Topic

LiteLLM and PHP Supply Chain Woes

LiteLLM 1.107.0 was found poisoned on PyPI, OpenAI helped uncover a critical PHP flaw, and Cloudflare deployed WAF rules; now eMudhra's CA private key was found to be merely the number 4, letting certificates be abused.

6 stories · Oct 21, 02:55 to Oct 22, 14:21

Oct 21, 2026
1. LiteLLM Supply Chain Compromise
  
  Mudit Gupta warns of major incidents: critical PHP RCEs, backdoored LiteLLM, crackable CA keys; patch now.
  
  Open Source Peaked at #1 @Mudit__Gupta Oct 21, 02:55
2. CA Private Key Leak and Weak Key Discussion
  
  User jokes a trusted intermediate CA leaked, with the private key being just the number 4.
  
  Crypto Peaked at #1 @otomir23 Oct 21, 05:45
3. Cloudflare Deploys PHP WAF Rules
  
  Cloudflare's Dane Knecht says initial WAF rules are deployed for known PHP exploit vectors, available to all customers including free, but calls this a stopgap; patch ASAP.
  
  Open Source Peaked at #1 @dok2001 Oct 21, 06:09
4. OpenAI AI Finds PHP Vulnerability
  
  OpenAI's Patch the Planet helped find critical PHP flaws, coordinated fixes before disclosure.
  
  AI Peaked at #1 @OpenAI Oct 21, 22:10
5. LiteLLM PyPI Supply Chain Attack
  
  JFrog Security reports malicious code in LiteLLM 1.107.0 PyPI release, a supply-chain attack, urging users to avoid and investigate.
  
  Open Source Peaked at #3 @JFrogSecurity Oct 21, 23:23
Oct 22, 2026
1. AI-Driven Attacks Hit Institutions
  
  Polymarket says an OpenAI model found critical flaws, taking down Wikipedia, Steam and government sites.
  
  AI Peaked at #2 @Polymarket Oct 22, 14:21

LiteLLM and PHP Supply Chain Woes

Oct 21, 2026

LiteLLM Supply Chain Compromise

CA Private Key Leak and Weak Key Discussion

Cloudflare Deploys PHP WAF Rules

OpenAI AI Finds PHP Vulnerability

LiteLLM PyPI Supply Chain Attack

Oct 22, 2026

AI-Driven Attacks Hit Institutions