The internet is having a very bad cybersecurity day

Key Points:

• Government websites worldwide experienced outages after AI discovered critical security vulnerabilities in the PHP programming language, prompting the NSA to advise immediate updates or system shutdowns for PHP users.
• Node.js released patches for four high-severity vulnerabilities, including remote code execution and TLS validation bypasses, posing significant security risks.
• LiteLLM, an open-source proxy for routing requests to multiple LLM providers, was compromised with malicious code that stole cloud credentials and included a remote access trojan; affected releases have been removed and remediation guidance issued.
• Indian certificate authority eMudhra suffered a private key compromise, potentially enabling attackers to issue fraudulent certificates and impersonate legitimate websites, described as a security incident larger than the Heartbleed vulnerability.
• These incidents follow recent breaches and exploits in other software and services, underscoring the increasing challenges cybersecurity teams face, especially as AI may facilitate faster exploitation of discovered vulnerabilities.