Socket retweeted
Attackers were stealing secrets from LiteLLM's GitHub org 11 days before the malicious litellm 1.107.0 release.
The trick: push a workflow to a throwaway branch, let on: [push] run it with real secrets, delete the branch. 20 secrets taken, including a GitHub App private key.
socket.dev/blog/litellm-a…
The trick: push a workflow to a throwaway branch, let on: [push] run it with real secrets, delete the branch. 20 secrets taken, including a GitHub App private key.
socket.dev/blog/litellm-a…
8
11
73
22,447
🚨 New investigation: Socket found malicious LiteLLM workflows running 11 days before the attack, targeting 20 secrets including GitHub, cloud, and AI credentials.
After our disclosure, LiteLLM linked a stolen token to approval of the malicious release.
socket.dev/blog/litellm-a…
After our disclosure, LiteLLM linked a stolen token to approval of the malicious release.
socket.dev/blog/litellm-a…
3
12
50
6,191
Microsoft made TypeScript roughly 10× faster by porting its compiler and tooling to Go.
Now Cloudflare’s @voidzerodev team is working with the #TypeScript team on tsrs, a Rust port reporting up to 8× faster checks than TS 7.0 and ~70% less memory.
socket.dev/blog/cloudflar…
Now Cloudflare’s @voidzerodev team is working with the #TypeScript team on tsrs, a Rust port reporting up to 8× faster checks than TS 7.0 and ~70% less memory.
socket.dev/blog/cloudflar…
2
15
217
9,055
Socket retweeted
Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix.
The PHP Foundation’s postmortem says Chainguard unilaterally broke the embargo. From that point, any attacker could study the fix in binary form while every other PHP user was still waiting.
CVE-2026-109618 and CVE-2026-109619 let attackers run code on web servers without logging in. PHP runs 69% of websites whose server-side language is known.
The embargo was already under strain. The CVE IDs leaked the day before, and Calif accidentally posted an exploit video that evening. PHP pulled the release forward a day but held it until 14:00 UTC, because distributors were still packaging and an immediate release would have left many users without a clean way to update. Chainguard went first anyway.
Chainguard CEO Dan Lorenc says several vendors in the disclosure had reported exploits in the wild, and that he notified the group right after making the call. He did not name the vendors or publish evidence. PHP’s security team found no working public exploit by release time. Lorenc has since apologized for the added stress on PHP’s maintainers.
Chainguard’s disclosure policy allows it to shorten timelines when exploitation is active. The patch it shipped was PHP’s, shared under PHP’s embargo.
In July, Lorenc wrote: “Pre-disclosure protection extends exactly as far as the people you can vet and hold to an embargo.”
Coordinated disclosure only works if everyone holding the fix ships at the same moment. When one party goes early, the fix becomes a map for attackers, and the users still waiting carry the risk.
PHP owned its part. Its postmortem calls the long delay in fixing the underlying bug, first spotted in a 2024 audit, “a structural failure.” It is asking the companies that run on PHP to fund more engine engineers.
If you haven’t patched: update the PHP runtime itself, not just WordPress or your framework, to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Then restart your workers.
The PHP Foundation’s postmortem says Chainguard unilaterally broke the embargo. From that point, any attacker could study the fix in binary form while every other PHP user was still waiting.
CVE-2026-109618 and CVE-2026-109619 let attackers run code on web servers without logging in. PHP runs 69% of websites whose server-side language is known.
The embargo was already under strain. The CVE IDs leaked the day before, and Calif accidentally posted an exploit video that evening. PHP pulled the release forward a day but held it until 14:00 UTC, because distributors were still packaging and an immediate release would have left many users without a clean way to update. Chainguard went first anyway.
Chainguard CEO Dan Lorenc says several vendors in the disclosure had reported exploits in the wild, and that he notified the group right after making the call. He did not name the vendors or publish evidence. PHP’s security team found no working public exploit by release time. Lorenc has since apologized for the added stress on PHP’s maintainers.
Chainguard’s disclosure policy allows it to shorten timelines when exploitation is active. The patch it shipped was PHP’s, shared under PHP’s embargo.
In July, Lorenc wrote: “Pre-disclosure protection extends exactly as far as the people you can vet and hold to an embargo.”
Coordinated disclosure only works if everyone holding the fix ships at the same moment. When one party goes early, the fix becomes a map for attackers, and the users still waiting carry the risk.
PHP owned its part. Its postmortem calls the long delay in fixing the underlying bug, first spotted in a 2024 audit, “a structural failure.” It is asking the companies that run on PHP to fund more engine engineers.
If you haven’t patched: update the PHP runtime itself, not just WordPress or your framework, to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Then restart your workers.
The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early:
“This disregarded weeks of work by many parties toward a coordinated disclosure.”
socket.dev/blog/php-embar…
7
63
536
62,215
Socket retweeted
When agents become the interface, what replaces the security controls the UI provided?
Tomorrow at AGNTCon + MCPCon, I’ll debate that with Dexter Horthy, Ian Livingstone and Scott Sanders. Allie Howe moderates.
Oct. 22, 2:55 p.m. PT. Come join us.
Tomorrow at AGNTCon + MCPCon, I’ll debate that with Dexter Horthy, Ian Livingstone and Scott Sanders. Allie Howe moderates.
Oct. 22, 2:55 p.m. PT. Come join us.
1
2
7
753
The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early:
“This disregarded weeks of work by many parties toward a coordinated disclosure.”
socket.dev/blog/php-embar…
“This disregarded weeks of work by many parties toward a coordinated disclosure.”
socket.dev/blog/php-embar…
8
63
488
152,115
Socket retweeted
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
23
47
1,033
21,728
Socket retweeted
again? x.com/SocketSecurity…
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
4
6
33
4,060
The vulnerabilities let attackers execute code on web servers without logging in. Cloudflare is already seeing exploits in the wild.
Changing php.ini settings won't fully protect you. WAF rules are a stopgap. Patch the PHP runtime now.
socket.dev/blog/php-criti…
Changing php.ini settings won't fully protect you. WAF rules are a stopgap. Patch the PHP runtime now.
socket.dev/blog/php-criti…
0
4
5
1,519
🚨 PHP has released emergency patches for two critical RCE vulnerabilities. Organizations unable to patch are advised to take affected systems offline.
Believe it or not, PHP still runs an enormous amount of the web. And nearly half of #PHP sites run EOL versions.
Believe it or not, PHP still runs an enormous amount of the web. And nearly half of #PHP sites run EOL versions.
2
25
100
8,172
Socket retweeted
Socket flagged all seven malicious wheels within seven minutes of publication.
The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository.
Full analysis: socket.dev/blog/litellm-c…
The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository.
Full analysis: socket.dev/blog/litellm-c…
2
8
91
17,222
Socket retweeted
Don't look now, but this is problematic.
credential-stealers suck.
credential-stealers suck.
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
2
5
29
9,312
Socket flagged all seven malicious wheels within seven minutes of publication.
The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository.
Full analysis: socket.dev/blog/litellm-c…
The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository.
Full analysis: socket.dev/blog/litellm-c…
2
8
91
17,222
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
110
325
1,908
300,528
.@vltpkg 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile.
The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents.
socket.dev/blog/vlt-skills
The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents.
socket.dev/blog/vlt-skills
2
7
18
2,469