Security teams had their hands full after a cluster of unrelated incidents landed in quick succession, led by critical vulnerabilities in the PHP programming language serious enough that the U.S. National Security Agency advised organizations to update immediately or take affected systems offline until they could.

Node.js, the open-source JavaScript runtime, separately disclosed that four high-severity vulnerabilities had been patched in its latest release. One allowed remote code execution, while two others would have permitted a TLS validation bypass that could let attackers sidestep checks meant to verify a server's identity.

LiteLLM, a popular open-source proxy for routing requests to multiple LLM providers, said an attacker injected malicious code into its releases. The company said the artifacts were published to PyPI, Docker Hub and GHCR, and that the code included an information stealer targeting cloud credentials, passwords and AI service credentials, plus a remote access trojan allowing command execution on compromised systems. LiteLLM said it removed the malicious releases and images and issued remediation guidance.

Also affected: Indian certificate authority eMudhra, whose private keys were compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security professionals described the cleanup as enormous.

The incidents follow other recent breaches, including TiDB Cloud, exploitation of four patched Plex Media Server flaws collectively called Plex2Shell, and a critical zero-day in BeyondTrust's Remote Support product that had been exploited since August. Though unrelated, their arrival together underscores the pressure on security teams, particularly as AI could make it easier for attackers to exploit vulnerabilities once found.

Source: TechCrunch