Global Cybersecurity Crisis: Multiple Critical Vulnerabilities Impact PHP, Node.js, and LiteLLM
A series of major cybersecurity vulnerabilities has emerged simultaneously, impacting critical infrastructure and software ecosystems. The U.S. National Security Agency (NSA) issued urgent warnings regarding severe security flaws in the PHP programming language, while Node.js released patches for four high-severity vulnerabilities, including remote code execution risks. Further complications arose from a compromise of LiteLLM, an open-source proxy for LLM providers, where attackers injected malicious code into PyPI and Docker Hub to steal cloud credentials and AI service keys. Additionally, the Indian certificate authority eMudhra suffered a private key compromise, a breach described by experts as potentially more significant than the historic Heartbleed vulnerability due to its ability to facilitate website impersonation.
Topics: eMudhra private key compromise LiteLLM supply chain attack Node.js security patches NSA advisory PHP vulnerabilities