PHP flaws and LiteLLM compromise add to security teams’ workload

Government websites around the world went offline after AI discovered critical vulnerabilities affecting PHP. The U.S. National Security Agency advised organizations using PHP to update immediately or take affected systems offline until they could. Separately, Node.js patched four high-severity vulnerabilities in its latest release. One allowed remote code execution, while two others could bypass TLS validation checks intended to verify a server’s identity.

LiteLLM, an open source proxy for routing requests to multiple LLM providers, disclosed that an attacker injected malicious code into releases distributed through PyPI, Docker Hub, and GHCR. The payload reportedly included an information stealer targeting cloud credentials, passwords, and AI service credentials, alongside a remote access trojan capable of executing commands on compromised systems. LiteLLM removed the malicious releases and images and directed affected users to its remediation guidance.

Indian certificate authority eMudhra also had its private keys compromised, potentially enabling attackers to issue fraudulent certificates and impersonate legitimate websites. The incidents followed a breach at TiDB Cloud, exploitation of patched Plex Media Server flaws known collectively as Plex2Shell, and a warning from BeyondTrust about an actively exploited Remote Support vulnerability. Although unrelated, the incidents underscore the workload facing cybersecurity teams and concerns that AI could make newly discovered vulnerabilities easier to exploit.