The internet is having a bad day from a cybersecurity perspective. Government websites around the world have been taken offline, Reuters reported, after AI discovered critical security vulnerabilities affecting the PHP programming language. The problems were serious enough that the United States National Security Agency (NSA) advised organizations using PHP on their systems to immediately update or take their systems offline until they could.
But updating PHP wasn’t the only headache cybersecurity specialists faced Wednesday. Node.js, the open source JavaScript runtime, also sprung a security surprise when it announced that four high-severity vulnerabilities had just been fixed in its latest release. One allowed remote code execution, and two others would have allowed TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server’s identity.
Additionally, LiteLLM, a popular open source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code, the company shared in a post on X Wednesday afternoon. The malicious artifacts were published to PyPI (Python Package Index), Docker Hub and GHCR (GitHub Container Registry), the post said.
The malicious code reportedly includes an information stealer targeting cloud credentials, passwords, and AI service credentials, in addition to a remote access Trojan that could allow hackers to execute commands on compromised systems.
LiteLLM said it removed the malicious versions and images and advised anyone who installed them to follow the provided fix instructions.
And wait, there’s more! An Indian certificate authority, eMudhra, has had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security professionals called it a massive cleanup job and “bigger than Heartbleed.” (The latter refers to the critical security vulnerability in the OpenSSL cryptographic software library).
These issues follow other security breaches and hacks, including the breach of the cloud-native database-as-a-service, TiDB Cloud, announced by the company on Monday. Other hackers exploited four patched vulnerabilities in Plex Media Server, collectively known as Plex2Shell. And last week, cybersecurity firm BeyondTrust warned customers to fix a critical zero day in its Remote Support product, which had been exploited since August.
Although these issues are unrelated to each other, their consecutive arrival highlights the challenges cybersecurity teams now face. This is particularly important because AI could make it easier for attackers to exploit vulnerabilities once discovered.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
Gn headline
