Just a few of the biggest security incidents in the past week... we're still accelerating: * PHP2Shell: Two critical RCE bugs in PHP core * eMudhra: Eight intermediate certificates had extremely weak private keys due to a key-generation script error that created keys with tiny values. * GitLab: integer overflow RCE * Plex Media Server: flaws compromised internet-facing servers used for cryptominers and proxy tools. * Arista VeloCloud Orchestrator zero-day: Actively exploited authenticated SQL injection enabling privilege escalation. * Node.js Brotli decoder RCE * NGINX critical heap/use-after-free issues * Railway breach: Attacker accessed systems storing customer environment variables and, for some, obtained decrypted contents (API keys, database credentials, private registry logins, etc.) * Zeabur breach: ~321,810 accounts and over 3.2 million environment-variable records exposed. Company announced it is shutting down. * LiteLLM supply-chain compromise: Malicious version 1.107.0 pushed to PyPI and Docker Hub containing a credential stealer and remote-access/backdoor capability. * California public school data theft: 5.7M+ student records leaked, including names, dates of birth, addresses, demographics, and disability status. * Capcom breach: Unauthorized access to ~11.77 million CAPCOM ID records * Quest Diagnostics: Unauthorized access to Quanum Lab Services Manager system used by some clients; potential access to certain patient records. * State Bank of India breach: customer records appearing on dark web