A string of separate but near-simultaneous security incidents has affected internet infrastructure and prompted emergency responses. Reports say an AI discovered critical vulnerabilities in the PHP programming language, causing government websites to go offline and prompting the U.S. National Security Agency (NSA) to advise organizations using PHP to either update immediately or take affected systems offline temporarily.
Node.js patches: four high-severity flaws
Alongside the PHP issue, Node.js — the open source JavaScript runtime environment — disclosed that it patched four high-severity vulnerabilities in its latest release. Among these was a remote code execution flaw and two issues that could have allowed a TLS validation bypass, potentially letting attackers circumvent mechanisms intended to verify a server’s identity.
Compromised packages: the LiteLLM incident
LiteLLM, a popular open source proxy for routing requests across multiple large language model (LLM) providers, was compromised: the project said in a post on X that an attacker injected malicious code. The malicious artifacts were published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry).
According to the post, the injected code included an information stealer targeting cloud credentials, passwords and AI service credentials, and a remote access trojan that could allow execution of commands on compromised systems. LiteLLM said it removed the malicious releases and images and provided remediation guidance to anyone who had installed them.
Compromised certificate authority keys: eMudhra
Separately, Indian certificate authority eMudhra suffered a compromise of its private keys. That breach could, in principle, enable the issuance of fraudulent certificates and the impersonation of legitimate websites.
Other recent related incidents
These events come shortly after other recent breaches and hacks. TiDB Cloud, a cloud-native database-as-a-service, announced a breach on Monday. Other attackers have been exploiting four patched Plex Media Server vulnerabilities collectively referred to as Plex2Shell. Last week, cybersecurity firm BeyondTrust warned customers to patch a critical zero-day in its Remote Support product that had been exploited since August.
Why this matters
Although these incidents are not directly linked, their back-to-back occurrence highlights the pressure on modern cybersecurity teams. Experts note that AI may accelerate the discovery and exploitation of vulnerabilities once they are found, increasing the need for rapid response, frequent patching and vigilant supply-chain and certificate management. Some security professionals have described the cleanup as a major operation, even calling it "bigger than Heartbleed."
