LiteLLM v1.107.0 backdoored, PHP RCEs exploited: a nightmare day for open-source security
aniketmaurya · x · 2026-10-22
A thread by Mudit Gupta compiles multiple simultaneous security incidents hitting production systems:
- PHP: two critical unauthenticated RCEs, already exploited in the wild — patch now.
- LiteLLM: v1.107.0 on PyPI and Docker is backdoored, stealing cloud, SSH, and AI credentials. Pin 1.106.2 and rotate secrets.
- eMudhra: the certificate authority's keys were crackable; update browsers and trust stores.
- Node.js / Next.js / React: security releases covering Brotli RCE, TLS bypasses, and two critical Next.js RCEs.
- TiDB Cloud: PingCAP breached via stolen credentials, with customer data exfiltrated.
Poster aniketmaurya notes this scale of simultaneous supply-chain incidents is exactly what coding agents are for — fixing it all manually is untenable.
Related event: PHP dual RCE, LiteLLM backdoor spark chain of security emergencies(2 posts)→
More from coding & agent
- Reflection ships open Beam customization recipes spanning LoRA, SFT and GRPO RL — HowDevelop · 2026-10-22
- Recursive launches Flint, a local coding model hitting 125+ tokens/s on MacBook Pro — lmoroney · 2026-10-22
- Data is not software: company ground truth lives in heads, not a global repo — HanchungLee · 2026-10-22
- Couple builds online pixel RPG with Claude Code, mixing hand-drawn art with AI — AkiraVero · 2026-10-22
- Claude Code with free Anthropic finance plugins can build LBO models via 7 prompts — alex_verem · 2026-10-22
- Obsidian Agent Kit cuts coding-agent token usage by up to 53.2% in benchmarks — Scared_Resort_8177 · 2026-10-22