From a cybersecurity perspective, the internet is having a bad day. According to Reuters, government websites around the world have gone offline due to an AI-discovered critical security vulnerability affecting the programming language PHP. The issue is so severe that the U.S. National Security Agency (NSA) has advised organizations using PHP in their systems to either update immediately or take their systems offline until updates can be applied.
However, PHP updates were not the only issue facing cybersecurity professionals on Wednesday. The open-source JavaScript runtime environment Node.js has also disclosed security issues in its latest version: four high-severity vulnerabilities have just been patched. According to the details, one of these vulnerabilities could lead to remote code execution, while two others could allow TLS validation bypasses, enabling attackers to circumvent checks used to verify server identity.
Additionally, the widely popular open-source proxy tool LiteLLM posted on X Wednesday afternoon that it had been compromised and malicious code injected. The company stated that the malicious artifacts have been published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry).
The post states that the malicious code includes a data-stealing program targeting cloud credentials, passwords, and AI service credentials; it also contains a remote access Trojan that could allow hackers to execute commands on infected systems.
LiteLLM stated that these malicious posts and images have been removed and advised anyone who installed related content to follow their provided remediation guide.
Additionally, the private key of India’s certificate authority eMudhra was also compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security professionals describe this as a massive cleanup effort and “more severe than Heartbleed,” referring to a critical security vulnerability in the OpenSSL cryptographic software library.
These issues were followed by additional security vulnerabilities and cyberattacks, including the compromise of TiDB Cloud, a cloud-native database-as-a-service platform, which the company disclosed on Monday. Separately, hackers have been exploiting four patched vulnerabilities in Plex Media Server, collectively known as Plex2Shell. Last week, cybersecurity firm BeyondTrust also warned customers to patch a critical zero-day vulnerability in its Remote Support product, which has been actively exploited since August.
Although these issues are unrelated to one another, their consecutive occurrence highlights the challenges currently faced by cybersecurity teams—especially as AI may make it easier for attackers to exploit vulnerabilities once discovered.