Security Weekly Covers PHP-to-Shell Attacks, LiteLLM Compromise and Tor Exit-Node Hijacking

Summary

Security Weekly covers PHP-to-shell vulnerabilities under attack, weak eMudhra TLS keys, a malicious LiteLLM release, a Tor exit-node hijack, deepfake risks, and AI supply-chain governance.

Key points

Two critical PHP vulnerabilities enable remote code execution. Attacks were being observed, Cloudflare said it was deploying blocking rules, and emergency patches were available. The host said AI models had assembled a complex exploit chain for longstanding PHP bugs.
An IANS and Artico Search report found that 65% of organizations with over $10 billion in revenue had an AI security lead, while 7% assigned primary AI-governance accountability to the CISO. The host also reported lower leadership adoption among smaller organizations.
The host described a Russian-voice deepfake exercise and warned about impersonation-driven financial fraud. Josh Marpet advised removing human judgment from authentication resets and sensitive financial or organizational decisions, and continuously inventorying AI components.
eMudhra said a key-generation flaw produced weak TLS certificate keys that were published to browser root stores; the company said it would leave the global SSL/TLS certificate business.
LiteLLM reported that attackers obtained GitHub CLI OAuth tokens from a user account in a publicly exposed deployment. A malicious release was available for about three hours and downloaded roughly 49,000 times; the host advised affected users to remove version 1.107.0, rotate credentials, and check for malware.
The host reported that a New Mexico jury found Meta misled consumers about personal-data access and other matters; a judge reduced the jury award from $219 billion to $25 billion.
An unknown entity reportedly hijacked more than 300 Tor exit nodes after accessing a management server with a reused valid password. The nodes redirected SSH connections through attacker-controlled servers and favored unencrypted email traffic; Ebury was installed, and the host warned that SSH passwords could be captured.

Article Details

Topics: [02:15] PHP-to-shell vulnerabilities, reported attacks, emergency patching, and AI-assisted exploit-chain concerns
[07:31] Survey findings on enterprise AI-security leadership and governance
[12:11] Deepfake voice risks and safeguards for authentication and sensitive decisions
[15:01] eMudhra's weak TLS certificate keys and withdrawal from the global certificate business
[18:10] LiteLLM supply-chain compromise, exposed OAuth tokens, and response steps
[20:16] Meta case concerning Facebook users' personal data and consumer-protection findings
[23:19] Josh Marpet on AI supply-chain components and continuous inventory
[27:12] Tor exit-node hijacking, Ebury, and SSH and email traffic risks