Leaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0
An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.
78
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 21, 2026
- Last mentioned1d ago
Timeline
3 articles · newest firstMalicious LiteLLM 1.107.0 ships stealer and backdoor
PyPI quarantined the release and Docker images were removed; users should pin 1.106.2 and rotate exposed credentials.
76
PHP rates two PHP2Shell flaws 9.2; fix due October 21
No attacks are reported, PHP offered no workaround, and disabling upload progress is not a full fix.
76
Appears with
- Socketorganization · 2
- LiteLLMproduct · 2
- PHP Foundationorganization · 1
- privcollectmalware · 1
- SafeDeporganization · 1
- BerriAIvendor · 1
- watchTowrorganization · 1
- PyPIorganization · 1
- GMO Flatt Securityorganization · 1
- Cloudflareorganization · 1
- PHPproduct · 1
- LiteLLMvictim · 1
- StepSecurityorganization · 1
- CERT-EUorganization · 1
- GitHuborganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.