# Socket Weekly: LiteLLM Compromised to Steal Cloud and AI Credentials… Canonical: https://brew.new/templates/socket/socket-weekly-litellm-compromised-to-steal-cloud-and-ai-credentials Brand: socket.dev Category: newsletter ![Preview of Socket Weekly: LiteLLM Compromised to Steal Cloud and AI Credentials…](https://cdn.brew.new/email-preview-05a1024a58eba271-tracking_r57p88vwmrkkmqeeds2z17hwgd8h19nt-1793096543243.png) ## Email content Socket Weekly Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes. Feross Aboukhadijeh Feross Aboukhadijeh Founder & CEO at Socket Top Story LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials A compromised release of litellm, the LLM proxy with around 23 million weekly downloads, shipped Python startup hooks that harvest cloud credentials, AI provider keys, SSH and GPG keys, and browser databases. The malicious files sit outside the package directory, so they run on any normal Python startup, whether or not anything imports LiteLLM. We later found secret-stealing workflows running in the repository 11 days before the release attack, and LiteLLM has since traced the root cause to an Agent Platform master key committed to a public repo in May and never revoked. Read more More News PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline PHP shipped emergency patches for two memory-safety flaws, collectively called PHP2Shell, that let an attacker run code on a web server without logging in, and the NSA recommended taking affected systems offline until they can be mitigated. The coordinated release fell apart beforehand, with the PHP Foundation saying Chainguard published patched container images more than six hours early, exposing the fix while everyone else was still waiting. Read more Cloudflare Introduces a Faster TypeScript Compiler Written in Rust Cloudflare is bringing tsrs, a Rust port of the TypeScript compiler, into its Oxc toolchain, reporting type checks up to 8x faster than TypeScript 7.0 while using around 70% less memory. Max Schwenk at Owner.com built the initial port with Claude coding agents, and the TypeScript team is now collaborating on it, with some of the optimizations landing in the official compiler. Read more More Worth Reading Sovereign Tech Agency Invests in OpenJS to Rethink When Vulnerabilities Should Be Fixed in the Open OpenAI’s red-team agents escaped sandboxes and talked to each other through the CPU cache Package managers have an integrity problem Rust 1.100 Will Add Dependency Cooldowns to Cargo The Internet goes on high alert after discovery of 8 compromised TLS certs Railway breach exposed customer environment variables, users urged to roll all keys Socket on X Socket on GitHub Socket on LinkedIn Socket on Bluesky Socket Inc. Secure your supply chain. Ship with confidence. 2810 N Church St., Wilmington, DE 19802 Book a Demo · Unsubscribe [Open and remix this design](https://brew.new/templates/socket/socket-weekly-litellm-compromised-to-steal-cloud-and-ai-credentials) [Browse email designs](https://brew.new/browse/templates)