SafeDep reports that all seven wheels of LiteLLM 1.107.0 install three extra files in site-packages, and that two of them run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source…
In the News: October 21, 2026 (Extra 2)
A poisoned LiteLLM release on PyPI targeted the credential files of coding agents; PHP patched flaws that Wiz and OpenAI say AI models helped exploit.
Extra edition
Machine-readable
Download Markdown
Story
LiteLLM 1.107.0 on PyPI shipped a credential stealer that reads coding-agent tokens and MCP configs
Read story →
Story
Wiz says AI models turned long-standing PHP memory bugs into working remote-code-execution chains
Wiz Research reports two CVEs in core PHP, CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2, affecting releases back to PHP 5.4. PHP published patched releases on October 21.
Story
OpenAI proposes a five-stage process for coordinating fixes when models find critical bugs
OpenAI says it led a coalition of maintainers, researchers and security providers on the PHP vulnerabilities, that Calif found a critical flaw using GPT-5.6 Sol, and that Wiz independently found and reported both. The post states: "To our…