A Python AI Tool Was Just Booby-Trapped With Key-Stealing Malware

Real Python AI News · Weekly edition · The week of October 17–23, 2026

A popular AI tool was booby-trapped this week and old web flaws turned dangerous, so much of the news is about keeping the software you depend on safe. The other big story is AI code breaking free of a single chip maker. Here’s the week, explained in plain language.

A tainted LiteLLM update hands attackers passwords and keys

Many companies that build with AI rely on LiteLLM, a free tool that connects their software to dozens of AI models through a single gateway. Version 1.107.0 is booby-trapped. Every copy on PyPI, the public catalog where Python programmers download add-on tools, and in its Docker images, packaged copies for servers, carries hidden malicious code.

A stealer runs whenever Python starts, collects credentials (the passwords and access keys that unlock accounts, including AI and cloud keys), and sends them to the attacker. A backdoor, a secret entrance, checks in every hour and can run whatever code the attacker sends. The bad version is gone from PyPI and Docker, but machines that installed it stay infected.

The maintainers’ security report says they believe stolen access keys were used to publish it. Anyone who installed 1.107.0 should remove it, replace every AI and cloud key that machine could reach, and lock their setup to version 1.106.2, which is clean.

PHP closes two serious security holes in software behind many websites

PHP is the programming language behind a big share of the web, including sites built on WordPress, Drupal, and Joomla. Its new security release, versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, closes two critical holes that the security company Wiz calls PHP2Shell.

Both allow remote code execution: a stranger on the internet, with no login, can make a website’s server run their own commands. The PHP Foundation, which funds PHP’s development, scores them 9.2 out of 10 and says a full attack works on a common server setup left at default settings.

Wiz traces the weaknesses back to PHP 5.4, and a PHP developer spotted early signs of one during an outside security review in 2024, though nobody found a practical way to use it then. Since August, three separate teams, among them Wiz and OpenAI, have each turned the flaws into working attacks. Wiz says advanced AI models helped it link several small bugs into one attack.