LiteLLM’s investigation connects an October 10 secret-stealing workflow to the October 21 publication of compromised litellm==1.107.0 artifacts. Socket independently found traces of the earlier workflow. The maintainer says token hashes link a stolen maintainer credential to approval of the later release.
Why it matters
The revised timeline shows why reviewing only the final package upload can miss the earlier breach of the release boundary. Repository credentials, workflow execution and publishing approvals all belong in the same investigation, while downstream exposure still depends on whether affected artifacts ran.
Supported action
Review October repository and CI activity as well as installations of the affected PyPI and container artifacts. Preserve logs, identify credentials available to the compromised workflows and affected processes, rotate exposed tokens from a trusted environment, and rebuild from verified clean artifacts.
The PHP project released security updates for two engine flaws tracked as CVE-2026-109618 and CVE-2026-109619. Under the conditions described by the PHP Foundation, an unauthenticated request can reach code execution. This is a major runtime vulnerability, not a compromise of PHP packages or its release process.
Why it mattersThe vulnerable boundary is inside PHP, so updating a framework or plugin alone does not address the engine flaws. Applications and hosting stacks need to identify the PHP runtime actually serving requests, including long-lived workers and containers.
The Node.js project rates CVE-2026-111497 high severity. Malformed Brotli data can drive an out-of-bounds write when an application decompresses attacker-supplied input through node:zlib. The affected supported release lines are 22.x, 24.x and 26.x. This is a runtime vulnerability, not evidence that Node.js distribution was compromised.
Why it mattersThe critical question for operators is whether untrusted compressed data can reach the bundled decoder in their service. A vulnerable runtime alone does not establish remote exploitability in every deployment, but a reachable decompression path can place process memory at risk.
Socket’s October investigation found malicious GitHub Actions workflows added through compromised maintainer accounts. Its initial case study covered 346 repositories; a later update identified a wider set of accounts and repositories. The workflow sought both CI secrets and credentials exposed in source or git history.
Why it mattersA workflow in a repository can inherit the project’s automation privileges. Its presence is a warning to inspect execution history; a completed malicious run changes the response from a repository cleanup to a credential-exposure investigation.
Socket’s package analysis identifies malicious releases in both the MemTensor npm plugin and the MemoryOS package on PyPI. The packages included a Go binary that searched developer environments for secrets. This is one distribution compromise spanning two registries, not two unrelated stories.
eMudhra says eight intermediate certificate authorities had weak, recoverable keys and were revoked. A GitHub advisory records Mozilla’s OneCRL block for the affected certificates. The issuer says its root key was not compromised, while root-store distrust and certificate migration create a separate operational impact for customers.
LiteLLM’s investigation connects an October 10 secret-stealing workflow to the October 21 publication of compromised litellm==1.107.0 artifacts. Socket independently found traces of the earlier workflow. The maintainer says token hashes link a stolen maintainer credential to approval of the later release.
The PHP project released security updates for two engine flaws tracked as CVE-2026-109618 and CVE-2026-109619. Under the conditions described by the PHP Foundation, an unauthenticated request can reach code execution. This is a major runtime vulnerability, not a compromise of PHP packages or its release process.
The Node.js project rates CVE-2026-111497 high severity. Malformed Brotli data can drive an out-of-bounds write when an application decompresses attacker-supplied input through node:zlib. The affected supported release lines are 22.x, 24.x and 26.x. This is a runtime vulnerability, not evidence that Node.js distribution was compromised.
Socket’s October investigation found malicious GitHub Actions workflows added through compromised maintainer accounts. Its initial case study covered 346 repositories; a later update identified a wider set of accounts and repositories. The workflow sought both CI secrets and credentials exposed in source or git history.
Socket’s package analysis identifies malicious releases in both the MemTensor npm plugin and the MemoryOS package on PyPI. The packages included a Go binary that searched developer environments for secrets. This is one distribution compromise spanning two registries, not two unrelated stories.
eMudhra says eight intermediate certificate authorities had weak, recoverable keys and were revoked. A GitHub advisory records Mozilla’s OneCRL block for the affected certificates. The issuer says its root key was not compromised, while root-store distrust and certificate migration create a separate operational impact for customers.