LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.

Governments and companies are scrambling to protect their websites, as Amazon says it experienced attacks before the warning was made public.

This week a UN summit aims to preserve the world's plants and animals. But a group of scientists wants to protect another diverse kingdom of species they say are too often forgotten – fungi. Here's a look at these beautiful organisms, why they aren't protected and why mycologists are fighting for 'justice' for them.

Government websites throughout Europe became unavailable on Wednesday as operators raced to patch two critical vulnerabilities in PHP, a scripting language widely used in website development.

Under the theme “Experiences in Motion: Human-Centred Design in Travel & Tourism”, Asia-Pacific’s largest 3-in-1 travel trade show runs in Singapore from 21–23 October, bringing together more than 1,000 exhibiting brands and 1,500 qualified buyers. New for 2026 is the Experience Zone, bringing together companies offering travel experiences, activities and attractions, with the Experience Pavilion by Tripadvisor housed within it. Complimentary curated Guided Tours and an invitation-only networking session for association executives create further opportunities for industry exchange. Agoda, Tourism Fiji, Turespaña, Trip.com Group, Uganda Convention Bureau and many more feature among participating brands, while opening keynote speakers Lovrenc Kessler (Simon-Kucher) and Brett Henry (WebBeds) address the global travel outlook and competition in the age of AI.

Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system. Each supported line has one fixed version: