News & Blog

AI Found the Cracks in PHP. A Forgotten AI Key Poisoned a Popular Python Package.

TL;DR

  • Days after AI-discovered flaws forced an emergency PHP patch, attackers are hammering servers, but confirmed break-ins are still hard to find. On the Python side, a key leaked from an AI-agent tool let hackers poison LiteLLM, a popular AI gateway, for about two hours.
Two stone gates on a navy background: a PHP elephant gate cracked under a glowing AI magnifying lens, and a Python gate where a shadowy hand turns a glowing key while a small robot watches.
AI illustration generated with Gemini; not a photo.

Two languages, one week, one common thread

Last week's security news belonged to two hugely popular programming languages. PHP, which runs most websites, spent the days after its emergency "PHP2Shell" patch fending off attackers. In Python, the go-to language for AI work, someone poisoned LiteLLM, a widely used open-source tool that lets apps talk to many AI models through one interface. AI shows up in both stories, in very different roles.

Two-column table comparing the PHP2Shell flaws and the LiteLLM supply-chain attack across three rows: role of AI, what happened, and status as of Oct 25-26.
Figure 1. How AI figured in each story. Sources: PHP.net, CrowdStrike, Sophos, Palo Alto Unit 42, WIRED, LiteLLM, Socket, Microsoft.

PHP: lots of noise, few confirmed break-ins

PHP shipped its PHP2Shell fixes on Oct 21. Cloudflare's analysis found millions of exploitation attempts within hours of disclosure, according to WIRED, and Amazon says the first attempt hit its decoy servers on Oct 17, four days before the patches. A live tracker run by the Delft Threat Intelligence Lab had logged more than 41,000 exploitation requests from more than 560 IP addresses in 67 countries by early Oct 26.

But trying is not succeeding. CrowdStrike reported on Oct 23 that it had seen no successful exploitation and no fully weaponized exploit. Many public exploits simply crash the server, and a working attack must be tuned to the exact PHP, system-library and app versions. Two vendors walked back early alarms: Sophos corrected a report of a successful attack (its data showed only scans and failed attempts), and Palo Alto Networks' Unit 42 retracted an update that had tied an attack on a European government agency to PHP2Shell. Unit 42 had counted more than 22.6 million potentially vulnerable exposed instances.

On Oct 23, PHP also published an informational advisory for CVE-2026-115560, a rarer remote-code-execution path in the "session upload progress" feature affecting only sites with an unusual mix of configuration and application code. PHP advises turning off session.upload_progress.enabled until the next regular release. Datadog notes that this setting does not fully protect against the original PHP2Shell bugs; only patching does.

Where AI comes in

WIRED reports some underlying PHP problems were identified in 2024 but judged too complex to exploit. Calif found the PHP2Shell flaws first, combining frontier AI tools with human expertise; OpenAI and Wiz then found them independently with AI. "The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed," Wiz's Sagi Tzadik told WIRED. CrowdStrike points to a cycle of discovery, rediscovery and patch circumvention "currently accelerated by AI-assisted vulnerability research." There are limits: Calif's Ryan Austin cautioned that no model can unearth "all bugs" with simple prompts, and Sophos says building a working exploit "is proving challenging even with AI support."

Python: a poisoned AI gateway

LiteLLM is downloaded about 92 million times a month from PyPI, Python's main package library, according to BleepingComputer. On Oct 21, a malicious version, 1.107.0, sat on PyPI for about two hours, and tainted Docker images lingered a little longer. The safe pin is 1.106.2.

Microsoft and LiteLLM say the malware planted startup files in Python's library folder, so simply starting Python could trigger it, even if a program never used LiteLLM. It went after cloud credentials, AI-tool and model-provider keys, developer secrets and browser data. Microsoft's advice: don't run Python or pip in a suspect environment, and rotate every credential it could reach, because removing the package isn't enough.

The AI connection is how the attackers got in. LiteLLM's Oct 23 root-cause report says that in May a configuration file in a public repository exposed the master key to the LiteLLM Agent Platform, an experimental tool LiteLLM used to run AI agents that file code changes. The commit was overwritten, but the key was never revoked, and the platform held an organization owner's GitHub token that was not scoped down. On Oct 10, the attacker used the key to grab that token, then ran throwaway workflows that stole more maintainers' secrets, as Socket also documented. On Oct 21, those tokens were used to bypass branch protection and approve a release built from a lookalike repository. (An early LiteLLM update blamed a different source; the Oct 23 report corrected it.)

Five-step timeline: May 27 master key for LiteLLM's AI-agent platform exposed in a public repo; Oct 10 attacker uses it to get an owner's GitHub token; Oct 10 and 12 throwaway workflows steal more secrets; Oct 21 11:39 UTC poisoned litellm 1.107.0 published; about two hours later the package is pulled.
Figure 2. From a leaked AI-agent key to a poisoned package. Source: LiteLLM's Oct 23 root-cause report; Socket.

Python's own ecosystem was busy too. After eight intermediate certificate-authority keys from eMudhra turned out to be trivially recoverable, the widely used certifi package removed the affected emSign roots (advisory Oct 20), and CPython added a blocklist for the compromised certificates (CVE-2026-115557) plus a tarfile fix (CVE-2026-114583), shipped in expedited releases on Oct 26. The AI link there is thinner: the keys were found with Google's free paranoid_crypto tool, though security engineer Ryan Hurst reports that Mozilla's Dennis Jackson saw AI agents recover them on the first try.

Why it matters for business and IS (analysis)

This section is analysis and opinion, not reported fact.

  • AI is emptying the "too hard to exploit" drawer. Bugs that were parked because no human would bother can now be found and proven. Patch backlogs and old software versions are a business risk, not a technical footnote.
  • Attempts are not breaches. Two security vendors walked back early claims last week. Managers should ask for evidence before declaring an incident, in either direction.
  • AI agents are privileged identities. LiteLLM's agent platform held an owner-level token. Treat agent keys like admin passwords: least privilege, short lifetimes, rotation and an up-to-date inventory.
  • The AI supply chain is now part of the software supply chain. An AI gateway holds keys to many model providers at once, so one poisoned package can expose an organization's AI spending and data.
  • Rotation is cheap; breaches are not. A key leaked in May and used in October is a governance gap that a basic secret-rotation policy would likely have closed.

Sources