AI-related risks emerge in software security incidents
An InfoQ article authorized for publication by 36Kr reviews vulnerabilities affecting GitLab, Chrome, Node.js, PHP, LiteLLM, eMudhra and Railway, alongside separate incidents involving AI-assisted attacks on Korean financial institutions and an AI agent reported to have deleted PocketOS’s production database and backup in nine seconds. The report says the listed vulnerabilities may not be technically related, does not establish a coordinated campaign, and does not claim that AI discovered every flaw.
The review highlights reported risks from AI-assisted intrusions, agent actions with production access, software supply-chain poisoning, and exposure of API keys, environment variables and other credentials. It also stresses that the incidents do not prove traditional software is comprehensively compromised or that all vulnerabilities were AI-discovered.
如果要给这魔幻的一周写个总结，那大概是：“全栈开发者的至暗时刻，AI 时代的赛博大逃杀。”
想象一下，你是一个普通的开发者，早上刚到工位，就会发现整个互联网基础设施都在轮流出事。GitLab 爆出了满分 10.0 的严重漏洞，Chrome 紧急修复高危漏洞，Node.js 和 PHP 接连爆雷，LiteLLM 遭遇供应链攻击，eMudhra 证书私钥泄露，连云部署平台 Railway 都出了安全事故，用户的 API Key、环境变量等敏感信息正面临全面泄露的风险。
短短几天，这场风暴就已席卷了整个软件生态。从浏览器、开发工具、代码托管，到上层应用和云部署平台，原本引以为傲的全栈技术栈瞬间成了“漏洞全家桶”：底层的 Linux 爆了提权漏洞，数据库 TiDB 被爆存在安全问题，连花大价钱买的 HTTPS 证书，也被发现是印度一家 CA 机构用 8bit 密钥签出来的。
这显然已经不只是几个孤立的安全事件。这些漏洞在技术上未必存在关联，但当越来越多的底层设施在同一时间密集暴露问题，量变可能会引起质变。而且，AI 在这片混乱里不再只是个帮人写代码的“乖助手”，它开始化身成最锋利的矛：有人借助 AI 跨国攻击韩国金融机构；也有开发者让 AI 处理测试环境问题，结果 Agent 9 秒就删掉了生产数据库，连同备份一起。
#LiteLLM#Railway#OpenCode#ARTEX#PocketOS#Claude Opus 4.6#Cursor#GitLab#Chrome#PHP#Node.js#eMudhra