Government websites around the globe went offline on Wednesday after an artificial‑intelligence tool uncovered critical flaws in the PHP programming language, Reuters reported. The vulnerabilities were deemed serious enough that the U.S. National Security Agency advised any organization still running PHP to either apply the update immediately or shut down the affected systems until a fix could be installed.
The PHP issue was only the beginning of a hectic day for security teams. The open‑source JavaScript runtime Node.js announced that its latest release patched four high‑severity vulnerabilities. One of those flaws allowed remote code execution, while two others could have let attackers bypass TLS validation checks, potentially compromising server identity verification.
In the same window, LiteLLM – a popular open‑source proxy that routes requests to multiple large‑language‑model providers – was compromised. An attacker injected malicious code that was later published to the Python Package Index, Docker Hub and the GitHub Container Registry. The code contained an information‑stealing component aimed at cloud credentials, passwords and AI service keys, as well as a remote‑access trojan that could enable command execution on infected machines. LiteLLM has now removed the tainted releases and images and has issued remediation guidance for anyone who may have installed the compromised packages.
Adding to the cascade of incidents, Indian certificate authority eMudhra reported that its private keys had been exposed, a breach that could allow threat actors to issue fraudulent digital certificates and impersonate legitimate websites. Security experts have called the cleanup effort “bigger than Heartbleed,” referencing the notorious OpenSSL vulnerability from years ago.
These events follow other recent security incidents. TiDB Cloud, a cloud‑native database‑as‑a‑service, disclosed a breach on Monday. Hackers have also been exploiting four patched flaws in Plex Media Server, a campaign dubbed Plex2Shell. In addition, cybersecurity firm BeyondTrust warned customers to patch a critical zero‑day in its Remote Support product, which has been exploited since August.
Although the incidents are unrelated, their back‑to‑back timing underscores the mounting pressure on cybersecurity teams, especially as artificial intelligence may make it easier for attackers to discover and exploit new weaknesses.
Sarah Perez is a consumer news editor at TechCrunch. She has reported for the site since 2011 after stints at ReadWriteWeb and several IT roles in banking, retail and software. Contact her via email at [email protected] or encrypted message on Signal at sarahperez.01.