--- title: 'In the News: October 21, 2026 (Extra 2)' description: 'A poisoned LiteLLM release on PyPI targeted the credential files of coding agents; PHP patched flaws that Wiz and OpenAI say AI models helped exploit.' canonical_url: 'https://darkfactory.dev/news/2026-10-21-extra-2' markdown_url: 'https://darkfactory.dev/news/2026-10-21-extra-2.md' collection: news date_published: '2026-10-21T16:20:00-04:00' date_modified: '2026-10-21T16:20:00-04:00' --- # In the News: October 21, 2026 (Extra 2) A tampered LiteLLM release on PyPI went after the credential files of coding agents, and PHP shipped fixes for memory flaws that Wiz and OpenAI say frontier models helped turn into working exploits. Three items. ## 1. LiteLLM 1.107.0 on PyPI shipped a credential stealer that reads coding-agent tokens and MCP configs **[Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor](https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/)** · Kunal Singh · SafeDep, October 21, 2026 SafeDep reports that all seven wheels of LiteLLM 1.107.0 install three extra files in site-packages, and that two of them run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them, and PyPI has since removed the release. SafeDep lists 1.106.2, 1.107.0rc1 and 1.107.0rc2 as clean. The stealer collects SSH keys, cloud and CI/CD credentials, and the LLM provider keys stored in a LiteLLM proxy database. Its target list also names configuration and tokens for Claude Code, Claude Desktop, Cursor, Windsurf, Copilot, Codex and Gemini CLI, plus MCP config files. A second file starts a background daemon that, every hour, reads a server address from a GitHub file and runs whatever code that server returns. SafeDep says the GitHub account was deleted about two hours after the release, so the backdoor now has no address to fetch, but hosts that ran it earlier could have received second-stage code, and it could not recover the server. The tag v1.107.0 points at a commit whose pyproject.toml says version 1.108.0, and the published source matches a later commit plus one injected line, `data = "cook"`. SafeDep found no public GitHub Actions run that built the release. It assesses, with moderate to high confidence, that BerriAI's private release pipeline built the wheels from attacker-modified source, and says only BerriAI's pipeline logs can confirm the cause. Hashes and host indicators are in the post. **Why it matters:** Any machine or CI job that installed 1.107.0 should be treated as having exposed everything on that list, including agent tokens and MCP configs. The mismatch between tag and contents is also the kind of thing an unattended agent installing dependencies will not notice, so release-to-source checks belong in the harness, not in a human's attention. ## 2. Wiz says AI models turned long-standing PHP memory bugs into working remote-code-execution chains **[PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](https://www.wiz.io/blog/php2shell-php-rce)** · Wiz Research · Wiz, October 21, 2026 Wiz Research reports two CVEs in core PHP, CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2, affecting releases back to PHP 5.4. PHP published patched releases on October 21. Wiz says the bugs come from how PHP handles fatal out-of-memory errors, leaving stale state that a later request can reuse. It reports demonstrating unauthenticated code execution on the latest WordPress, Drupal and Joomla container images, and unauthenticated reads of PHP worker memory that can hold passwords, tokens and API keys. The "70% of websites" figure is Wiz's. The AI claim is Wiz's too. It says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and that a single researcher completed in a week what would have taken a world-class team months. Its timeline runs from first discovery on August 19 to report on August 24, PHP acknowledgment on September 21, and patch and disclosure on October 21. The post gives no human-only baseline for that comparison. **Why it matters:** Patching PHP is the immediate action. If Wiz is right that models make per-target exploit adaptation cheap, the gap between a patch landing and exploitation of unpatched servers shrinks, and that is a reason to shorten your own time-to-patch. ## 3. OpenAI proposes a five-stage process for coordinating fixes when models find critical bugs **[Patch the Planet: global response coordination as agents uncover critical vulnerabilities](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/)** · OpenAI, October 21, 2026 OpenAI says it led a coalition of maintainers, researchers and security providers on the PHP vulnerabilities, that Calif found a critical flaw using GPT-5.6 Sol, and that Wiz independently found and reported both. The post states: "To our knowledge, frontier AI found these vulnerabilities before attackers did." It proposes five stages: validate and fix upstream, give affected organizations time to act, coordinate with government partners, prepare updates across products, and publish guidance once a patch exists. It also commits $1 billion in subsidized access to its Daybreak security program for under-resourced defenders, and says it expects similar findings to increase sharply in the coming months. This is a proposal, not an adopted standard, and OpenAI sells the access it is subsidizing. The post asks for feedback on open questions, including when governments or operators should patch systems they own after losing administrative access. **Why it matters:** If model-found critical bugs do become routine, maintainers will need a defined process for who is told what and when. The questions OpenAI leaves open, disclosure windows and emergency patching, are the ones to watch before treating this as a framework.