PHP, Node.js, LiteLLM and an Indian CA hit in one day
Original title: The internet is having a very bad cybersecurity day
NSA told PHP users to update or go offline; LiteLLM malicious packages stole credentials and included a RAT.
TechCrunch reported government websites going offline after critical PHP vulnerabilities, which it says AI discovered, and said the NSA advised organizations to update PHP immediately or take systems offline. Node.js patched four high-severity issues, including remote code execution and TLS validation bypasses. LiteLLM said an attacker published malicious releases to PyPI, Docker Hub, and GHCR with an information stealer and a remote access trojan, then removed them. The piece also says eMudhra's private keys were compromised, and recounts a TiDB Cloud breach, exploitation of four Plex flaws called Plex2Shell, and a BeyondTrust Remote Support zero-day exploited since August.
Unconfirmed: The article does not say the PHP flaws are exploited; offline sites may follow NSA advice, and the Heartbleed comparison is attributed to unnamed security professionals.
- Node.js said one patched flaw allowed remote code execution and two bypassed TLS validation.
- LiteLLM said the code targeted cloud, password, and AI service credentials.
- eMudhra is an Indian certificate authority; pros compared cleanup to Heartbleed.
- BeyondTrust warned of a critical Remote Support zero-day exploited since August.
Impact: RCE, TLS bypass, stolen credentials, and fraudulent certificates
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | — |
| Node.js | — | latest release |
| LiteLLM | — | — |
| Plex Media Server | — | — |
| BeyondTrust Remote Support | — | — |
- 1.Update PHP immediately or take affected systems offline, per the NSA advice reported here.
- 2.If malicious LiteLLM releases were installed, follow LiteLLM's remediation guidance.
- 3.Patch the BeyondTrust Remote Support zero-day the company warned customers about.
- Vendors
- BeyondTrustPlex
- Organizations
- National Security AgencyeMudhra
- Countries
- India
From the original article
2 min read at techcrunch.com
From AI-discovered PHP vulnerabilities to flaws in Node. js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.
By Sarah Perez · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.