While you were patching PHP, LiteLLM went and get compromised again.
https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919
IFINLiteLLM Compromised Again: Credential Stealer and BackdoorLast Updated: 2026-10-21T18:41:47Z (UTC) What’s Happening LiteLLM has been compromised again. litellM 1.107.0 on PyPI has a credential stealer and a backdoor. The official litellM 1.107.0 Docker image is also affected. Both of these run when any python process is ran, regardless of if they import litellm or not. Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are not compromised, nor are the pinne