PHP, Node.js, LiteLLM and an Indian CA hit in one day
NSA told PHP users to update or go offline; LiteLLM malicious packages stole credentials and included a RAT.
78
Product
TiDB Cloud
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 21, 2026
- Last mentioned4d ago
Timeline
2 articles · newest firstStolen credentials used to access PingCAP systems and source code
Access ran from September 9 to October 7; customer-specific impact and credential usability remain under investigation.
70
Appears with
- Remote Supportproduct · 1
- Plex Media Serverproduct · 1
- BeyondTrustvendor · 1
- PingCAPvendor · 1
- eMudhraorganization · 1
- LiteLLMproduct · 1
- PHPproduct · 1
- Node.jsproduct · 1
- PingCAPvictim · 1
- National Security Agencyorganization · 1
- Plexvendor · 1
- TiDBproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.