[2026-10-22] PHP2Shell衝擊全球七成網站、LiteLLM爆發PyPI後門與八位元CA私鑰大崩潰

詳細網頁版與參考連結：https://podcast.david888.com/post/2026-10-22 本日科技焦點聚焦重大資安危機：LiteLLM 遭供應鏈攻擊植入後門；AI 挖掘出深埋 PHP 核心十年的雙重重大 RCE 漏洞，社群特別提醒關閉 session 設定無效，唯有升級才能防禦。此外，eMudhra 憑證機構竟因單位元組私鑰疏失遭輕易破解。生態方面，OpenAI 進駐 Google Cloud，開源資料庫 DuckDB 推出 2.0 LTS 並導入 AI 模式，vLLM 與開源模型 Flint 亦展現實力。 相關連結： Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor Security advisory: Critical remote code execution vulnerabilities, update now PHP2Shell: AI uncovers critical RCE in PHP DuckDB 2.0.0 LTS “Cinnamon Teal” PHP2Shell Is a PHP Remote Code Execution Bug Whose Official Workaround Doesn't Work by Rohit Bhadani Using Claude to reduce the attack surface of code Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds PHP patches for critical PHP2Shell vulnerabilities (r/netsec) Using thousands of AI agents to uncover new leads in biological data OpenAI models are coming to Google Cloud Today's PHP security release, and how we're strengthening security vllm-project / vllm (94,862 ⭐) RecursiveSI/flint (40B A2.5B) · Hugging Face (r/LocalLLaMA) The Future of CSS