Installing Python packages can run malicious code; teams urged to pin hashes and delay new releases

·6 views

A recent compromised LiteLLM release on PyPI reportedly stole credentials and planted a backdoor, highlighting that installing packages can execute code. The article explains that malicious code can run before import through setup.py in source distributions, through .pth files in site-packages that execute at interpreter startup, or via transitive dependencies. Attackers typically target environment variables, cloud and SSH credentials, and CI secrets before exfiltrating them. The suggested defenses include pinning exact artifact hashes, avoiding source distributions, applying a seven-day cooldown on new releases, and running pip-audit in CI.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Testing Live Watchlist Events Reliably by Modeling Presence, Not Timing

The article argues that flaky tests for a live trading watchlist stem from treating event time, batching, and delivery as timing problems rather than state. It recommends making event time an explicit dependency, flushing batches using a defined watermark, and asserting symbol presence as a state transition instead of relying on fixed sleeps. The author notes that batching delays are intentional and that transport ordering from protocols like WebRTC does not define what counts as current in the application. A deterministic reducer that tracks each symbol's latest sequence and status can be tested with an in-memory clock, while the network layer is tested separately. The approach keeps the production batching rules intact while removing sources of noise from CI runs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hearing words is not the same as understanding a request

Listening involves more than receiving words; it also requires checking understanding and making corrections usable in action. In a fictional kitchen example, a clarifying question prevents someone from handing over the wrong bowl. Research by Apperly and colleagues on adults interpreting instructions from another person's perspective is cited, though the article notes these experiments do not show how such abilities develop in childhood. The author suggests focusing clarification on differences that affect the outcome, and stating a brief summary of what was understood so mistakes can be corrected. The piece also argues that corrections should update the planned action rather than merely being recorded in memory.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PHP2Shell flaws and stolen UpdraftCentral keys threaten PHP and WordPress sites

Emergency PHP patches on October 21 address two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which score 9.2 and can let unauthenticated attackers run code on web servers. Nearly all PHP versions back to 5.4 are reportedly affected, with Apache mod_php carrying the highest risk, and the bugs can also leak memory containing other users' credentials. Separately, attackers breached the developer of the UpdraftPlus WordPress backup plugin and are using stolen UpdraftCentral keys to install backdoor plugins that create hidden admin accounts. Administrators are advised to check PHP versions against fixed releases, restart services after patching, and review sites for unexpected plugins and users. Updating UpdraftPlus and removing the connection key are recommended as immediate cleanup steps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Probabilistic graph neural networks aim to monitor aquaculture ponds under real-time policy limits

A developer built a sensor network across several fishponds in a cooperative near their city to track water quality. They found that per-sensor forecasting models missed cross-pond effects, since shared water channels let problems such as ammonia spikes spread between ponds. Treating the sensor layout as a graph, with ponds as nodes and hydrological connections as weighted edges, allowed the model to capture those dependencies. The work extends this to probabilistic inference and to enforcing regulatory constraints such as discharge limits and antibiotic restrictions in near-real time. The article describes the resulting architecture and lessons from testing it.

0 comments Read more at DEV Community