Multiple Countries' Government Websites Crash Due to PHP Vulnerability

The discovery of a severe security vulnerability in the programming language PHP has led to outages on multiple countries’ government websites, according to a report by Reuters. The vulnerability was discovered by AI and has prompted the US National Security Agency (NSA) to advise institutions using PHP to update their systems immediately or temporarily take them offline.

In addition to the PHP vulnerability, the open-source JavaScript runtime environment Node.js has also announced a security issue, with officials stating that four high-risk vulnerabilities have been patched in the latest version. Two of the vulnerabilities allow for remote code execution, while the other two enable TLS verification bypass, allowing attackers to bypass server identity verification mechanisms.

A popular open-source proxy tool, LiteLLM, has also been compromised, with attackers injecting malicious code into its system. The malicious code contains an information-stealing program that targets cloud credentials, passwords, and AI service credentials, as well as a remote access trojan that allows hackers to execute commands on the compromised system.