they’re calling it the black October lmao. > node.js: security vulnerability. > PHP: critical RCE vulnerabilities. > tensorlake: npm package infected. > liteLLM: malicious PyPI + Docker releases > Railway: customer secrets exposed > zeabur - infrastructure breached. > OpenCode: AI API keys exposed. > OVHcloud CLI: official binaries backdoored. > RankMath PRO: malware inside official plugin. > TeamUpdraft: customer data compromised. > ConnectWise: cloud backup identities compromised. > SubQuery: backdoored npm package. > GhostAction: GitHub repos with malicious workflows (related to the broader Shai-Hulud/ChainDrop activity). > eMudhra: certificate authority keys compromised (with downstream impact on Tailscale). this some complete madness bro. 1/3 of the internet is fucked.