The internet is experiencing significant cybersecurity challenges as government websites worldwide went offline due to critical vulnerabilities discovered in the programming language PHP. According to Reuters, the U.S. National Security Agency (NSA) has advised organizations using PHP to either update their systems immediately or take them offline until they can do so.
Multiple Vulnerabilities Discovered
In addition to the PHP issues, Node.js, the open-source JavaScript runtime environment, revealed four high-severity vulnerabilities that were patched in its latest release. Notably, one vulnerability allowed for remote code execution, while two others could have enabled a TLS validation bypass, potentially allowing attackers to circumvent checks meant to verify a server's identity.
Compromise of LiteLLM
Furthermore, LiteLLM, a popular open-source proxy for routing requests to multiple LLM providers, reported that it was compromised by an attacker who injected malicious code. This malicious code was published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry). The malicious artifacts included:
- An information stealer targeting cloud credentials, passwords, and AI service credentials.
- A remote access trojan that could allow hackers to execute commands on compromised systems.
