Sourced tech, AI and security news.
Short reports that link their sources, plus free browser tools such as a lockfile checker.
Latest news
Every story links its sources
- Malicious LiteLLM 1.107.0 release on PyPI and Docker carried a credential stealer (thehackernews.com)A poisoned LiteLLM release on PyPI and Docker carried a credential stealer and an hourly backdoor. Affected builds, how the malware worked and how the attacker got in.Security · · 2 sources · read
- eMudhra to exit global SSL/TLS certificate business (emudhra.com)After an incident with its certificate authorities, the Indian trust company says it will withdraw from public TLS certificates.Security · · 3 sources · read
- PHP security releases fix two remote code execution bugs after early leak (thephp.foundation)Releases across PHP 8.x fix two RCE flaws reported by Wiz Research. Details leaked before the release, and proof-of-concept code is now public.Security · · 3 sources · read
How the checker works
Private by design
1Paste or drop a lockfile
requirements.txt, poetry.lock, package-lock.json or yarn.lock.
2Parsed in your browser
Your file is never uploaded to Caldrel. Only package names and versions go to OSV.dev.
3See the results
Known vulnerabilities and malicious-package reports, with fixed versions where OSV.dev lists them.
One short email a week
A weekly roundup of tech, AI and security news. Signups aren’t open yet. Follow @CaldrelHQ on 𝕏 to hear when they are.