Хиймэл оюун ухааны тусламжтайгаар PHP програмчлалын хэлэнд илрүүлсэн эмзэг байдлын улмаас дэлхийн олон улсын засгийн газрын вэбсайтууд ажиллагаагүй болж, АНУ-ын Үндэсний аюулгүй байдлын агентлаг (NSA) яаралтай шинэчлэл хийх эсвэл системээ түр салгахыг зөвлөв.
PHP-ийн асуудлаас гадна Node.js орчинд дөрвөн ч өндөр эрсдэлтэй эмзэг байдал илэрч, алсын зайнаас код гүйцэтгэх болон серверийн танилт баталгаажуулалтыг тойрч гарах боломжийг хаах засваруудыг хийжээ. Үүний зэрэгцээ, LLM үйлчилгээ үзүүлэгчдийг холбогч LiteLLM платформ халдлагад өртөж, PyPI, Docker Hub болон GitHub Container Registry-д хортой код байршуулсан байна. Уг хортой код нь үүлэн тооцооллын нэвтрэх эрх, нууц үг хулгайлах болон алсаас систем удирдах троян програм агуулж байжээ.
Энэтхэгийн гэрчилгээ олгогч eMudhra байгууллагын хувийн түлхүүрүүд алдагдсан нь хуурамч гэрчилгээ үүсгэх, вэбсайтуудыг дуурайх эрсдэлийг бий болгосон бөгөөд мэргэжилтнүүд үүнийг Heartbleed-ээс ч том хэмжээний цэвэрлэгээ хийх шаардлагатай асуудал гэж үзэж байна. Даваа гарагт TiDB Cloud үүлэн мэдээллийн сангийн систем халдлагад өртсөнөөс гадна Plex Media Server-ийн Plex2Shell эмзэг байдал болон BeyondTrust-ын Remote Support бүтээгдэхүүний zero-day цоорхойг хакерууд идэвхтэй ашиглаж байгааг мэдээллээ.
Хэдийгээр эдгээр нь хоорондоо хамааралгүй тохиолдлууд боловч дараалсан байдлаар гарч байгаа нь кибер аюулгүй байдлын багуудад томоохон сорилт болж байна. Ялангуяа хиймэл оюун ухааныг ашиглан хакерууд илэрсэн эмзэг байдлуудыг урьд өмнөхөөс илүү хялбар ашиглах боломжтой болж байгаа нь энэ салбарын эрсдэлийг улам нэмэгдүүлж байна.
We have identified a security incident in our repository. We have removed the malicious versions and have published a remediation guide. Please follow the instructions here: https://t.co/9J9wz618sN
— LiteLLM (@LiteLLM) October 21, 2026
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
The internet is having a bad day, from a cybersecurity perspective. Government websites around the world went offline, Reuters reported, after AI discovered critical security vulnerabilities that impacted the programming language PHP. The issues were severe enough that the U.S. National Security Agency (NSA) advised organizations using PHP on their systems to either immediately update or take their systems offline until they could.
But the PHP update wasn’t the only headache cybersecurity folks were facing on Wednesday. Node.js, the open-source JavaScript runtime environment, also dropped a security surprise of its own when it shared that four high-severity vulnerabilities were just patched in its latest release. One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server’s identity.
In addition, LiteLLM, a popular open source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code, the company shared in a post on X on Wednesday afternoon. The malicious artifacts were published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry), the post noted.
The malicious code was said to include an information stealer that targeted cloud credentials, passwords, and AI service credentials, in addition to a remote access trojan that could allow hackers to execute commands on compromised systems.
LiteLLM said it has now removed the malicious releases and images and advised anyone who installed them to follow the remediation guidance it provided.
And wait, there’s more! An Indian certificate authority, eMudhra, had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security pros have called this a massive cleanup job and one that’s “bigger than Heartbleed.” (The latter is a reference to the critical security vulnerability in the OpenSSL cryptographic software library).
These issues come on the heels of other security breaches and hacks, including the breach of the cloud-native database-as-a-service, TiDB Cloud, which the company announced on Monday. Other hackers have been exploiting four patched Plex Media Server flaws, collectively called Plex2Shell. And last week, cybersecurity company BeyondTrust warned customers to patch a critical zero-day in its Remote Support product, which had been exploited since August.
Though the issues were unrelated to each other, their back-to-back arrival highlights the challenges cybersecurity teams now face. This is particularly important as AI could make it easier for attackers to exploit vulnerabilities once discovered.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
