On October 21, 2026, someone with maintainer access to LiteLLM pushed a poisoned release — version 1.107.0 — to PyPI and Docker Hub. The package contained a professional-grade credential stealer and an hourly remote code execution . It was live on PyPI for one hour and forty-four minutes. In that window, 49,000 developers downloaded it. If you run any Python environment with LiteLLM installed, treat it as compromised until proven otherwise. LiteLLM is the open-source AI gateway most teams use to route requests across providers — OpenAI, Anthropic, Gemini, and dozens of others. It sees 23 million downloads a week […]
The post
source & further reading
byteiota.com — original article
Visual Studio October 2026: Bulk Conflicts, Hot Exit
Mistral Large 4: 1T Open Weights Drop — Free to Use
tstack: 9 Agent Skills That Automate Your Entire PR Workflow