LiteLLM 1.107.0 was poisoned, and PHP's two critical bugs
A credential-stealing LiteLLM release sat on PyPI and Docker for under two hours, PHP patched two critical RCE flaws, and Anthropic handed Agent Skills to the Agentic AI Foundation.
The common thread today is credentials: the ones sitting in your logs, the ones an agent shouldn’t hold, and the ones you now have to rotate.
1 · Top story
A poisoned LiteLLM release stole cloud and AI keys
LiteLLM says version 1.107.0 was compromised: the PyPI wheels were live for about two hours on 21 October, and the Docker Hub and GHCR tags (including latest) for a little longer. The malware steals credentials and loads remote-code tools. The attacker used three developers’ GitHub CLI OAuth tokens, and the post says such tokens can show up in LiteLLM logs when response bodies are logged. The investigation is still open, and the entry point isn’t confirmed.
If you run a gateway, pin 1.106.2 or earlier, rebuild images and virtual environments from scratch, and rotate every provider key, master key, database password and role the host could reach. Don’t start Python in an affected environment before cleaning it. The longer lesson is about logs: a proxy that records response bodies is a credential store.
2 · Agents
Agent Skills joins the Agentic AI Foundation, alongside three more specs
The Linux Foundation announced four new projects for the Agentic AI Foundation on 22 October: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba. The foundation now hosts ten projects, MCP and A2A among them. Anthropic says more than 70 agent platforms have integrated Agent Skills since the format was published in December 2025.
The practical shift is that a skill format, a multi-provider API spec, an RL environment hub and a sandbox runtime now sit under neutral governance. If you’ve been waiting to see which agent plumbing outlives its vendor, this is a reasonable signal to build skills against the open format. Licences and versions for the new projects weren’t in the announcement.
3 · Research
Retrieval tricks that help alone don’t add up
A preprint tested 450 RAG configurations across eight benchmarks, with corpora from 5K to 200K documents. Three retrieval techniques that each helped on their own predicted about +47% NDCG@10 when combined, and delivered about +17%. The best combination also changed with corpus size, and what improved retrieval quality didn’t always improve answer faithfulness.
The architectural point is that you can’t stack improvements from other people’s benchmarks and expect the sum. The authors released a framework, “lasagna”, though the per-configuration data is only available on request.
4 · People worth following
PHP patched two critical RCE bugs, and the leak made it a scramble
Simon Willison walks through the PHP security release: two remote code execution holes across the PHP 8.x line, with the release pulled forward a day to 21 October after CVE details and a proof-of-concept video leaked. Wiz Research reported the bugs on 24 August.
Google Cloud’s advisory scores them 9.2 and lists affected versions from PHP 5.4 through 8.5.11, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier won’t be patched, so that’s an upgrade rather than a patch for anything old, such as the PHP services quietly sitting behind your retrieval or admin tools. Google says its own platform isn’t vulnerable but customers’ apps may be.
5 · Architecture
NVIDIA’s OpenShell keeps real credentials out of the agent’s hands
OpenShell is an Apache-2.0 runtime where each agent gets its own sandbox, with kernel-level limits on files and syscalls and outbound connections checked against a declared policy. The notable part is that agents never see real credentials: OpenShell adds them only to requests headed for approved endpoints, and risky policy changes wait for human review. It’s on the 0.1.x line, and the README doesn’t call it production-ready.
Credentials injected at the edge is the pattern to copy, whatever runtime you pick. Today’s LiteLLM story is the case for it: if the agent never holds the token, the token can’t end up in a log.
Also worth knowing
🆕 New on the radar
- Claude Duet — Anthropic’s proactive agent app that watches connected apps, flags what needs attention and checks with you before acting; research preview by waitlist for US Pro and Max subscribers, runs in a cloud VM with its own browser. Watch. Source
- Omnara — an Apache-2.0, self-hostable alternative to managed agent platforms, from a Show HN on 21 October; its README says local defaults are intentionally insecure. Watch. Source
🧰 Models & tools
- Harbor with Docker Sandboxes — the open-source agent eval framework now runs each task in its own microVM, locally or in Docker Cloud Sandboxes; Docker tested 64 concurrent tasks and stable lands 23 October. Source
- Copilot usage metrics — the API now names skills, custom agents and MCP servers instead of lumping them under “other”, with up to 25 entries per record; it needs Copilot CLI 1.0.97 or later. Source
🏢 Platforms & enterprise
- Google Agent Compute Engine — hardware-isolated microVMs for agents with checkpointing, forking and SPIFFE-based identity, with credentials swapped in on the wire; not available yet, “targeted for preview in the coming months”. Source
🔬 Research
- Jellyfish productivity study — across 718 firms, AI agents lifted PRs 23% and resolved Jira issues 12%, but average PR review time rose 49%, so review is the new bottleneck. Source
Rotate one key today if you can, and leave the rest of the list for Monday.
Middle East, India & events · 1
- Chariot-1-ASR Realtime — Chariot, an Indian startup, says its real-time speech recognition for 10 Indian languages is out as of 22 October and beats every system it tested, including ones that wait for the full recording. Its page gives no benchmarks, language list or pricing. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →