Multiple High-Severity Vulnerabilities Discovered Across PHP, Node.js, LiteLLM and Certificate Authority
Critical flaws in PHP, Node.js, the LiteLLM proxy and an Indian certificate authority were disclosed this week, prompting urgent patches and remediation guidance from security agencies and vendors.
Government sites worldwide went offline after artificial-intelligence tools uncovered critical security flaws in the PHP programming language, prompting the U.S. National Security Agency to advise organizations to update PHP immediately or suspend affected systems.
At the same time, the Node.js runtime released a patch that addresses four high-severity vulnerabilities, including a remote-code-execution flaw and two issues that could bypass TLS certificate validation.
LiteLLM, an open-source proxy that routes requests to large language-model providers, reported that attackers injected malicious code into its packages on PyPI, Docker Hub and the GitHub Container Registry. The compromised artifacts contained components designed to steal cloud credentials, passwords and AI service tokens, as well as a remote-access trojan. > "LiteLLM has removed the malicious releases and images and advises anyone who installed them to follow the remediation guidance we provided," the company said on X.
Separately, Indian certificate authority eMudhra disclosed that its private keys were compromised, potentially enabling the issuance of fraudulent digital certificates. Security experts described the incident as a large-scale remediation effort, comparing its scope to the 2014 Heartbleed vulnerability.
These disclosures follow recent incidents affecting TiDB Cloud, Plex Media Server and BeyondTrust’s Remote Support product, underscoring the growing workload for cybersecurity teams as AI tools accelerate vulnerability discovery and exploitation.