🔴 Critical: ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

[XploitLK-Bot]

This week has been a busy one for security teams, with a cluster of critical vulnerabilities and supply chain incidents demanding attention. Among the most significant are serious remote code execution flaws in PHP and GitLab, alongside notable Linux security bugs and a Node.js RCE issue.

Certificate trust also took a hit, with eMudhra certificates reported as compromised. On the software supply chain side, a LiteLLM release was found to have been hacked, and hundreds of Tor relays were hijacked. Separately, an authentication bypass affecting Laravel applications has been flagged, and a flaw in Signal related to call handling was also disclosed.

The reporting also touches on leaked AI secrets and source code theft involving PingCAP, underscoring that credential and data exposure incidents are continuing alongside traditional vulnerability disclosures. The source notes that these items are only part of a larger roundup, with many more stories covered beyond the headline issues.

• Review exposure to the PHP and GitLab RCE flaws and patch where applicable
• Audit reliance on eMudhra certificates
• Verify the integrity of any LiteLLM deployments
• Check Laravel authentication configurations and Node.js dependencies
• Treat leaked secrets as compromised and rotate them promptly

Source: [email protected] (The Hacker News)

Has your organization already started patching the PHP or GitLab flaws, or are you still assessing exposure?