Malicious LiteLLM 1.107.0 on PyPI steals Claude, Cursor, Codex keys
Only the final 1.107.0 wheel is poisoned—a stealer in every Python process, plus an hourly backdoor. Also: PHP2Shell, DuckDB 2.0 LTS, OpenAI on GCP.
Copy markdown
The stealer runs in every Python process
The poisoned wheel drops a `cook.pth` that imports on interpreter startup, so it fires even in processes that never touch LiteLLM. It harvests SSH keys, AWS/GCP/Azure/Kubernetes/Docker/GitHub creds, CI/CD secrets, and the API tokens for Claude, Cursor, Copilot and Codex, then dumps your LiteLLM proxy's provider-key tables and POSTs the AES-encrypted lot to litellm[.]dev/healthcheck.
An hourly backdoor that swaps its own C2
A planted `sitecustomize.py` runs as a detached daemon that every hour pulls a domain from an attacker-controlled GitHub file, re-runs the stealer, then downloads and `exec()`s whatever code lives at that domain. Editing one text file repoints the backdoor at will, so any host that ran 1.107.0 is fully owned, not just leaked.
Only 1.107.0 is hit—roll back to 1.106.2 now
The release candidates (1.107.0rc1/rc2) and 1.106.2 are clean; only the final 1.107.0 wheels carry the implant. Pin to `litellm==1.106.2`, rebuild any image that pulled 1.107.0, delete `cook.pth`/`cook.py`/`sitecustomize.py`, and rotate every credential—cloud, CI, browser, and your LLM provider keys—that touched the box.
Also today: AI-written exploits crack most of the web (PHP2Shell)
Wiz used Gemini 4 Argon and GPT-5.6 to find and weaponize four memory-safety bugs in PHP's core (CVE-2026-109618/109619, up to CVSS 9.2) affecting nearly every version shipped since PHP 5.4—unauthenticated RCE on WordPress, Drupal and Joomla alike. It was patched the same day; Wiz says one researcher did in a week what used to take a team months.
Also today: DuckDB 2.0 LTS adds an agent mode and vector joins
The new long-term-support release (supported to Oct 2027) ships an agent mode that cuts the output a coding model has to read by 59%, plus NEAREST joins that turn top-k similarity search into a SQL clause for embeddings. Heads-up: databases written by 2.0 can't be read by older DuckDB, so test on a shadow copy before upgrading.
Also today: OpenAI models are coming to Google Cloud
OpenAI's frontier models and Codex workflows are landing in Google Cloud's Model Garden, bought through the GCP Marketplace and drawable against existing cloud commitments. It's not live yet—GA is planned 'in the coming weeks'—but it's a new procurement path if your stack already runs on Google Cloud (Microsoft stays OpenAI's primary cloud).