从网络安全角度看，互联网正度过糟糕的一天。路透社报道称，全球多个政府网站在人工智能发现影响编程语言PHP的关键安全漏洞后陷入瘫痪。这些问题严重到美国国家安全局（NSA）建议在系统中使用PHP的组织立即更新，或在能够更新前将系统下线。
The internet is having a bad day, from a cybersecurity perspective. Government websites around the world went offline, Reuters reported, after AI discovered critical security vulnerabilities that impacted the programming language PHP. The issues were severe enough that the U.S. National Security Agency (NSA) advised organizations using PHP on their systems to either immediately update or take their systems offline until they could.
但PHP更新并非周三网络安全人员面临的唯一麻烦。开源JavaScript运行时环境Node.js也带来了自己的安全意外，称其最新版本刚刚修补了四个高危漏洞。其中一个允许远程代码执行，另外两个本可允许TLS验证绕过，潜在上可能让攻击者绕过旨在验证服务器身份的检查。
But the PHP update wasn’t the only headache cybersecurity folks were facing on Wednesday. Node.js, the open-source JavaScript runtime environment, also dropped a security surprise of its own when it shared that four high-severity vulnerabilities were just patched in its latest release. One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a server’s identity.
此外，LiteLLM公司周三下午在X平台发帖称，这款用于将请求路由至多个大语言模型供应商的流行开源代理已遭攻击者入侵，攻击者注入了恶意代码。该帖子指出，恶意构件已发布到PyPI（Python软件包索引）、Docker Hub和GHCR（GitHub容器注册表）。
In addition, LiteLLM, a popular open source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code, the company shared in a post on X on Wednesday afternoon. The malicious artifacts were published to PyPI (Python Package Index), Docker Hub, and GHCR (GitHub Container Registry), the post noted.
据称，恶意代码包含一款针对云凭证、密码和AI服务凭证的信息窃取程序，以及一款可让黑客在受感染系统上执行命令的远程访问木马。
The malicious code was said to include an information stealer that targeted cloud credentials, passwords, and AI service credentials, in addition to a remote access trojan that could allow hackers to execute commands on compromised systems.
LiteLLM表示，已移除恶意发布版本和镜像，并建议任何安装了这些内容的人遵循其提供的修复指南。
LiteLLM said it has now removed the malicious releases and images and advised anyone who installed them to follow the remediation guidance it provided.
而且，还有更多！印度证书颁发机构eMudhra的私钥遭到泄露，可能使攻击者得以签发欺诈性证书并冒充合法网站。安全专家称这是一项大规模清理工作，且“比心脏出血（Heartbleed）还要严重”。（后者指的是OpenSSL加密软件库中的严重安全漏洞）。
And wait, there’s more! An Indian certificate authority, eMudhra, had its private keys compromised, potentially allowing attackers to issue fraudulent certificates and impersonate legitimate websites. Security pros have called this a massive cleanup job and one that’s “bigger than Heartbleed.” (The latter is a reference to the critical security vulnerability in the OpenSSL cryptographic software library).
这些问题紧随其他安全漏洞和黑客攻击之后出现，包括云原生数据库即服务TiDB Cloud的泄露事件，该公司于周一宣布了这一消息。其他黑客一直在利用Plex Media Server的四个已修补漏洞，这些漏洞被统称为Plex2Shell。上周，网络安全公司BeyondTrust警告客户修补其Remote Support产品中的一个严重零日漏洞，该漏洞自8月以来一直遭到利用。
These issues come on the heels of other security breaches and hacks, including the breach of the cloud-native database-as-a-service, TiDB Cloud, which the company announced on Monday. Other hackers have been exploiting four patched Plex Media Server flaws, collectively called Plex2Shell. And last week, cybersecurity company BeyondTrust warned customers to patch a critical zero-day in its Remote Support product, which had been exploited since August.
尽管这些问题彼此无关，但它们接连出现凸显了网络安全团队如今面临的挑战。这一点尤为重要，因为AI可能使攻击者在发现漏洞后更容易加以利用。
Though the issues were unrelated to each other, their back-to-back arrival highlights the challenges cybersecurity teams now face. This is particularly important as AI could make it easier for attackers to exploit vulnerabilities once discovered.