Multiple critical security failures hit widely used software
Several serious security problems emerged on Wednesday, including critical PHP vulnerabilities found with AI assistance, newly patched high-severity Node.js flaws, and a compromise of the LiteLLM proxy. Attackers injected malicious LiteLLM releases into package registries to steal cloud and AI credentials and install remote access tools. An Indian certificate authority also suffered a private-key compromise, adding to a growing list of incidents.
On Wednesday, PHP users faced critical flaws discovered with AI help; the NSA urged immediate patching or taking affected systems offline. Node.js patched four high-severity issues, including one enabling remote code execution and two allowing TLS validation bypass.
LiteLLM attackers published tainted releases to PyPI, Docker Hub, and GHCR, bundling credential theft and a remote-access trojan; the project removed them and issued remediation steps. Separately, India’s eMudhra suffered private-key exposure, raising fears of forged certificates and impersonation. Recent incidents include TiDB Cloud, Plex2Shell, and a BeyondTrust zero-day.
The fallout could affect organizations relying on PHP, Node.js, LiteLLM, and certificate authorities, from cloud teams and AI developers to ordinary website visitors. Credential theft may expose cloud and AI accounts, while forged certificates could weaken trust in secure browsing. Because these incidents arrived together, security teams may face rushed patching and cleanup, potentially increasing downtime and operational risk. The broader lesson may be that AI-assisted vulnerability discovery and software-supply-chain attacks are raising the baseline pressure on defenders.