Real Python AI News · Weekly edition · The week of October 17–23, 2026
Stop Falling Behind on AI. Catch Up in Five Minutes.
New models, new prices, new agent tools, all the time. Our new AI newsletter gives you the handful of stories you actually need as a developer. Free, straight from the Real Python team.
A popular AI tool was booby-trapped this week and old web flaws turned dangerous, so much of the news is about keeping the software you depend on safe. The other big story is AI code breaking free of a single chip maker. Here’s the week, explained in plain language.
A tainted LiteLLM update hands attackers passwords and keys
![Screenshot of the source page: [SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest/main-stable removed): cook.pth credential stealer + sitecustomize RCE loader, built from lookalike re](https://files.realpython.com/media/s-compromised-litellm-1-107-0-pypi-framed.4808b54edf78.png)
Many companies that build with AI rely on LiteLLM, a free tool that connects their software to dozens of AI models through a single gateway. Version 1.107.0 is booby-trapped. Every copy on PyPI, the public catalog where Python programmers download add-on tools, and in its Docker images, packaged copies for servers, carries hidden malicious code.
A stealer runs whenever Python starts, collects credentials (the passwords and access keys that unlock accounts, including AI and cloud keys), and sends them to the attacker. A backdoor, a secret entrance, checks in every hour and can run whatever code the attacker sends. The bad version is gone from PyPI and Docker, but machines that installed it stay infected.
The maintainers’ security report says they believe stolen access keys were used to publish it. Anyone who installed 1.107.0 should remove it, replace every AI and cloud key that machine could reach, and lock their setup to version 1.106.2, which is clean.
“This is a supply chain attack, where the attacker poisons one tool that many companies download automatically instead of breaking into each one. AI tools are tempting targets because they hold the keys to paid AI services and cloud accounts. If your business uses AI software, ask your technical team whether LiteLLM 1.107.0 was ever installed, and if so, to treat its secrets as stolen.”
— Philipp Acsany, Real Python
PHP closes two serious security holes in software behind many websites
PHP is the programming language behind a big share of the web, including sites built on WordPress, Drupal, and Joomla. Its new security release, versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, closes two critical holes that the security company Wiz calls PHP2Shell.
Both allow remote code execution: a stranger on the internet, with no login, can make a website’s server run their own commands. The PHP Foundation, which funds PHP’s development, scores them 9.2 out of 10 and says a full attack works on a common server setup left at default settings.
Wiz traces the weaknesses back to PHP 5.4, and a PHP developer spotted early signs of one during an outside security review in 2024, though nobody found a practical way to use it then. Since August, three separate teams, among them Wiz and OpenAI, have each turned the flaws into working attacks. Wiz says advanced AI models helped it link several small bugs into one attack.
“AI is making old, hard-to-use weaknesses dangerous much faster, so delaying updates is riskier than before. Anyone running PHP should update now, and if a hosting company runs your site, check that it has installed the fix. The Foundation now uses AI tools to check PHP’s own code too.”
— Philipp
Popular AI software now runs directly on Google’s own chips
Google rents out its own AI chips, called TPUs (tensor processing units), through Google Cloud. But most AI programmers use PyTorch, a free toolkit for building AI in the Python programming language, and their code is usually written for GPUs: graphics chips, mostly from Nvidia, that do most of the world’s AI math. Moving that code to TPUs took awkward changes.
Google and Meta’s PyTorch team now offer TorchTPU, a bridge that runs PyTorch directly on Google’s chips. It’s open source, public and free to use. It supports running code line by line as written (eager mode) as well as torch.compile, which first turns a model into a faster form. Google says some of its largest cloud customers already use it.
In the simplest case, a programmer swaps one word in the code, “cuda” (Nvidia’s GPU label), for “tpu”. The model then runs, though not at top speed, since it was likely tuned for GPUs. Hugging Face, a popular site for sharing AI models, offers the same switch in its widely used Transformers library.
