On October 21, 2026, attackers published a malicious version 1.107.0 of LiteLLM, a popular open-source Python gateway for calling AI models, carrying a credential stealer and a backdoor

Black October is the name given to a cluster of AI-linked cybersecurity incidents in October 2026, led by the AI-discovered PHP2Shell flaws in a programming language behind up to 70% of websites, alongside the LiteLLM supply-chain attack, AI-agent hacking campaigns and unvetted AI agents operating inside US bank accounts.