ThreatWire Roundup: E-Mudra Certificate Weaknesses, a Node.js Flaw and Data Breaches

Summary

ThreatWire reports weak E-Mudra certificate keys, a long-lived GitLab flaw, a Brotli decoder vulnerability affecting Node.js and other projects, breaches at Railway and Pingcap, and an infostealer in LightLLM 1.107.0.

Key points

The episode says a researcher demonstrated signing with eight insufficiently random E-Mudra intermediate certificate keys. E-Mudra later shut down its certificate-issuing business; Java's default TLS stack may not check for revoked certificates.
The report describes a 10.0-rated, unauthenticated remote-code-execution flaw involving integer overflow during regex compilation, applicable to GitLab versions reaching back 12 years. It says related issues also involved the broader Ruby environment.
CVE-2026-111497 affects a Brotli decoder used by Node.js. The episode says crafted input could cause crashes, memory corruption or remote code execution; a patch was made to Google's Brotli library, but dependent projects still need to propagate it.
Railway reported a breach that exposed encrypted environment variables in an estimated 1.85% of workspaces. It shifted from asking all users to rotate keys to contacting confirmed affected customers and high-risk companies.
Pingcap said attackers accessed internal systems using compromised credentials. The episode attributes a claim of 10 terabytes removed, including emails, API keys and other data, to a ransomware group; Pingcap said it believed customer TiDB data and production environments were not accessed.
An infostealer was reportedly added to LightLLM Python package version 1.107.0, targeting cloud credentials, developer secrets and API-provider keys.

Article Details

Topics: [00:33] E-Mudra's weak intermediate certificate keys and certificate-issuing shutdown
[02:39] GitLab's long-lived remote-code-execution vulnerability
[03:50] Node.js vulnerabilities and the Brotli decoder flaw
[06:15] Railway's breach and response to exposed environment variables
[06:46] Pingcap breach claims and the company's account of affected systems
[07:50] Infostealer added to the LightLLM Python package

MITRE ATT&CK

T1078 · Valid AccountsThe episode says attackers used compromised credentials to access Pingcap's internal systems.

Vendors

GitLabThe episode discusses a critical remote-code-execution vulnerability affecting GitLab and says related issues also involved the broader Ruby environment.GoogleThe episode says a patch was made for Google's Brotli C decoder, whose flaw also affected projects that use the library.PingCAPPingcap reported attackers' access to internal systems and said it believed customer TiDB data and production environments were not accessed.

Products

GitLabThe episode describes a critical unauthenticated remote-code-execution vulnerability affecting GitLab versions reaching back 12 years.TiDBThe episode says Pingcap believed attackers did not access data stored in customer TiDB databases or production environments.