A single day of security failures hits government sites, Node.js, LiteLLM and an Indian certificate authority
Organisations running PHP, Node.js or LiteLLM now need to patch or remove affected code, and certificate trust is at risk.
A wave of security problems hit in a single day, with government sites going dark after AI-assisted discovery of severe PHP flaws, prompting the NSA to tell organisations to patch immediately or disconnect until they could. Node.js separately patched four high-severity issues in its latest release, one enabling remote code execution and two enabling a TLS validation bypass that could let attackers get past server identity checks. LiteLLM, a widely used open source proxy for routing calls to several LLM providers, was compromised after malicious code was pushed to PyPI, Docker Hub and GHCR, with the payload stealing cloud, password and AI service credentials and opening a remote access trojan. The company removed the bad artifacts and told anyone who had installed them to follow its remediation steps. An Indian certificate authority, eMudhra, also lost control of private keys, raising the risk of forged certificates impersonating real websites.
Why it matters
The incidents land across the software that many public services and developers rely on at once. Government sites were taken offline while PHP fixes were rolled out, and the NSA told organisations to patch immediately or disconnect. Anyone who installed the compromised LiteLLM artifacts faces possible theft of cloud, password and AI service credentials, plus a remote access trojan. The eMudhra key compromise matters beyond India, because forged certificates could impersonate real websites to users who trust them.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- TechCrunch