LiteLLM ships a stealer, PHP needs patching, and a house that heats itself

Homelab Highlights for 2026-10-21: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

The Lead: LiteLLM 1.107.0 shipped a credential stealer plus an hourly-polling backdoor via PyPI and official Docker tags

The 1.107.0 release of LiteLLM on PyPI and the official Docker image carried an infostealer and a backdoor that polls the attacker’s server for new code every hour. The latest, main-latest, and main-stable tags all pointed at the bad image, so auto-updaters pulled it in. The payload reads the proxy’s credential table, cloud credentials, SSH keys, env vars, and Kubernetes tokens. The image has since been removed from Docker Hub and GHCR.

Why it matters: This is the second LiteLLM compromise this year. Last time, pinning your Docker tag kept you safe; this time the pinned official image itself was bad. Anyone who auto-updated must treat the host as compromised and rotate keys now.

Source: aikido.dev

News Roundup

Two critical PHP RCE advisories — php2shell — require immediate upgrade

Two PHP security advisories rated 9.2/10 were published: RCE via OOM corruption and RCE via stale global state. Exploits were demonstrated in the wild within hours. Patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Why it matters: If your homelab runs any PHP app — Nextcloud, WordPress, anything — these are trivially exploitable unauthenticated RCEs. Upgrade today.

Source: Jeff Geerling

Eight eMudhra intermediate CA certificates leaked — browsers revoke, but curl and libraries still trust them

Eight intermediate CA certificates from eMudhra were compromised. Browsers have revoked them, but curl and many libraries still accept them. Debian has shipped an updated ca-certificates package removing the affected roots. The compromised keys were weak — one was literally the number 4.

Why it matters: A real MITM risk for self-hosters using non-browser clients or containers with stale ca-certificates bundles. Update ca-certificates everywhere, including inside containers.

Source: r/selfhosted - Homelab Highlights top (day)

New Jellyfin plugin gives each user their own Live TV tuner and hides the rest

A plugin for Jellyfin 10.11.11 that assigns each user to one M3U tuner, blocks second streams, and hides upstream stream URLs from non-admins. It solves the problem of IPTV providers capping streams per connection on shared servers.

Why it matters: Great for family setups where each user has their own IPTV subscription. Pin your Jellyfin version and test before deploying.

Source: r/jellyfin - Homelab Highlights top (day)

Tool & Software Highlight: MuckScraper 1.0: self-hosted news aggregator with bias labeling and local LLM summaries

A self-hosted news aggregator that pulls articles from RSS feeds, groups coverage into stories using vector embeddings, labels outlets left/center/right, and writes summaries and analysis locally via Ollama. Features syndication detection, op/ed tracking, and a public sample site.

Why it matters: Runs on modest hardware (2 cores, 1.5 GB RAM) with a GPU box that powers off between runs. No cloud LLM required. The developer is seeking non-US bias references for UK, Europe, or Australia.

Source: github.com

Community Highlight: Open-source 3D digital twin of a house that coordinates heat pumps, solar, and battery

A 3D digital twin of a split-level house with 4 heat pumps, smart radiator valves, solar panels, and a battery. It runs in the browser with a thermal zone model, connects to Home Assistant for live data, and coordinates heating on solar surplus. Includes an A/B test toggle to measure actual savings.

Why it matters: A beautiful example of tying energy automation to a visual model. The A/B test toggle is a practical way to validate model predictions against real measurements. MIT licensed with a step-by-step guide.

Source: r/homeassistant - Homelab Highlights top (day)

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: So, the big one today: if you self-host LiteLLM and let anything auto-update it, go check your containers now. The 1.107.0 release on PyPI and the official Docker image carried an infostealer plus a backdoor. And because a recent, main-latest, and main-stable tags all pointed at the bad image, Watchtower-style auto-updaters pulled it in automatically. HOST B: That’s rough. Not a vulnerable version you forgot to patch — the patch itself was the attack. According to Aikido’s writeup, the payload went straight for the proxy’s credential table in the database, so every provider API key stored in LiteLLM was readable. On top of that it grabbed cloud credentials, SSH keys, environment variables, Kubernetes tokens. And the backdoor polls the attacker’s server for new code every hour, so it’s not a one-shot theft. HOST A: The image has since been pulled from Docker Hub and GHCR. A Reddit comment from the LiteLLM team points to an official incident blog, saying the situation is contained. But contained going forward doesn’t help anyone who already ran it. The quick checks are in the show notes — the important warning from the researchers is don’t exec into the container and run Python or pip to look around, because the payload triggers on interpreter startup. There are two marker files in tmp to look for instead: one means the stealer already ran, the other means the backdoor ran or is still running. HOST B: And here’s the part that stings for this audience. This is the second LiteLLM compromise this year — there was a PyPI incident back in March. Last time, pinning your Docker tag kept you safe. This time the pinned official image itself was bad, so the usual advice didn’t save you. If you get a hit: isolate the container from the network, rotate the provider keys from a different machine immediately, then rebuild. And pin images by digest instead of a moving tag for anything that holds API keys — one commenter put it well, running latest with an auto-updater is basically letting a stranger push to prod on a schedule.

