supply-chain

• AI Brief, 22 October 2026: the decade-old PHP flaws that needed a model to become exploits

  22 October 2026

  PHP shipped an emergency release on 21 October for two unauthenticated RCE flaws reaching back to version 5.4, and the AI claim attached to them concerns exploitation rather than discovery. The same day, a malicious litellm release spent two hours on PyPI carrying an implant built to steal coding-agent credentials.

← All tags