安全大逃杀：HTTPS证书、PHP、Node.js三连爆

HTTPS证书、PHP漏洞、Node.js漏洞近日集中爆出。印度CA机构eMudhra的8张中间证书私钥被算出，攻击者可冒充任意网站。PHP与Node.js同窗出现远程执行代码风险，高市早苗提醒网站检查PHP并紧急打补丁。本文拆解影响范围、修复顺序与避坑清单。 🔥 三连爆：地基被连着敲三下你打开网站，浏览器看证书链。根证书预装，中间证书签发域名。中间证书私钥一旦泄露，域名可被伪造。HTTPS证书 ...

CSIRT Work Memo | Scared of the Vulnerability Rush! A Summary of Checkpoints for PHP ...

Hello everyone! This is Hatchobori-chan.From yesterday to today, various vulnerability reports have been flying in.GitLab, ...

一晚四个雷：PHP、Node.js、HTTPS证书、Railway同时被捅

10月21日晚间，Railway 检测到存储客户环境变量的系统出现异常活动。初步调查显示，未经授权的第三方可能访问了加密的环境变量，并获取了部分变量的解密后明文内容。这些变量通常存放 API 密钥、数据库密码和私有镜像仓库凭证，对于许多使用 Railway 部署 AI 应用的开发者而言，这意味着 Stripe、OpenAI、Anthropic 等服务的密钥可能已经外泄。

The Java, Node.js, Go, and Python certificate issue was one single event. eMudhra's key ...

This week, updates related to "certificates" were released for Java, Node.js, Go, and Python respectively. While they may ...
ABS-CBN on MSN

PHP, Node.js, eMudhra, and LiteLLM lead busy week for security teams

Security roundup: PHP2Shell, eMudhra certificate failures, Node.js security fixes and the LiteLLM supply-chain attack reshape ...