PHP2Shell RCE 與 LiteLLM PyPI 後門：全球七成網站受衝擊，eMudhra 私鑰被破解

詳細網頁版與參考連結：https://podcast.david888.com/post/2026-10-22

本日科技焦點聚焦重大資安危機：LiteLLM 遭供應鏈攻擊植入後門；AI 挖掘出深埋 PHP 核心十年的雙重重大 RCE 漏洞，社群特別提醒關閉 session 設定無效，唯有升級才能防禦。此外，eMudhra 憑證機構竟因單位元組私鑰疏失遭輕易破解。生態方面，OpenAI 進駐 Google Cloud，開源資料庫 DuckDB 推出 2.0 LTS 並匯入 AI 模式，vLLM 與開源模型 Flint 亦展現實力。

相關連結：

• Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
• Security advisory: Critical remote code execution vulnerabilities, update now
• PHP2Shell: AI uncovers critical RCE in PHP
• DuckDB 2.0.0 LTS “Cinnamon Teal”
• PHP2Shell Is a PHP Remote Code Execution Bug Whose Official Workaround Doesn't Work by Rohit Bhadani
• Using Claude to reduce the attack surface of code
• Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
• PHP patches for critical PHP2Shell vulnerabilities (r/netsec)
• Using thousands of AI agents to uncover new leads in biological data
• OpenAI models are coming to Google Cloud
• Today's PHP security release, and how we're strengthening security
• vllm-project / vllm (94,862 ⭐)
• RecursiveSI/flint (40B A2.5B) · Hugging Face (r/LocalLLaMA)
• The Future of CSS