Multiple Cyber Incidents Shake Internet Security

A series of cybersecurity incidents has affected major internet technologies, exposing vulnerabilities in programming platforms, AI infrastructure and digital certificate systems. The incidents, involving PHP, Node.js, LiteLLM and India’s eMudhra, have raised concerns about the security of widely used online services.

Why Did Government Websites Go Offline?

Government websites in several countries went offline after critical vulnerabilities were discovered in PHP, a programming language used to develop web applications.

The security flaws were considered serious enough for the US National Security Agency (NSA) to advise organisations using PHP to update their systems immediately or temporarily take affected services offline until protective measures could be implemented. The disruptions highlighted how vulnerabilities in widely used software can affect public-facing digital services across different countries.

What Happened to Node.js?

Node.js, an open-source JavaScript runtime widely used in web applications, also received security updates addressing four high-severity vulnerabilities. One flaw could allow remote code execution, potentially enabling attackers to run malicious commands on affected systems.

Two other vulnerabilities could permit bypassing Transport Layer Security (TLS) validation, weakening checks designed to verify the identity of servers during secure communications. The vulnerabilities were patched in the latest release, making timely updates important for organisations operating affected applications.

FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders

How Was LiteLLM Compromised?

LiteLLM, an open-source proxy used to connect applications with multiple large language model providers, suffered a software supply chain compromise.

An attacker inserted malicious code into the project, with affected packages subsequently distributed through PyPI, Docker Hub and GitHub Container Registry.

The malicious code reportedly contained an information stealer designed to collect cloud credentials, passwords and AI service credentials. It also included a remote access trojan capable of allowing attackers to execute commands on compromised systems.

LiteLLM said the malicious releases and images had been removed and advised affected users to follow its remediation guidance.

Why Is eMudhra’s Breach Significant?

Indian digital certificate authority eMudhra also faced a security incident involving compromised private keys.

The compromise raised concerns about the possibility of attackers issuing fraudulent digital certificates and impersonating legitimate websites.

Digital certificates are important for establishing trust in online communications. A compromise involving certificate-related infrastructure can therefore create risks beyond a single organisation.

The incident adds to concerns about the security of systems responsible for verifying digital identities.

Were Other Technology Companies Affected?

The incidents followed several other security developments involving major technology providers.

Cloud-native database company TiDB disclosed a security breach, while attackers were reportedly exploiting four previously patched vulnerabilities in Plex Media Server, collectively known as Plex2Shell. Cybersecurity company BeyondTrust also warned customers to patch a critical zero-day vulnerability in its Remote Support product that had reportedly been exploited since August.

Although the incidents were unrelated, their close timing placed additional pressure on cybersecurity teams responsible for protecting interconnected systems.

What Do These Incidents Reveal?

The incidents demonstrate how security weaknesses can emerge across different layers of internet infrastructure, from programming languages and application dependencies to AI tools and digital certificates. Compromised software packages can expose credentials, while unpatched vulnerabilities may allow unauthorised access or remote command execution.

The growing use of AI also raises concerns that attackers could exploit newly discovered vulnerabilities more quickly, increasing the importance of rapid detection and remediation.

The420 Insight: What Should Organisations Do?

Organisations should promptly install security updates, examine third-party software dependencies and review systems for exposed credentials or suspicious activity.

Those using affected LiteLLM packages should follow the project’s remediation instructions, while administrators of vulnerable PHP, Node.js and other affected services should apply the relevant fixes.

The incidents underline the need for continuous vulnerability monitoring, stronger software supply chain security and careful management of digital certificates and authentication credentials.

About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.