The internet is having a bad day, from a cybersecurity perspective. Government websites around the world went offline, Reuters reported, after AI discovered critical security vulnerabilities that impacted the programming language PHP. The issues were severe enough that the U.S. National Security Agency (NSA) advised organizations using PHP on their systems to either immediately update or take their systems offline until they could.
But the PHP update wasn’t the only headache cybersecurity folks were facing on Wednesday. Node.js, the open-rise of its own when it shared that four high-severity vulnerabilities were just patched in its latest release. One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server’s identity
In addition, LiteLLM, a popular openmpromised by an attacker who injected malicious code, the company shared in a post on X on Wednesday afternoon. The malicious artifacts were published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry), the post noted
The malicious code was said to include an information stealer that targeted cloud credentials, passwords, and AI service credentials, in addition to a remote access trojan that could allow hackers to execute commands on compromised systems.
LiteLLM said it has now removed the malicious releases and images and advised anyone who installed them to follow the remediation guidance it provided.
And wait, there’s more! An Indian certificate authority, eMudhra, had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security pros have called this a massive cleanup job and one that’s “bigger than Heartbleed.” (The latter is a reference to the critical security vulnerability in the OpenSSL cryptographic software library).
These issues come on the heels of other security breaches and hacks, including the breach of the cloud-native database-as-a-service, TiDB Cloud, which the company announced on Monday. Other hackers have been exploiting four patched Plex Media Server flaws, collectively called Plex2Shell. And last week, cybersecurity company BeyondTrust warned customers to patch a critical zero-day in its Remote Support product, which had been exploited since August.
Though the issues were unrelated to each other, their back-to-back arrival highlights the challenges cybersecurity teams now face. This is particularly important as AI could make it easier for attackers to exploit vulnerabilities once discovered.
