A series of cybersecurity incidents involving digital certificate infrastructure, critical software vulnerabilities and compromised technology platforms has put companies and government agencies on alert, with artificial intelligence playing a role in both discovering security flaws and accelerating cyberattacks. The developments include a government probe into a security incident at , critical vulnerabilities in PHP that prompted websites to go offline, and supply-chain attacks affecting software packages and cloud platforms.




Here's a look at what all happened in the last 24 hours:



eMudhra security incident


The Ministry of Electronics and Information Technology (MeitY) constituted a special team after a security incident occured involving eMudhra's global digital certificate infrastructure after private keys associated with eight intermediate certificates were found to be vulnerable.




The incident raised concerns that attackers could potentially use the keys to create fraudulent certificates and impersonate legitimate websites. However, MeitY said the impact on Indian websites and applications was very limited and short-lived, and clarified that eMudhra's domestic Digital Signature Certificate and eSign services remained unaffected.




The issue came to light on October 17 after a researcher alerted Google and other technology companies. Google and Mozilla subsequently blocked the affected certificates.




eMudhra co-founder Kaushik Srinivasan told PTI that weak keys had been generated by eight of the company's 40 certifying authorities but had never been put to commercial use. He said no customer certificates had been issued using the affected keys and that the company's infrastructure had not been compromised.




The company said it was investigating the cause of the error. The incident affected its global TLS certificate business, which Srinivasan said accounted for around 1% of revenue, but could carry reputational risks.




Following the disclosure, eMudhra shares fell nearly 20% to a 52-week low of Rs 346 on the NSE on Thursday.



Also read:



Critical PHP vulnerabilities prompt global website shutdowns


Government websites and other online services were temporarily taken offline after the discovery of two critical vulnerabilities in PHP, a widely used programming language that powers websites and web applications.




The FBI and the National Security Agency warned that the flaws could allow attackers to execute code remotely, potentially compromising sensitive data and networks. The FBI's cyber division advised operators to take websites offline if they could not immediately install security updates.




The PHP Foundation released fixes and instructions for updating systems. Websites and services in the Netherlands, Finland, France and Denmark were among those affected by precautionary shutdowns or maintenance.




The vulnerabilities were discovered with the help of artificial intelligence, according to cybersecurity companies Calif and Wiz. OpenAI said it had led a coalition of researchers and security providers working on the vulnerabilities over the preceding two months, with PHP's maintainers leading the fixes and release.




The disclosure also raised concerns about attackers using AI to exploit the flaws. Reuters reported that Amazon detected an attempt to exploit the vulnerabilities against one of its decoy systems on October 17, before public disclosure. The company said further attempts followed on Wednesday.



LiteLLM Python package compromised in supply-chain attack


The LiteLLM Python package was compromised in a software supply-chain attack that delivered a credential stealer and a backdoor, according to reports from cybersecurity firms SafeDep, Socket, StepSecurity and Upwind.




The incident affected version 1.107.0, distributed through the Python Package Index (PyPI) and Docker images. The package was quarantined on PyPI, and the malicious Docker images were removed.




Oliver Jensen, director of security at LiteLLM, said the malicious release appeared to have been published through three engineers' GitHub accounts using stolen GitHub CLI OAuth tokens. The tokens involved were revoked, and the company removed all but one unaffected user from its GitHub organisation as a temporary measure.




Upwind Research said its analysis found that the malicious payload was injected into the package's build environment before the wheels were created. The package contained files capable of executing code automatically when Python starts, retrieving attacker-controlled payloads and maintaining persistent access to affected environments.




LiteLLM said its investigation into the original attack vector was ongoing.



Railway warns of possible exposure of customer credentials


Cloud platform Railway disclosed on Wednesday that an unauthorised third party might have accessed encrypted customer environment variables and, in some cases, obtained their decrypted contents.




Environment variables can contain sensitive information such as API keys and database and registry credentials. Railway said the incident might be part of a series of attacks targeting platform companies to compromise AI inference providers.




The company advised users to rotate their environment variables, API keys and private registry credentials, and review service logs for unusual activity. It paused all deployments while investigating the incident and said it would contact customers directly as it confirmed which accounts had been affected.



Microsoft links AI-assisted attacks to China-aligned hacking group


Microsoft released a statement saying the China-state-aligned hacking group Storm-0940 had used an AI-driven penetration-testing framework called ARTEX to automate attacks against hundreds of organisations globally.




The activity, which Microsoft said began as early as September 2026, targeted organisations across sectors including financial services, government, manufacturing, energy and technology.




Microsoft said several attacks had resulted in the group gaining privileged access to organisations' cloud infrastructure, with some cases taking less than three hours from initial targeting to privileged access.




The company also linked Storm-0940 to the recently disclosed ConnectWise supply-chain compromise. ConnectWise said it had contained affected application connections and was restoring services in controlled phases, while cautioning that unauthorised access might already have been established in individual customer environments.




Microsoft said the activity demonstrated how AI could accelerate reconnaissance and other offensive security operations. It cautioned that the presence of an affected application or successful authentication did not necessarily mean customer data had been accessed or exfiltrated.



Also read:



SBI reports suspected exposure of 3,897 customer records


The cybersecurity developments come alongside a separate disclosure by the (SBI) of the suspected exposure of customer information on the dark web.




In a regulatory filing, SBI said a preliminary analysis of around 3.75 lakh records available on the dark web had identified 3,897 customer records containing personally identifiable information.




The exposed information reportedly included names, dates of birth, registered mobile numbers, email addresses, residential addresses and other identifiers associated with customer and loan records.




SBI said it had received alerts about the matter from its threat intelligence service provider on October 16. The supplied information does not establish a connection between this incident and the other cybersecurity cases.



CERT-In flags risks from unauthorised AI agents


Last week, CERT-In issued a critical advisory warning that autonomous AI agents had accessed live systems and confidential data belonging to Indian organisations without authorisation.




In its advisory, 'AI Agents as Attack Vectors', the cybersecurity watchdog described incidents in which AI models and agents undergoing research and evaluation exceeded the authorised scope of their tasks and reached live systems belonging to Indian organisations.




The agents accessed business records containing personal data and confidential information using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency said.