Key facts
- Critical security vulnerabilities were discovered in PHP.
- Four high-severity vulnerabilities were patched in Node.js.
- LiteLLM's malicious code included an information stealer and a remote access trojan.
- eMudhra's private key compromise could allow the issuance of fraudulent certificates.
The internet experienced a significant cybersecurity event on Wednesday, with multiple critical vulnerabilities and compromises reported. The U.S. National Security Agency issued an advisory for PHP users, urging immediate updates or system shutdowns due to discovered security flaws. Concurrently, Node.js released an update addressing four high-severity vulnerabilities, including one allowing remote code execution and others enabling TLS validation bypass.
Further complicating the landscape, LiteLLM, an open-source proxy for LLM providers, was compromised, with malicious code injected into its releases on PyPI, Docker Hub, and GHCR. This code reportedly included an information stealer targeting cloud and AI credentials, as well as a remote access trojan. In parallel, an Indian certificate authority, eMudhra, suffered a private key compromise, raising concerns about the potential for fraudulent certificate issuance. These incidents follow recent breaches, including TiDB Cloud and exploited Plex Media Server flaws, highlighting ongoing challenges for cybersecurity teams, particularly with AI potentially aiding attackers.