Internet Faces Extremely Poor Day in Cybersecurity Terms
U.S. government websites went offline following the discovery of vulnerabilities in PHP
In the latest Node.js release, four high-severity vulnerabilities were fixed. One allowed remote code execution, while two others enabled bypassing TLS verification, which confirms server authenticity.
Additionally, an attacker injected malicious code into LiteLLM—an open-source proxy for distributing requests among multiple LLM providers. Compromised files appeared in PyPI, Docker Hub, and GHCR; they could steal cloud credentials, passwords, and access to AI services, as well as enable remote command execution. LiteLLM removed the dangerous versions and images and published instructions for mitigating the consequences.
The private keys of India’s certification authority eMudhra were compromised. This potentially allowed the issuance of fake certificates and the impersonation of fraudulent websites as legitimate ones. Security experts described the upcoming cleanup as larger in scale than the Heartbleed incident, linked to a critical vulnerability in OpenSSL.
Simultaneously, other attacks occurred: TiDB Cloud reported a breach; four patched vulnerabilities were exploited via Plex2Shell for Plex Media Server; and BeyondTrust warned of a critical zero-day vulnerability in Remote Support, which had been exploited since August. Although the incidents were unrelated, their near-simultaneous occurrence demonstrates the challenges faced by cybersecurity teams. AI may simplify the exploitation of discovered vulnerabilities for attackers.
