Security
Compromised LiteLLM release pipeline pushes credential-stealing malware to PyPI and Docker
The malicious version 1.107.0 was live on PyPI for about two hours and stole cloud credentials, developer secrets and AI provider keys.
Thursday, October 22, 2026
Security
PHP ships fixes for the PHP2Shell flaws, and Amazon says someone probed them four days before disclosure
Palo Alto Networks says all PAN-OS and Panorama versions are affected. OpenAI says a firm using its GPT-5.6 Sol model found one of the two bugs.
Security
Microsoft attributes the ConnectWise supply-chain attack to China-aligned Storm-0940 using an AI agent framework
Microsoft says the group used the ARTEX agentic penetration-testing framework to reach more than 2,250 Microsoft 365 tenants.
Business & Policy
Judge orders Meta to pay New Mexico $25 billion for misleading Facebook users about privacy
It is the largest penalty ever imposed on the company and grows out of the Cambridge Analytica scandal.
Models
Anthropic launches Claude Duet, an AI agent for professionals and small business owners
The agent is available as a research preview and competes with Meta's Muse and OpenAI's Dots.
Models
Recursive releases Flint, a free laptop coding model it says was built largely by its automated research system
The startup says its Eureka Machine helped with nearly every development step, so a small team could build the model in under four months.
Research
OpenAI, PerturbAI and Scripps run 1,946 GPT-Rosalind agents on a mouse brain atlas in 32 minutes
The agents worked in parallel on existing CRISPR data from millions of mouse brain cells to produce hypotheses for scientists to test.
Business & Policy
Walmart opens its store to AI shopping agents while Amazon blocks them
The retailer's new Agent Gateway lets approved agents connect over the Model Context Protocol, with spending limits and purchase approval for customers.
Sources in this edition
PHP ships fixes for the PHP2Shell flaws, and Amazon says someone probed them four days before disclosure
- SecurityWeekPHP2Shell Exploitation Started Days Before Patches
- The Hacker NewsSomeone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- CyberScoopPHP releases emergency fixes for 2 critical vulnerabilities
- Help Net SecurityWhat the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers - Help Net Security
- TechCrunchPHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet | TechCrunch
- PPC LandOpenAI says GPT-5.6 Sol found a PHP flaw before attackers did
Compromised LiteLLM release pipeline pushes credential-stealing malware to PyPI and Docker
Microsoft attributes the ConnectWise supply-chain attack to China-aligned Storm-0940 using an AI agent framework
- Microsoft Security BlogAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security Blog
- CyberScoopMicrosoft pins ConnectWise supply-chain attack to China-state aligned threat group
- The Hacker NewsChina-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Judge orders Meta to pay New Mexico $25 billion for misleading Facebook users about privacy
Anthropic launches Claude Duet, an AI agent for professionals and small business owners
Recursive releases Flint, a free laptop coding model it says was built largely by its automated research system
OpenAI, PerturbAI and Scripps run 1,946 GPT-Rosalind agents on a mouse brain atlas in 32 minutes
- Research & Development WorldOpenAI runs 1,946 GPT-Rosalind agents on a mouse brain atlas