“So much AI code assumes Nvidia’s GPUs that changing chips can mean costly rework. A one-word switch makes Google’s chips a more realistic option for companies renting computing power. The open question is how much extra tuning real projects need to reach full TPU speed.”
— Philipp
DeepSeek opens up the engine behind its own AI service
Most AI companies keep the software that serves their models private. DeepSeek, a Chinese company known for AI models anyone can download, now gives its version away. DeepSeek says DeepInfer is the engine behind its own production services. Running a trained model to get answers is called inference. The Apache 2.0 license lets anyone use and change the code for free, even in commercial products.
For now, it supports one model, DeepSeek-V4.1-Flash, on recent Nvidia GPUs called SM100 and on the Ascend 950 from Huawei, the Chinese tech giant.
It isn’t the full system yet. It handles only offline inference: batches of prepared requests, not live users. It leaves out the KV cache system, which manages a model’s short-term memory of a conversation, plus load balancing and splitting the prefill and decode stages (reading the question and writing the answer) across machines. Its deterministic modes, which give identical output for identical input, work only on Nvidia chips.
“How efficiently a company runs its models shapes what each AI answer costs, so this code usually stays in-house. Now others can serve DeepSeek’s model the way DeepSeek does, on Huawei hardware as well as Nvidia’s. DeepSeek says support for future models will follow, but it’s not yet clear whether the missing live-service pieces will arrive too.”
— Philipp
Reflection’s large AI model Beam is now free to download and run
Reflection, an AI company, now lets anyone download Beam, the large model it announced in early October. An AI model is the program behind an AI assistant, and its weights are the settings it learned in training. With Beam’s weights public, a business can run the model on its own computers instead of renting it, which is called self-hosting.
Beam has 501 billion parameters, its individual learned settings. Thanks to a mixture of experts design, only the specialist parts a task needs switch on, about 23 billion parameters at a time, which makes it cheaper to run. Reflection says it’s built for coding, reasoning, and agent work, where the AI carries out tasks on its own.
The files are on Hugging Face under the Apache 2.0 license. Reflection also offers Beam as an online service in test mode and lists more than 40 partners and integrations, including Amazon Web Services and Google Cloud.
“The strongest AI systems usually stay with their makers, so customers pay per use and send data out. A large model under a permissive license lets businesses keep sensitive information in-house and tailor the AI to their work. For now, Beam’s performance numbers come only from Reflection.”
— Philipp
A startup’s AI drafts whole answers at once, at high speed
Inception, a small AI company, now offers Mercury 3, an AI model that writes in an unusual way. Most chatbots build replies left to right, one token (roughly a word or part of a word) at a time. Inception’s model uses diffusion instead. It starts from a rough version of the whole reply and sharpens many parts at once, like a blurry photo coming into focus.
Inception measures 1,068 tokens per second on Nvidia GPUs and says that’s four to eight times faster than rivals. It can also read a million tokens at once, up from 260,000 for the previous version. Inception also claims its answers match fast models from bigger companies, a claim no published tests back.
Software makers pay $0.20 per million tokens sent in and $0.70 per million written, half price for now at launch. It’s available from Inception and through Vercel AI Gateway, a service that gives apps access to many companies’ AI models.
“Nearly every popular chatbot writes word by word, so a fast, cheap model built another way tests whether that approach can compete. Speed matters most when someone is waiting, as in a support chat or a voice assistant. Until outside testers compare its answers with its rivals’, only the speed and price stand on their own.”
— Philipp
Claude proves 123 software libraries won’t crash, within set limits
Formal verification is a mathematical proof, checked by a computer, that a program follows certain rules for every possible input, not just the ones a tester tried. It has long been slow expert work. Working with a company called Theorem, Anthropic reports that Claude produced such proofs for 239 entry points (the spots where outside data enters a program) in 123 open-source libraries, building blocks that other programs rely on.
Each proof shows the code won’t crash or corrupt memory for any input under 64 MB, but only under stated assumptions: a RISC-V processor (one kind of chip design) running Linux, doing one task at a time, with fixed memory. Most people run these libraries on other machines, and Anthropic stresses that verified doesn’t mean bug-free.
Claude also found and patched hundreds of bugs, many of which Anthropic says fuzzing (firing huge numbers of random inputs at a program) would likely miss.
“These libraries open compressed files and images inside countless everyday apps, so one crash bug can become a security hole for all of them. Proofs at this scale suggest strong guarantees needn’t stay limited to projects that can hire specialists, and Theorem offers to run the process for other open-source projects. So far, though, the proofs only cover a setup that few people run.”
— Philipp
Other AI News
- Railway breach may expose customer secrets: Railway says an intruder may have decrypted some customer environment variables. Deployments are paused, and every user should rotate environment variables and API keys. Railway links it to attacks on AI inference providers.
- OpenAI’s GPT-6 models preview on Google Cloud: GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna reach Model Garden in private preview for select enterprise customers.
- Anthropic’s Claude Platform arrives on Google Cloud: The full Claude API, with same-day betas, now runs under Google Cloud IAM and billing and counts toward your Google Cloud commitments.
- Recursive’s Flint, an open-weight local coding model: A 40B mixture-of-experts model with 2.5B active, Apache 2.0, built for offline agentic coding.
- Mistral’s Voxtral 3 speech models and agent SDK: Speech-to-text and text-to-speech models plus a real-time voice agent SDK. The 4B Mini transcription model costs $0.0035 per minute, via API or self-hosted.
- AWS’s TorchNeuron brings PyTorch to Trainium: AWS open-sources TorchNeuron under Apache 2.0, so existing PyTorch code runs on Trainium chips without a rewrite.
- ElevenLabs’ Eleven Realtime speech-to-speech models: Mini and Max models with 90+ languages and an OpenAI Realtime API-compatible interface, so existing voice-agent code can switch providers. Speed figures are ElevenLabs’ own.
- OpenAI’s Decisions API is generally available: The GPT-6 Luna-based API handles classification, routing, and next-action calls, which OpenAI says run up to 10x faster. It adds prompt caching and US/EU data residency.
Dive in Deeper
Real Python helps you understand the concepts behind the news. Deepen your knowledge with these resources:
How attackers sneak bad code into the tools programmers download, as in this week’s LiteLLM attack, and how to defend against it.
Tutorial
Supply Chain Security for the Age of AI-Speed Exploits
Learn Python supply chain security as AI speeds up attacks: what the LiteLLM backdoor teaches, how to check your setup, and habits that last.
How Python programmers install add-on tools and lock them to a known-good version, the fix for the LiteLLM attack.
Tutorial
Using Python's pip to Manage Your Projects' Dependencies
What is pip? In this beginner-friendly tutorial, you'll learn how to use pip, the standard package manager for Python, so that you can install and manage packages that aren't part of the Python standard library.
What PyTorch is and how it compares with its main rival, now that TorchTPU runs it on Google’s chips.
Tutorial
PyTorch vs TensorFlow for Your Python Deep Learning Project
PyTorch vs Tensorflow: Which one should you use? Learn about these two popular deep learning libraries and how to choose the best one for your project.
How to download and run shared AI models with Hugging Face, where Beam’s files are published.
Tutorial
Hugging Face Transformers: Leverage Open-Source AI in Python
Get hands-on with Hugging Face Transformers in Python. Download, run, and inspect pretrained open-source AI models, and speed up inference on GPUs.
That’s it for this week.
If you want the most important AI news straight to your inbox, sign up below.
– The Real Python Team
Stop Falling Behind on AI. Catch Up in Five Minutes.
New models, new prices, new agent tools, all the time. Our new AI newsletter gives you the handful of stories you actually need as a developer. Free, straight from the Real Python team.