Host B: From one bad morning to another — two critical PHP security advisories dropped today, nicknamed php2shell. Both are remote code execution bugs rated 9.2 out of 10, one via out-of-memory corruption and one via stale global state. Within a few hours of the bugs being publicized, some people were demonstrating exploits in the wild, according to the article. If the homelab runs any PHP at all — Nextcloud, WordPress, anything — upgrade today to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. HOST A: One bright spot in that story: Remi’s repo, the community PHP repository a lot of Red Hat-family users rely on, initially looked like it would lag because Remi was on vacation — and then he pushed the updates anyway, from vacation. Dedication. And then there’s the certificate mess. Eight intermediate CA certificates from eMudhra, an Indian certificate authority, were compromised. Browsers have revoked them, but the original poster showed curl still accepting certs signed under the affected chain, which matters for anyone running non-browser clients or containers with stale ca-certificates bundles. Debian already shipped an updated ca-certificates package removing the affected eMudhra-related roots. HOST B: Worth keeping perspective on that one, though. According to a Reddit commenter citing Mozilla, no public TLS server certificates were issued under the affected roots — only internal technical certs — and the twist is the compromised keys were weak to begin with. One Reddit commenter noted one of the keys was literally the number four. So it’s a genuinely bad CA incident, but the day-to-day browsing risk is low if your systems are patched. The real exposure is old containers and untrusted networks, so update the ca-certificates package everywhere, including inside containers, and watch your DNS. HOST A: Last quick one, and it’s a fun one: a new Jellyfin plugin that gives each user their own Live TV tuner and hides the rest. If you share a server and your IPTV providers cap streams per connection, stock Jellyfin lets any user grab any tuner and kick someone else off. This assigns users to specific tuners, blocks second streams, and hides the upstream stream URLs from non-admins — which matters because M3U playlists often embed provider credentials. It’s built and tested for Jellyfin 10.11.11 only, so pin your version and try it on a test box first.

Host A: Time for the tool highlight, and this one is a genuinely charming project: MuckScraper 1.0, out of beta after about six months of work. It’s a self-hosted news aggregator that pulls articles from RSS feeds, groups coverage from different outlets into a single story using vector embeddings, labels each outlet left, center, or right, and writes summaries and coverage analysis — all locally through Ollama by default. No cloud LLM required. HOST B: The standout feature is syndication detection. It catches when multiple outlets are just republishing the same wire report, and counts them once. The developer shared how the clustering actually works: cosine similarity handles the easy cases, and the ambiguous middle band gets sent to the local model for a yes-or-no call, plus a country check after a Nepal flood article once got merged into a Russian arms-depot story because both headlines said death toll rises. On 56 real borderline decisions, the current setup got 4 wrong. HOST A: And the hardware story is very homelab. The whole stack — Postgres with pgvector, Meilisearch, Flask, the scheduler — runs in containers on two cores of an old i7 with about 1.5 gig of RAM between runs, while Ollama lives on a separate box with a 10 gig GPU that powers off between runs and gets woken by Wake-on-LAN. Since April it’s stored around 120,000 articles grouped into 69,000 stories. That’s a lot of articles for a box that’s mostly asleep. There’s a public read-only sample site if anyone wants to kick the tires before committing disk space, and the developer is specifically asking for a non-US bias reference for the UK, Europe, or Australia.

Host B: For the community highlight: a homeowner with a split-level house, four heat pumps, gas radiators with smart valves, 4.3 kilowatts of solar, and a 5 kilowatt-hour battery noticed the classic autumn problem — the battery is full by early afternoon and gets exported for almost nothing, then the boiler burns gas at night to heat the same rooms. So the fix was a 3D digital twin of the house, built in plain HTML and three.js, running in the browser. HOST A: It’s not just eye candy, which is what makes it clever. There’s a small thermal zone model where each room heats, cools, and passes warm air up the staircase depending on which doors are open, drawn as thousands of colored dots. It connects to Home Assistant with a token for live temperatures and battery levels, and the coordination logic is a package plus three blueprints: a dynamic battery floor computed from the solar forecast, and a blueprint that runs the heat pumps on surplus one at a time — kids’ room first, the hungry attic last — only spending energy the sun will refill before sunset. HOST B: The detail worth stealing is the A/B test toggle. The model predicts about two degrees warmer rooms in the evening and roughly 30 percent less radiator heat overnight, but the builder is explicitly running alternating days with and without pre-heating to measure whether it’s actually true, and will post the real numbers. That’s the right instinct — model output versus measurement. It’s MIT licensed, there’s a step-by-step guide including calibrating the thermal model from your own history, and the builder specifically wants to hear whether the setpoint trick works in other houses.

Host A: That’s Homelab Highlights for Wednesday. Until next time, happy hosting!