AI-linked security flaws hit PHP, Node.js and more
Government sites went offline after critical PHP bugs surfaced, while Node.js, LiteLLM and eMudhra also dealt with serious security incidents.
The internet had an unusually rough day for cybersecurity, with several unrelated problems surfacing at once across widely used software and services. Government websites in different countries went offline after AI identified critical vulnerabilities in PHP, and the U.S. National Security Agency warned organizations to update immediately or take affected systems offline. The same day brought fresh warnings from Node.js, a compromise in LiteLLM’s software supply chain, and a private-key breach at Indian certificate authority eMudhra. Together, the incidents left security teams juggling patching, incident response and trust issues all at once.
PHP flaws prompted an NSA warning
The most immediate concern centered on PHP, the programming language used by many websites and online services. Reuters reported that AI discovered critical security vulnerabilities affecting PHP, and the flaws were serious enough to knock government websites offline around the world.
The U.S. National Security Agency responded by advising organizations using PHP to either update their systems right away or shut them down until they could be secured. As IT-PUB News notes, that is not the kind of message that accompanies a routine software bug.
For organizations that rely on PHP, the practical issue is clear: if vulnerable systems are exposed, they may need urgent action to avoid being attacked. For users, the fallout can be immediate — inaccessible websites and interrupted services.
Node.js patched four high-severity bugs
PHP was not the only widely used platform under pressure. Node.js, the open source JavaScript runtime environment, also disclosed four high-severity vulnerabilities in its latest release.
According to the source, one of the flaws allowed remote code execution, meaning an attacker could potentially run commands on a targeted system. Two other vulnerabilities could have enabled TLS validation bypasses, weakening checks meant to confirm a server’s identity during secure connections.
That matters because Node.js is used across a broad range of web applications and services. Even when a patch arrives quickly, it still has to reach the people and companies running affected systems, leaving a window of exposure in the meantime.
LiteLLM compromise spread through software repositories
Another issue involved LiteLLM, an open source proxy used to route requests to multiple LLM providers. The company said on X that an attacker injected malicious code into its releases.
The malicious artifacts were published to PyPI, Docker Hub and GHCR, three major distribution channels that developers and teams may use when pulling software and containers into their own environments. That makes the incident especially sensitive, because a compromise at the publishing stage can spread beyond the original project.
LiteLLM said the malicious releases and images have now been removed. It also advised anyone who installed them to follow the remediation guidance it provided.
The company said the malicious code included an information stealer aimed at cloud credentials, passwords and AI service credentials, along with a remote access trojan that could let hackers execute commands on compromised systems. For organizations using such tools, the concern is not just code integrity but possible exposure of sensitive accounts tied to cloud and AI services.
eMudhra breach raised certificate trust concerns
The security problems did not stop with software. Indian certificate authority eMudhra said its private keys were compromised, creating the possibility that attackers could issue fraudulent certificates and impersonate legitimate websites.
That kind of breach is especially troubling because certificate authorities sit at the center of online trust. If private keys are exposed, the damage can extend beyond a single company or website and create broader uncertainty about whether a site is really who it claims to be.
Security professionals described the cleanup as a major effort and said it was “bigger than Heartbleed,” referring to one of the most notorious OpenSSL vulnerabilities. The comparison points to the scale of the response needed, though the source does not provide further technical details about the full scope of the compromise.
Security teams faced a pileup of urgent fixes
The day’s incidents came after a series of other security problems that had already been putting pressure on defenders. TiDB Cloud disclosed a breach on Monday. Hackers were also exploiting four patched Plex Media Server vulnerabilities known collectively as Plex2Shell, and BeyondTrust warned customers last week to patch a critical zero-day in its Remote Support product that had been exploited since August.
The source stresses that these cases were unrelated, but their timing still matters. When multiple serious issues appear in quick succession, security teams have to decide what to patch first, which systems to isolate and where to look for signs of compromise.
The broader concern is that AI may make it easier for attackers to take advantage of vulnerabilities once they are found. In that sense, the day’s news was not just a cluster of isolated bugs, but a sign of how quickly discovery, exploitation and response can collide across the digital environment.
