The viral Oct 21 'internet broke' thread, fact-checked

On 22 October, @techie_piyush (Piyush Sachdeva, a verified account with about 10k followers) posted ten security incidents under “THE INTERNET BROKE TODAY”. It has about 720k views and 7.3k likes, and it ends with “RT to save someone’s server”.

I wanted to know which parts are solid. I went back to primary sources where they exist: Mozilla’s incident bug, CISA, the Node.js advisory, Railway’s own report, and the filings and statements behind the news stories. Where I only found secondary reporting, I say so. All of this reflects what was public on 24 October, and several of these stories are still moving.

Short version: every incident is real, and one headline number (eMudhra’s “60M+”) is wrong. Three others blur dates or scope. The thread is a useful to-do list, but I wouldn’t repeat its numbers.

Scorecard

#	Claim	Verdict
1	eMudhra: key was “4”, forged any site, 60M+ certs	Key is right. “Forged” and “60M+” are not.
2	SBI: 3,897 customers, loan data	Mostly right. Loan metadata, not loan data.
3	Rajasthan Police: alleged hack	Right, and correctly labelled unverified.
4	php2shell: 9.2, 70% of the web, “patch or go offline”	Right, with caveats on “70%”.
5	GitLab: 10.0, unauth RCE	Right, but details are undisclosed.
6	Node.js: Brotli RCE + TLS bypass	Right, but two separate items.
7	Railway breached today, env vars decrypted	A subset, and it started on Oct 20.
8	OpenCode: keys exposed	Right, but it happened on Oct 16–17.
9	LiteLLM 1.107.0 was malware	Right.
10	Plex2Shell actively exploited, KEV Oct 23	Right, but it isn’t new.

The one with the wrong number: eMudhra

The key really was the number 4. Mozilla’s incident bug says eight intermediate CA keys, generated on 30 April 2025, were P-384 private keys with values below 256, so anyone could recover them by brute force. The Register reports one of them “is the number 4”. Mozilla recovered the keys itself within hours of the report.

Two parts of the claim go too far:

• “Forged ANY website for 17 months.” The keys could have been used to forge certificates for about 17 months. Nobody has shown that they were. eMudhra says it issued no end-user certificates from these intermediates. That isn’t fully settled, because the Mozilla thread notes a DV issuer was live until 17 October, and a community CT analysis raises questions. Google says no TLS certificates chaining to them had been logged to Certificate Transparency before it blocked them.
• “60M+ certs at risk.” 60 million is the total eMudhra says it has ever issued, per Help Net Security. The migration figure is about 30,000 certificates, which is an estimate from eMudhra and others and not an audited count.

What did happen is quick: Chrome blocked the six TLS intermediates within two hours of the report on 17 October. Mozilla, Apple and Microsoft followed. eMudhra revoked all eight, and Chrome plans to remove the parent root on 27 October. eMudhra says the cause was a faulty key-generation script. Mozilla’s questions to it were still unanswered on 23 October.

Right, with fine print

SBI. SBI told the exchanges that of about 375,000 records on the dark web, 3,897 contained customer PII: names, phones, dates of birth, addresses and “metadata associated with loan/lead records”. That isn’t the same as loan data. The source is unverified, and a group called Siriusim claims it.

php2shell. CISA’s alert does say to take PHP systems offline if you can’t patch. “70% of the web” is where it gets loose. W3Techs says 69.3% of sites use PHP, but the flaws affect PHP serving web requests, and mod_php is the highest risk. Amazon saw the first attempt on 17 October, four days before disclosure. As of 23 October it was not in CISA’s KEV catalog.

GitLab. CVE-2026-110264 is CVSS 10.0 and, per SOC Prime’s summary, unauthenticated. I couldn’t reach GitLab’s own advisory, so this is secondary. GitLab hasn’t disclosed the triggering conditions, there is no public exploit, and no exploitation had been confirmed as of 22 October. A separate 10.0 bug from 12 October, CVE-2026-97229, needs the attacker to commit a CI config.

Node.js. The release notes list ten CVEs, including the Brotli RCE, CVE-2026-111497. The TLS hostname bypasses are separate CVEs, and the eMudhra block is a CA-cert update. All of it is in 22.23.4, 24.22.1 and 26.12.1.

Plex2Shell. CISA added it to KEV on 20 October, but only two of the four CVEs are due on 23 October, and the others on 3 November. Plex shipped the fix in early August, so this is about unpatched servers.

The three that are about your keys

Railway. The attack window started on 20 October, not 21. An attacker reached internal build systems, then CI credentials, and decrypted a subset of stored environment variables. Railway says “at most 1.85%” of workspaces, about 100,000, were potentially affected. It can’t yet say which variables, so it told all customers who signed up before 21 October to rotate secrets. No root cause has been given.

OpenCode. Keys were exposed overnight on 16–17 October for about 1.4% of Console users. Charges ran from hundreds to more than $1,000 per account. Anthropic and Google blocked keys, and OpenAI helped with refunds. “Distillation attack” is OpenCode’s own label.

LiteLLM. Version 1.107.0 was live on PyPI from 11:39 UTC on 21 October. Chainguard flagged it 16 minutes later. A .pth file runs the stealer on every Python start, even if litellm is never imported. LiteLLM says the attacker used three engineers’ GitHub CLI tokens. The last safe version is 1.106.2, and updating alone doesn’t undo a compromise.

“AI found the bugs. AI is exploiting them.”

This is only half-supported. Calif and Wiz say they used AI models in finding php2shell. On the attacker side, Railway’s report says the intruder was after AI provider keys, apparently for distillation, and may have had “abliterated models” and large compute. That is Railway’s unverified read, and nothing I found shows AI being used to exploit PHP or GitLab.

What to do

1. Update PHP (8.5.12, 8.4.27, 8.3.36 or 8.2.35) and restart workers, then GitLab and Node.
2. Search for litellm 1.107.0. If you ran it, rotate everything that machine could reach, from a clean machine.
3. Rotate keys you stored on Railway or in OpenCode Console, and check your provider billing since 16 October.
4. Update your OS and browser trust stores for the eMudhra distrust, and check anything that bundles its own CA list.