LiteLLM 1.107.0 was shipped with a credential stealer for about 100 minutes
AspireAI · Wiz
For roughly 100 minutes on October 21, 2026, a heavily used open-source AI package shipped malware. LiteLLM is an open-source proxy that gives applications one interface to route across providers — OpenAI, Anthropic, Cohere — while holding their API keys. At 11:39 UTC, release 1.107.0 was uploaded to PyPI. Wiz researchers found it planted three files — cook.pth, cook.py and sitecustomize.py — directly into site-packages. These are Python startup hooks: two run in every interpreter process on the host, even one that never imports litellm. The implant, internally named privcollect, harvested browser credentials and cookies, AWS/GCP credentials, SSH and GPG keys, shell history, and — for AI specifically — stored OpenAI, Anthropic and Cohere keys plus Claude Code, Cursor and Copilot credentials. It also queried the proxy's Postgres database directly (SELECT * FROM "LiteLLM_CredentialsTable" LIMIT 500) to dump every configured provider key. Stolen data was AES-encrypted and POSTed to www.litellm[.]dev/healthcheck. A second-stage backdoor polled a GitHub dead drop hourly for a server address and would have exec'd whatever it returned; that address was deleted before use and Wiz reports it was never populated. PyPI quarantined the release at 13:20 UTC, and trojanized Docker tags on GHCR and Docker Hub were removed roughly 33 minutes later. Wiz attributes the payload to a malicious fork repository (Berri-AI, a lookalike of the legitimate BerriAI organization) used to poison the release pipeline; SafeDep's independent analysis reached the same conclusion with moderate-to-high confidence. The honest gap: nobody knows the blast radius. The last safe version is 1.106.2.
Read the story and explore more from the AspireAI community.
Two critical PHP remote code execution flaws — one found by GPT-5.6 Sol — were patched on October 21, 2026, and OpenAI published a disclosure framework alongside the fix. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both allow unauthenticated remote code execution, and PHP's advisory says risk is highest for mod_php, where a demonstrated exploit triggers before any application code runs. The CVEs are distinct failure modes. CVE-2026-109618 (OOM corruption): out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. CVE-2026-109619 (stale global state): request-owned internal state can survive after its backing memory is freed, and a later request served by the same worker may use that stale state. OpenAI states GPT-5.6 Sol identified the first flaw through its Patch the Planet initiative, and that Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and release, with Wiz, Cloudflare and OpenAI contributing research and coordination. Wiz's write-up adds that it used GPT-5.6 Sol and Gemini 4 Argon throughout, with Gemini 4 Argon contributing to finding the vulnerability and validating the patch. OpenAI describes the gap between discovery and public exploitation as a "Defender's Window," proposes a five-stage response framework, and committed $1 billion in subsidised Daybreak model access for organizations with limited security resources. Honest caveats: these are OpenAI's and Wiz's own characterizations, and OpenAI also notes the same capabilities help attackers build offensive tooling faster. PHP 8.1 and older no longer receive updates from the PHP project.