PHP, Node.js and LiteLLM Security Incidents Raise Response Pressure
Security teams faced a concentrated set of unrelated incidents affecting PHP, Node.js, LiteLLM and certificate authority eMudhra. Government websites in several countries went offline after critical PHP vulnerabilities were identified with AI assistance, Reuters reported. The U.S. National Security Agency advised organizations using PHP to update immediately or take systems offline until they could do so.
At the same time, Node.js released patches for four high-severity vulnerabilities. One flaw could allow remote code execution. Two others could permit a TLS validation bypass, undermining checks designed to confirm a server’s identity. The combination gave teams another urgent review item across applications and services that depend on the JavaScript runtime.
Multiple layers of the software supply chain affected
LiteLLM, an open-source proxy used to route requests to multiple large language model providers, also reported a compromise. An attacker injected malicious code into releases and images published through PyPI, Docker Hub and GHCR. LiteLLM said it removed the malicious artifacts and issued remediation guidance for users who installed them.
The malicious code reportedly included an information stealer aimed at cloud credentials, passwords and AI-service credentials. It also included a remote access trojan that could enable attackers to execute commands on compromised systems. That detail makes the incident relevant not only to development teams but also to cloud, identity and AI platform owners.
eMudhra, an Indian certificate authority, separately had private keys compromised. Such an incident could enable fraudulent certificate issuance and impersonation of legitimate websites. Security professionals characterized the overall remediation burden as a major cleanup effort, with comparisons to the scale of the response prompted by Heartbleed in OpenSSL.
Patch management becomes a cross-team operational task
The events followed other recent security disclosures. TiDB Cloud announced a breach on Monday, attackers have been exploiting four patched Plex Media Server flaws known collectively as Plex2Shell, and BeyondTrust warned customers to patch a critical zero-day in Remote Support that had been exploited since August.
These incidents are not presented as connected, but their close timing illustrates the workload created when vulnerabilities, compromised packages and trust infrastructure issues arrive together. The source also notes that AI may make exploitation easier after vulnerabilities are discovered, increasing the importance of prompt response.
Practical implication for businesses
Organizations should establish which PHP and Node.js versions they operate, apply the available fixes or isolate systems where updates cannot be made, and review deployment records for affected LiteLLM packages and images. They should also follow LiteLLM’s remediation guidance where relevant and treat credentials exposed on potentially compromised systems as requiring investigation and replacement.