AI Finds Critical PHP Flaws as Global Government Sites Go Dark

Government websites around the world went offline after AI discovered critical security vulnerabilities in PHP, the programming language that powers a huge share of the web, Reuters reported. The U.S. National Security Agency (NSA) told organizations running PHP on their systems to either update immediately or take those systems offline until they could.

And PHP was only the first headache on Wednesday's crowded security docket. Node.js, the open-source JavaScript runtime environment, disclosed that its latest release patched four high-severity vulnerabilities. One of them allowed remote code execution. Two others permitted a TLS validation bypass — meaning attackers could potentially sidestep the checks meant to verify a server's identity.

What hit LiteLLM?

LiteLLM, a popular open-source proxy for routing requests to multiple LLM providers, disclosed it had been compromised by an attacker who injected malicious code, according to a post on X on Wednesday afternoon. The malicious artifacts were published to three major distribution channels: PyPI (the Python Package Index), Docker Hub, and GHCR (GitHub Container Registry).

The malicious code reportedly included:

• An information stealer targeting cloud credentials, passwords, and AI service credentials
• A remote access trojan capable of letting hackers execute commands on compromised systems

LiteLLM said it has removed the malicious releases and images. It advised anyone who installed them to follow the remediation guidance the company provided.

Why are pros calling this 'bigger than Heartbleed'?

The same day brought a fourth crisis. Indian certificate authority eMudhra had its private keys compromised. That breach could allow attackers to issue fraudulent certificates and impersonate legitimate websites — effectively faking the padlock in a browser. Security professionals have called the cleanup a massive job, with some describing it as "bigger than Heartbleed," a reference to the critical vulnerability in the OpenSSL cryptographic software library that shook the internet in 2014-era security memory.

For anyone counting, that's four distinct incidents in a single day: PHP, Node.js, LiteLLM, and eMudhra.

The context: this week was already brutal

Wednesday's pileup didn't arrive in a vacuum. On Monday, TiDB Cloud, a cloud-native database-as-a-service, announced a breach of its own. Hackers have also been exploiting four patched flaws in Plex Media Server, collectively nicknamed Plex2Shell. And last week, BeyondTrust warned customers to patch a critical zero-day in its Remote Support product — a flaw that had been exploited in the wild since August.

None of these incidents were connected to each other. But their back-to-back arrival underscores the operational reality security teams now face: triage queues stack up fast, and unrelated failures can land on the same shift.

What does this change for practitioners?

Two things. First, patch hygiene just got more urgent across the stack — language runtime (PHP, Node.js), supply chain (LiteLLM's PyPI, Docker Hub, and GHCR artifacts), and trust infrastructure (eMudhra's certificates) all failed in the same 24-hour window. Second, the source of the PHP discovery matters: AI found the flaws. Attackers have the same tools. As the reporting notes, AI could make it easier for attackers to exploit vulnerabilities once discovered — which compresses the window between a flaw's discovery and its weaponization, and makes immediate updates the default rather than the exception.