New supply‑chain breach hits LiteLLM on PyPI

The Python package manager index now hosts a malicious version of LiteLLM 1.107.0 that drops a credential‑stealing backdoor. Safedep.io reported that the compromised wheel installs a hidden script which exfiltrates AP…

The breach surfaced on a public Hacker News thread that linked to the Safedep investigation. Commenters noted that the malicious upload bypassed the standard PyPI vetting process and propagated to downstream projects …

AI‑driven PHP exploit surfaces via PHP2Shell