OpenAI: Cutting-Edge AI Model Discovers PHP Security Vulnerability Ahead of Attackers

The White House stated that the U.S. government was alerted to the PHP security vulnerability on October 16. It is closely monitoring the issue and coordinating with federal agencies and leading systems integration labs to accelerate the rollout of fix patches. The White House noted that federal agencies are evaluating the vulnerability’s potential impact on government systems and critical infrastructure, and are working with network operators to prioritize mitigation measures.

Beating AI Express: Security firm JFrog has discovered that popular open-source AI model gateway LiteLLM has fallen victim to another supply chain attack. Its latest v1.107.0 version was implanted with malware, and official Docker images were also compromised. LiteLLM enables unified access to models from providers like OpenAI and Anthropic, and centralizes API key management. It was previously targeted by a supply chain poisoning attack back in March this year. This latest attack is far more stealthy: hackers hid three extra files in Python packages. After installation, whenever users launch the associated Python environment—even without invoking LiteLLM—the malicious code runs automatically. It steals browser passwords, SSH private keys, AWS and other cloud platform credentials, plus authentication data for development tools including Claude, Codex, and Cursor. The malware also attempts to exfiltrate model API keys stored in LiteLLM’s database to servers masquerading as official domains. Attackers also embedded a persistent backdoor that checks for remote commands hourly, downloading and executing new code as needed. Notably, the official source code on GitHub contained no malicious files, but all seven platform-specific packages released to PyPI were infected with trojans. The community traced the issue via Docker build logs: the release system used a source address pointing to a fake repository that differed from the official one by only one hyphen. How the fake repo slipped into the release pipeline remains unconfirmed. PyPI has since removed the malicious versions, and Docker Hub has taken down affected images. JFrog warns users who installed or ran v1.107.0 to treat all related credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive data like API keys—rather than simply uninstalling the software. The confirmed safe rollback version is v1.106.2.

Tencent Cloud Security Center has detected a remote code execution vulnerability in PHP, with CVE identifiers CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". The flaw allows unauthenticated remote attackers to send specially crafted multipart POST requests to trigger memory corruption, leading to remote code execution that can result in full server compromise and other harms. Tencent Cloud Security recommends conducting timely security self-inspection; if your system is affected, update and patch immediately to prevent intrusion by external attackers.

Bybit CEO Ben Zhou said that Bybit plans to partner with established local firms when entering the U.S. market to compete with platforms like Robinhood. Citing Interactive Brokers as an example, he noted that it is more suitable at this stage to seek partners that already have a U.S. customer base and are looking to expand into crypto business. Ben Zhou added that applying for money transmission licenses state-by-state could take two to three years, so he prefers to wait for progress on the CLARITY Act and further clarity on the new regulatory framework before entering the U.S. at an opportune time rather than acting hastily. He believes the U.S. market, while large, is highly competitive and already saturated. Additionally, Bybit is exploring the U.K. market, but Ben Zhou said entry costs there are high, and the location of its London office has not yet been finalized. The company also plans to launch a comprehensive application in Europe as early as the first quarter of 2027, covering derivatives and tokenized stocks.

According to Forbes, driven by gains in SpaceX and Tesla’s share prices, Elon Musk reclaimed his spot as a trillionaire on October 21. His net worth increased by approximately $88 billion that day, hitting $1.013 trillion. SpaceX’s share price surged over 10% following the release of its better-than-expected third-quarter results, while Tesla’s rose more than 3%; Tesla was set to announce its earnings after U.S. markets closed the same day. Musk confirmed during SpaceX’s Tuesday evening earnings call that the two companies are exploring a merger. Musk became the world’s first trillionaire on June 12 when SpaceX went public, and has since fallen below and reclaimed the threshold multiple times; he most recently lost the status last week amid a decline in SpaceX’s share price.

According to official announcements, prediction market platform predict.fun stated in a post that it has launched six 15-minute up/down markets, with underlying assets including UNITREE, ZHIPU, SKHYNIX, SNDK, XAU, and CL (crude oil), and trading is now live.