AI-Discovered PHP Flaws Take Government Sites Offline as Other Security Crises Mount

The PHP problems were severe enough to prompt the NSA warning, but they were not the only security incidents cybersecurity teams faced that day. Node.js, the open-source JavaScript runtime environment, said its latest release patched four high-severity vulnerabilities. One allowed remote code execution, and two others could have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server's identity.

LiteLLM, a popular open-source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code, the company said in a post on X on Wednesday afternoon. The malicious artifacts were published to PyPI, Docker Hub and GHCR, according to the post. LiteLLM said the malicious code included an information stealer targeting cloud credentials, passwords and AI service credentials, as well as a remote access trojan that could allow hackers to execute commands on compromised systems. The company said it had removed the malicious releases and images and advised anyone who installed them to follow its remediation guidance.

Separately, an Indian certificate authority, eMudhra, had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security professionals described the cleanup as massive and one that was 'bigger than Heartbleed,' a reference to the critical vulnerability in the OpenSSL cryptographic software library.

The disclosures followed other breaches and hacks. TiDB Cloud, a cloud-native database-as-a-service, announced a breach on Monday. Other hackers have been exploiting four patched Plex Media Server flaws collectively called Plex2Shell. Last week, cybersecurity company BeyondTrust warned customers to patch a critical zero-day in its Remote Support product that had been exploited since August.

The incidents were unrelated, but their back-to-back arrival left security teams handling separate patches, advisories and credential cleanups at the same time. The PHP flaws also underscored how AI could make it easier for attackers to exploit vulnerabilities once they are discovered.