NEAR Co-Founder Flags Internet Security Risks as PHP, Node.js Patch Flaws

Illia Polosukhin, co-founder of NEAR Protocol, warned Thursday that weaknesses in widely used software threaten internet security as PHP and Node.js issued separate fixes for critical vulnerabilities.

In a Thursday, Oct. 22 post, Polosukhin wrote, “We are at Security Armageddon now,” pointing to aging software and flaws in widely used services.

PHP announced fixes Wednesday, Oct. 21, for two critical flaws that could let an attacker run code without logging in. Web-facing PHP installations were at risk, especially those using mod_php. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Node.js also released security updates Wednesday for versions 22.x, 24.x and 26.x, including fixes for flaws in TLS certificate hostname checks. Separately, an authenticated user of the LiteLLM proxy could redirect an outbound provider request and expose configured credentials. Fixes for LiteLLM span package versions 1.88.6 through 1.96.2. These vulnerabilities affect different software and do not establish a single coordinated attack.

NEAR’s formal-verification research on Friday, Oct. 16, included an AI agent that solved 672 Lean problems in the PutnamBench mathematics benchmark. Model costs for that submission totaled $111.85 at the prices used. Formal verification uses computer-checked mathematical proofs to test whether software meets specified requirements. Solving benchmark problems does not establish that deployed software has been verified, and the cost figure is not a total development cost or an estimate for checking a production contract.