AI-discovered PHP flaws forced government websites offline and prompted the NSA to urge immediate updates or shutdowns. Node.js patched four high-severity bugs, including one enabling remote code execution, while an attacker injected malicious code into LiteLLM packages on PyPI, Docker Hub and GHCR.