Today’s briefing covers a supply chain compromise of the LiteLLM AI proxy, active exploitation of critical PHP vulnerabilities adopted by Mirai botnet operators, and Anthropic’s preview of a proactive AI agent that anticipates user tasks. Each story highlights evolving risks in software supply chains, web infrastructure, and AI-assisted workflows.
Listen to today’s briefing (podcast)
LiteLLM Supply Chain Attack via Compromised GitHub Tokens
SecurityWeek reports that attackers used compromised GitHub CLI OAuth tokens to publish a malicious version 1.107.0 of the LiteLLM open-source LLM proxy to PyPI and Docker Hub on October 21. The poisoned packages were available for roughly three hours and downloaded over 49,000 times before removal. LiteLLM’s investigation found the tokens belonged to an innocuously named user account in an internal deployment exposed to the public internet, and were likely leaked by Claude Code embedding them in response bodies that were logged.
The attackers leveraged three sets of developer credentials to disable branch protections, redirect the release workflow to a lookalike repository (Berri-AI/litellm posing as BerriAI/litellm), and sign and publish the malicious artifacts. The payload extracts three files into site-packages that execute on every Python interpreter run, deploying an information stealer and a remote access trojan (RAT).
The stealer harvests system information, browser credentials, cloud secrets (AWS, GCP, Azure), AI API keys (Anthropic, GitHub Copilot, OpenAI), SSH keys, shell history, and GPG keys, encrypting and exfiltrating data to litellm[.]dev. Wiz observed credential abuse beginning 4.5 hours post-exfiltration, including Amazon Bedrock queries suggesting LLMjacking. StepSecurity notes the RAT checks a GitHub dead drop hourly for attacker-supplied Python code. Enterprise customers using LiteLLM’s private repository were unaffected.
Why it matters: This attack underscores the critical need to secure CI/CD pipelines, manage OAuth tokens carefully, and monitor for anomalous credential usage to prevent supply chain compromises that can steal sensitive credentials and enable further attacks.
PHP2Shell RCE Vulnerabilities Actively Exploited, Mirai Botnet Adopts Them
Kurumsal BT & Güvenlik reports two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (each CVSS v4.0 9.2), discovered by Wiz, OpenAI, and Calif in August 2026. PHP issued emergency patches on October 21 for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 after CVE identifiers leaked. Amazon Threat Intelligence detected first exploitation attempts on October 17, with AWS CISO CJ Moses noting varied payloads and anonymization infrastructure suggesting multiple actors, though success rates remain unclear.
Sophos observed threat actors attempting to deploy Potassium, a Mirai-derived botnet variant first seen in early 2026, via PHP2Shell, but the attempt was blocked. VulnCheck developed an ASLR bypass exploit for CVE-2026-109618 on hardened x86-64 configurations, available to its customers. SOCRadar and Hunt.io found attacker tooling and scanning against 123 servers, but no confirmed compromises. Sansec revised its initial mass-exploitation warning, stating public exploits fail against default PHP configurations.
Qualys data from 12,000 customers shows only 199,000 instances patched within 12 hours; roughly 110 million (71%) run end-of-life PHP 5.4–8.1 and will never receive vendor patches, while 44 million on supported branches remained unpatched as of October 23. Precautionary patching caused outages across European government, school, and hospital sites, with the UK reporting 32 services unavailable. PHP also disclosed another unpatched RCE, CVE-2026-115560, affecting unusual configurations, mitigated by setting session.upload_progress.enabled=0. VirusTotal estimates over 5.1 million PHP hosts exposed online.
Why it matters: IT professionals must urgently patch supported PHP versions, assess legacy systems that will never receive fixes, and monitor for exploitation attempts that could lead to server compromise and Mirai botnet recruitment, while everyday users face potential disruption of critical services and increased DDoS risk.
Anthropic Launches Claude Duet Proactive Agent App
Anthropic video producer Josh demonstrates Claude Duet, an early research preview that messages the user first with proactive suggestions. After a week of use, it planned an entire video shoot including a gear list, and each morning delivers a short action list — such as script feedback and studio booking — tailored to the day. It also drafted a reply to a back-order camera email, awaiting only the user’s approval before sending.
The agent maintains continuity with the user’s existing Claude instance, preserving memory and connected app integrations so no re-onboarding is needed. In one example, a single voice note at morning produced a complete project plan by lunch. All actions require explicit user approval via an “approve button,” ensuring human-in-the-loop control.
Why it matters: For IT professionals, this demonstrates a proactive AI agent that retains memory and app integrations across sessions, reducing context-switching and manual task triage; for everyday people, it shows an assistant that anticipates needs while keeping final control with the user.
n8n — n8n lets developers build and deploy their own proactive AI agents with visual workflows and integrations. Try n8n to create custom AI agents that can automate tasks and integrate with your tools. Try n8n
Affiliate disclosure: some links in this description are affiliate links. If you sign up through them, SysArticles may earn a commission at no extra cost to you. We only mention tools that are relevant to the story.
These developments illustrate how supply chain integrity, legacy infrastructure patching, and AI agent autonomy are converging as critical focus areas for security and productivity. Stay vigilant and apply updates promptly.
Ali YAZICI is a Senior IT Infrastructure Manager with 15+ years of enterprise experience. While a recognized expert in datacenter architecture, multi-cloud environments, storage, and advanced data protection and Commvault automation , his current focus is on next-generation datacenter technologies, including NVIDIA GPU architecture, high-performance server virtualization, and implementing AI-driven tools. He shares his practical, hands-on experience and combination of his personal field notes and “Expert-Driven AI.” he use AI tools as an assistant to structure drafts, which he then heavily edit, fact-check, and infuse with my own practical experience, original screenshots , and “in-the-trenches” insights that only a human expert can provide.
