How-To: A Home Lab Checklist After the LiteLLM and PHP2Shell Attacks

Two big attacks this week, the trojaned LiteLLM 1.107.0 and PHP2Shell, are good reasons to run through a quick check of any home lab. Here’s the checklist I’d use. Adjust it to your own setup.

1. LiteLLM

• Find every install: pip show litellm in each venv, and docker ps / docker images | grep litellm.
• If anything ran 1.107.0 (or the latest, main-latest or main-stable tags), look for /tmp/.pc_once_* and /tmp/remote_code_loader.lock, and look for unexpected cook.pth or sitecustomize.py files in site-packages.
• If you find any, treat the machine as compromised. Rebuild it and rotate every key it could reach.
• Pin to a known-good version (1.106.2 or a later fixed release), and pin Docker images by digest.

2. PHP2Shell

• Check php -v on every web host and container, and update to the fixed PHP release for your branch.
• Restart PHP-FPM and your web server so the new binary is actually in use.
• Look through your access logs for odd requests hitting session upload-progress paths around the disclosure dates.

3. General hygiene

• Keep AI gateways, model servers and admin panels off the public internet.
• Keep API keys in a secrets store, not in shell history or world-readable files.
• Take backups before any upgrade, and make sure you can restore them.

Have a blessed day! And Happy Hacking!

References & Further Reading

• LiteLLM supply chain attack hoovers up passwords and secrets (The Register)
• Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure (The Register)
• PHP Downloads