Critical PHP, Node.js and LiteLLM Flaws Trigger Security Advisories
South Korea issued a cyber crisis advisory over the PHP bugs, and hackers began scanning for vulnerable servers four days before patches landed.
Critical vulnerabilities have been disclosed in the PHP programming language, the Node.js open-source JavaScript runtime and the open-source LLM proxy LiteLLM, according to digitaltoday.co.kr. The PHP flaws drew the sharpest response: hackers began searching for vulnerable PHP servers four days before the two critical PHP bugs were patched.
The South Korean government issued a cyber crisis advisory over the PHP vulnerabilities, and domestic security firms released response services. Some countries blocked websites because the PHP flaws could not be patched immediately, including sites running unsupported older versions of the language.
AI agents used to automate attacks
Separately, Microsoft reported that Storm-0940, a China-linked hacking group, automated attacks on hundreds of organizations across industries using the open-source AI penetration-testing tool Artex, developed by a Chinese engineer. Another group, CyberCartel, automated attacks on around 400 financial institutions in Latin America using AI agents built on Anthropic, SpaceX and Chinese Moonshot AI models.
Hackers also attacked the AI coding tool OpenCode, causing unauthorized charges on users' AI accounts.
In October 2026, Microsoft said a China-linked group attacked hundreds of companies worldwide using Chinese AI agents. Anthropic's red team previously revealed it had built an AI worm that spreads itself through smart TVs, prompting industry debate over its real-world feasibility.
At security events, AhnLab took part in the GovWare 2026 conference in Singapore from the 13th, presenting its unified AhnLab AI Plus brand, while Sparrow attended a Japanese IT exhibition to present its AI-generated-code security assistant Sparrow MCP. Naru Security launched the AI web defense service ZeroTiCA Lite Web, and Comtrue Technology plans to present new features in its Sherlock Holmes AI DLP product. Microsoft also defined AI agents working inside companies as "agentic insiders" and presented control measures.
Quick answers
Which software has critical vulnerabilities?
PHP, the Node.js open-source JavaScript runtime and the open-source LLM proxy LiteLLM.
Why did some countries block websites?
Because the PHP flaws could not be patched immediately, including sites running unsupported older PHP versions.
What did the South Korean government do?
It issued a cyber crisis advisory over the PHP vulnerabilities.