A cascade of critical flaws threatens the internet’s backbone
Today’s cyber‑security landscape was rocked by a series of high‑severity vulnerabilities that forced governments, enterprises, and open‑source projects into emergency mode. From a zero‑day in PHP that shut down national portals to a quartet of Node.js bugs and a supply‑chain attack on the popular LiteLLM proxy, the day underscored how quickly the attack surface can expand when AI‑driven discovery meets open‑source velocity.
“The sheer simultaneity of these disclosures is unprecedented,” said Sarah Perez, senior editor at TechCrunch.
PHP’s emergency patch forces nationwide outages
- The U.S. NSA issued an advisory urging all PHP‑dependent systems to update or go offline.
- Government sites across Europe, Asia, and the Americas experienced temporary shutdowns as administrators scrambled for the patch.
- The vulnerability allowed remote code execution through crafted HTTP requests, exposing databases and authentication modules.
Node.js unveils four high‑severity flaws
The Node.js core team released version 20.12.0, closing:
- A remote‑code‑execution bug that could be triggered via malicious npm packages.
- Two TLS validation bypasses that would let attackers spoof server identities.
- A denial‑of‑service issue affecting event‑loop stability.
Security analysts warn that the sheer popularity of Node.js in micro‑service architectures makes these bugs especially dangerous for cloud‑native workloads.
LiteLLM supply‑chain compromise
LiteLLM, an open‑source proxy that routes requests to multiple large‑language‑model providers, was hijacked on Wednesday:
- Malicious code was published to PyPI, Docker Hub, and GitHub Container Registry.
- The payload combined a credential‑stealer targeting cloud keys, passwords, and AI‑service tokens with a remote‑access trojan.
- The project’s maintainers removed the tainted releases and issued a remediation guide for affected users.
eMudhra’s certificate‑authority key leak
India’s eMudhra certificate authority disclosed that its private signing keys had been compromised:
- Attackers could issue fraudulent TLS certificates, enabling man‑in‑the‑middle attacks on any domain trusting the compromised root.
- Experts compare the fallout to the 2014 Heartbleed bug, calling it “a massive cleanup job.”
- Browsers and operating systems are now revoking trust for the affected root, and organizations are urged to re‑issue certificates promptly.