The internet is having a very bad cybersecurity day
The internet experienced a severe cybersecurity day marked by critical vulnerabilities in PHP, Node.js, and LiteLLM packages, alongside compromised private keys at an Indian certificate authority. These incidents forced government warnings, package removals, and massive remediation efforts globally.
Why it matters
Widespread supply chain vulnerabilities and zero-day flaws across foundational web technologies threaten global digital infrastructure and enterprise security.
The internet is having a bad day, from a cybersecurity perspective. Government websites around the world went offline , Reuters reported, after AI discovered critical security vulnerabilities that impacted the programming language PHP . The issues were severe enough that the U.S. National Security Agency (NSA) advised organizations using PHP on their systems to either immediately update or take their systems offline until they could.
But the PHP update wasn’t the only headache cybersecurity folks were facing on Wednesday. Node.js , the open-source JavaScript runtime environment, also dropped a security surprise of its own when it shared that four high-severity vulnerabilities were just patched in its latest release. One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server’s identity.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in