A Day of Cybersecurity Turmoil: Major Vulnerabilities and Breaches Hit Global Infrastructure

PHP vulnerability triggers global outages and urgent NSA guidance

Reuters reported that government websites around the world went offline after AI discovered critical security vulnerabilities in the PHP programming language. The flaws were severe enough that the U.S. National Security Agency advised organizations using PHP to either update immediately or take their systems offline until they could.

Node.js patches four high‑severity flaws, including remote code execution and TLS bypass

The open‑source JavaScript runtime environment Node.js released its latest update, patching four high‑severity vulnerabilities. One flaw allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially letting attackers impersonate servers. The fourth vulnerability was also addressed in the release.

LiteLLM compromised with credential‑stealing malware distributed across major repositories

LiteLLM, a popular open‑source proxy for routing requests to multiple large language model providers, was compromised by an attacker who injected malicious code. The malicious artifacts were published to PyPI, Docker Hub, and GHCR. The injected code included an information stealer targeting cloud credentials, passwords, and AI service credentials, as well as a remote‑access trojan that could let hackers execute commands on compromised systems. LiteLLM has removed the malicious releases and images and urged anyone who installed them to follow its remediation guidance.

eMudhra certificate authority breach raises certificate fraud concerns

Security pros have called this a massive cleanup job and one that’s “bigger than Heartbleed.”

The Indian certificate authority eMudhra had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. The warning that the incident is “bigger than Heartbleed” references the critical OpenSSL vulnerability that once threatened a large portion of internet traffic.

Recent breaches add to mounting pressure

• TiDB Cloud, a cloud‑native database‑as‑a‑service, announced a breach on Monday.
• Hackers have been exploiting four patched Plex Media Server flaws collectively known as Plex2Shell.
• Last week, cybersecurity firm BeyondTrust warned customers to patch a critical zero‑day in its Remote Support product, which had been exploited since August.

Implications for cybersecurity teams and AI‑driven threats

Although the incidents were unrelated, their back‑to‑back arrival underscores the growing challenges faced by security teams worldwide. The convergence of AI capabilities with newly disclosed vulnerabilities could further lower the barrier for attackers to weaponize flaws as soon as they are discovered.