LiteLLM 1.107.0, uploaded to PyPI on 2026-10-21

LiteLLM 1.107.0, uploaded to PyPI on 2026-10-21, shipped a credential stealer that runs on every Python process start and names Claude Code, Cursor, Copilot, and Codex tokens specifically as theft targets, alongside SSH keys, cloud credentials, and CI/CD secrets. Four independent security vendors trace the injection to the wheel/build-artifact level, not the git tag itself.

Mozilla disclosed that private keys for eight eMudhra intermediate CA certificates were compromised, one reportedly as trivial as the number "4". Chrome, Firefox, Apple, and Microsoft all blocked the certificates within days, and Mozilla removed the issuing root from NSS outright rather than only blocklisting leaf certificates.

Wiz Research used three named AI tools (Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol) to find a PHP 8.x-wide RCE on 19 August, confirming unauthenticated exploitation against Drupal and WordPress within two days, then reported privately. A leaked proof-of-concept video on 20 October forced PHP to move its own public disclosure a full day earlier.

Claude by Anthropic does not appear in the 2026-10-22 Google Play top-30 capture, extending its absence to six consecutive days and meeting the project's own week-long bar for treating the drop as genuine rather than chart noise.

Anthropic is circulating a draft federal AI safety bill that would block a model's release if an independent evaluator finds a "foreseeable, imminent risk" of 50+ deaths or $1B+ in property damage from a bio-weapon, loss-of-control, or cyberattack scenario — thresholds mirroring California's SB 53. TechCrunch notes the bill doesn't obviously cover the rogue-agent incident pattern actually driving 2026's AI-safety coverage.

OpenAI's GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna entered private preview on Google Cloud's Model Garden, making Google Cloud the only major US hyperscaler reselling all three leading closed-source model families natively in one platform, alongside Azure and AWS distribution OpenAI already had.

stablyai/orca debuted on GitHub Trending at #3 (101,641 stars) — a desktop app that fans one prompt across a fleet of coding agents (Claude Code, OpenCode, and others), each in its own isolated git worktree, for the user to compare and merge results.

cloudflare/security-audit-skill held its GitHub Trending #1 slot a second day (37,119 stars, up from 34,589), while DietrichGebert/ponytail (172,009) and headroomlabs-ai/headroom (77,359) both continued climbing — four of today's top GitHub entrants are agent-harness or fleet tooling rather than models.