GITLAB
GitLab is used to store source code, manage repositories and automate builds and deployments.
Rated 10/10 on the CVSS scale, this vulnerability allows an unauthenticated user to execute arbitrary code on the server. If a vulnerable instance is compromised, an attacker could steal credentials and attempt to tamper with the software.

GITHUB
Version 1.107.0 of the open-source package LiteLLM was compromised via a supply chain attack on GitHub on October 21, 2026. The malware includes a backdoor for remote code execution and a credential stealer that activates automatically whenever Python is launched. The payload is designed to extract API keys for AI providers, cloud credentials (Amazon Web Services, Google Cloud, Azure), Kubernetes, GPG and SSH keys, browser cookies, and saved browser data.

EMUDHRA (DIGITAL CERTIFICATES)
Certificate Authorities ( Emudhra ) help determine whether a site's HTTPS certificate is authentic. This vulnerability concerns the compromise of digital certificate keys. Certain P-384 keys could be derived from their corresponding public keys. If an attacker can reconstruct a compromised private key and the certificate is still trusted by the client, they could attempt to issue fraudulent certificates and impersonate legitimate domains. This could facilitate man-in-the-middle attacks and the distribution of software with forged signatures. In such a scenario, a website may appear authentic while an attacker attempts to intercept or alter communications.

NPM (NEBULA AI)
CloudSEK has identified seven malicious packages published on npm, disguised as an AI service called NebulaAI. The packages were designed to install a Trojan capable of granting remote access to the infected computer. npm is the package registry used by the JavaScript and Node.js ecosystem. The Trojan is designed to enable remote control and surveillance activities (via webcam and microphone).

BANKING DATA BREACH IN INDIA
The State Bank of India has reported a data breach affecting over 3,890 customer records and has identified a database on the Dark Web containing the personal information of 375,000 individuals. The exposed data includes sensitive "Know Your Customer" (KYC) information: names, dates of birth, email addresses, home addresses, phone numbers, customer identifiers, and metadata related to loans.

Article always updated with all the possibilities of on-chain farming (airdrop): Some Sites To Earn Crypto Bonus (Old & New)