#python

A flaw in Google's reference C decoder for Brotli, the compression format many websites use, lets crafted compressed data write past the end of a buffer, which can crash a program, leak memory or, in some setups, run code. Node.js disclosed it on October 21 with credit to OpenAI's Codex Security researchers; the fix was in Brotli's source in February, but nobody knew then it was a security bug, The Register reports.

This week the fallout spread. Microsoft shipped out-of-band .NET updates on October 25, and Palo Alto Networks rolled out hotfixes for PAN-OS firewalls that inspect Brotli traffic. According to the Broccoli2Shell site, threat-intelligence firm ELLIO saw exploit traffic using the public proof of concept on October 26, and CISA added CVE-2026-111497 to its exploited-vulnerabilities catalog on October 27.

Anything that decompresses Brotli data from others with Brotli 1.0.3 to 1.2.0 can be exposed, including Node's built-in fetch and Python's requests when a Brotli package is installed. Patched programs must also be restarted, and container images rebuilt.

Version 1.107.0 of LiteLLM, a popular open-source Python gateway for calling AI models, was published to PyPI and Docker registries with malware on October 21, according to SafeDep and BleepingComputer. LiteLLM confirmed the compromise and says the release pipeline was hijacked; SafeDep says LiteLLM believes the attacker took three developers' GitHub CLI credentials from the logs of an internet-exposed internal deployment.

All seven wheels for Linux, macOS and Windows added three files that run whenever Python starts, even if litellm is never imported. One steals SSH keys, cloud and CI/CD credentials, AI tool tokens, browser passwords and stored model-provider keys; another checks in hourly and downloads and runs more code. The PyPI release was live from 11:39 to 13:23 UTC; Docker Hub and GHCR tags pointed to bad images for a couple of hours. Versions 1.106.2 and the 1.107.0 release candidates are clean.

BleepingComputer says affected systems should be isolated and rebuilt and all exposed secrets rotated, and warns that running Python or pip to investigate also triggers the malware.