AI-discovered PHP flaws knock government sites offline; NSA says patch or disconnect

Government sites knocked offline by AI-found PHP flaws

Government websites across the world went offline on Wednesday after critical vulnerabilities in PHP, the server-side language behind a substantial share of the web, were discovered with the help of artificial intelligence. TechCrunch, citing Reuters, reported the outages as a worldwide event rather than an isolated disruption.

The U.S. National Security Agency went a step further, advising organizations that run PHP to update immediately or disconnect their systems until patching was possible. The either/or wording of that advice signals how little reaction time officials believed defenders had before the flaws could be weaponized.

Node.js shipped fixes for four high-severity bugs the same day

Node.js, the widely used open-source JavaScript runtime, also released a security update on Wednesday. According to TechCrunch, the release closed four high-severity vulnerabilities. One of them allowed remote code execution, and two others would have permitted an attacker to bypass TLS validation — the mechanism software uses to confirm that a server is genuinely the host it claims to be, opening the door to impersonation and interception. The fourth vulnerability was not described in detail.

Malicious code found in LiteLLM releases

LiteLLM, an open-source proxy that routes requests to multiple large language model providers, disclosed in a post on X that an attacker had compromised the project and injected malicious code. The tainted artifacts were published to PyPI, Docker Hub and the GitHub Container Registry.

TechCrunch reported that the malicious code included an information stealer that went after cloud credentials, passwords and AI service credentials, alongside a remote access trojan capable of executing commands on compromised machines. LiteLLM said it has removed the malicious releases and images and urged anyone who installed them to follow its remediation guidance.

Certificate authority eMudhra had private keys stolen

Separately, eMudhra, an Indian certificate authority, had its private keys compromised. In the wrong hands, those keys could be used to issue fraudulent certificates and impersonate legitimate websites. Security professionals quoted by TechCrunch described the resulting cleanup as bigger than Heartbleed, the well-known critical flaw in the OpenSSL cryptographic library.

A cluster of incidents, not a coordinated attack

TechCrunch emphasized that these events were unrelated to one another. They arrived on the heels of other recent incidents: the cloud database service TiDB Cloud announced a breach on Monday, attackers have been exploiting four patched Plex Media Server flaws collectively dubbed Plex2Shell, and cybersecurity firm BeyondTrust warned customers last week to fix a critical zero-day in its Remote Support product that had been exploited since August.

Why it matters

The PHP episode is the headline, and it reframes the debate about AI and security. Tooling capable of surfacing critical vulnerabilities in one of the web's foundational languages compresses the time defenders have to patch before attackers weaponize the same findings — a concern TechCrunch raised directly. Government sites going dark is, in this light, the defensive outcome: administrators pulled systems offline rather than risk exploitation, trading public availability for safety.

The day also illustrates how much of the internet rests on a small number of shared components. A language runtime, a JavaScript ecosystem, an AI routing package and a certificate authority each failed independently, and each failure rippled outward to everyone downstream of it. The LiteLLM compromise adds a sharper point: infrastructure built around AI is itself a high-value target, with credentials for AI services explicitly in the attacker's sights. For teams still running unpatched PHP, the practical takeaway is unchanged and urgent — update now, or disconnect until you can.