Free to read · get new articles by email
The Pressentify Blog
Backend engineering, explained for people who ship.
Category
Security
2 articles
LiteLLM 1.107.0 was a credential stealer: how it got into the release workflow
A malicious LiteLLM 1.107.0 sat on PyPI for about 1h41m on 21 October 2026 and stole secrets at install time. The timeline, the release-workflow hole, and an audit you can run today.
· 8 min
PgBouncer 1.26.1 fixes an auth bypass: one SCRAM password can log in as any user
CVE-2026-107350 lets a client that knows one SCRAM user's password log in as another, admins and superusers included. Two denial-of-service bugs ship in the same release. What to check and what to patch.
· 3 min
Get the next one in your inbox
One practical backend article at a time. No spam; unsubscribe in one click.