Meta $25 Billion Cambridge Analytica Penalty & LiteLLM PyPI Supply Chain Compromise - Hacker News (Oct 22, 2026)

A jury's math first came to two hundred nineteen and a half billion dollars. The judge brought it down to twenty-five billion, and that is still one of the largest privacy penalties ever handed to a tech company. Stay with us for the details. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. I'm TrendTeller, and today is October 22nd, 2026. It's a busy one for security: a poisoned AI library, two cloud platforms dealing with possible data exposure, and urgent patches for PHP and GitLab. Let's start in a New Mexico courtroom.

Meta $25 Billion Cambridge Analytica Penalty

A New Mexico court has ordered Meta to pay twenty-five billion dollars in penalties over the Cambridge Analytica scandal. The jury found that the company misled state residents about how it collects, protects, and polices user data. It counted more than forty-three million violations of the state's unfair practices law. At first that added up to over two hundred billion dollars, but the award was capped at the legal maximum per violation. The judge also said Facebook's post-scandal investigation was not the thorough review the company had promised, and called its conduct intentional and systematic. Meta says it will appeal. Either way, the ruling shows that state regulators can still go after very large penalties for privacy failures years after the fact.

LiteLLM PyPI Supply Chain Compromise

Now to security, starting with a supply chain attack on AI tooling. SafeDep reports that version 1.107.0 of LiteLLM, a widely used Python library for working with AI models, was compromised on PyPI. The malicious release shipped a credential stealer that ran whenever any Python process started on an infected machine, even if LiteLLM itself was never imported. It went after SSH keys, browser passwords, cloud credentials, CI tokens, and AI service keys. A second component installed a persistent backdoor that could pull down new code from the attacker at any time. The package was removed on October 21st, and the official Docker images for that version were also affected for a while. The likely entry point was stolen GitHub credentials belonging to a developer, which let the attacker get around branch protection. If you installed that version, assume your secrets are exposed.

Railway Environment Variables Security Incident

Railway, the app hosting platform, says it spotted unusual activity in the systems that store customer environment variables. An unauthorized party may have reached encrypted variables, and some decrypted values could have been exposed. Those values often include API keys and database credentials. Railway thinks this may be part of a wider wave of attacks on platform companies and AI inference providers. It has paused all deployments while it investigates and is asking every customer to rotate their credentials and check their logs.

Alleged PingCAP TiDB Cloud Breach

A separate report makes serious allegations against PingCAP's TiDB Cloud. It claims attackers took roughly ten point six terabytes of data, including customer SQL, API keys, support tickets, billing records, and source code, and that an export pipeline kept pulling data every six hours for weeks without anyone noticing. The post also says PingCAP had previously documented an isolation flaw that could expose customer data. None of this has been independently confirmed. If it holds up, though, the risk extends to many tenants of the service.

mitmproxy Adds eMudhra Compatibility Option

An update on the eMudhra certificate story we've been following. mitmproxy has added a new option that signs TLS certificates using the compromised eMudhra intermediate key. The goal is to give users in affected environments a controlled way to stay compatible, now that the eMudhra authorities have been removed from mitmproxy's prebuilt binaries.

PHP Critical Remote Code Execution Fixes

The PHP Foundation has released updates for PHP 8.5, 8.4, 8.3, and 8.2. They fix two critical flaws in the core engine that could let an unauthenticated attacker run code on a server. The issues came to light through an external audit, Foundation-funded work, and reports from several researchers. Leaks forced the release out earlier than planned. The Foundation says PHP's security process has improved a lot over the past two years, but it is asking the companies that rely on PHP for steady funding and experienced engineers.

GitLab Critical Security Patch Release

GitLab has also shipped critical patches across seven supported versions. The most serious fix is for an integer overflow in its regular expression compiler that could allow unauthenticated remote code execution. Other fixes cover an LDAP authentication weakness and cache poisoning in OAuth discovery endpoints. GitLab.com is already patched, but self-managed instances should upgrade right away.

DuckDB 2.0 LTS Released

On a calmer note, DuckDB has released version 2.0, a long-term support release nicknamed Cinnamon Teal. The team calls it its biggest feature release so far. Highlights include a client-server protocol, faster reading of remote files, better handling of semi-structured data, triggers, and a new extensible SQL parser. It will be supported until at least October 2027. There are some breaking changes, including a storage format that older versions can't read, so check the notes before you upgrade. The bigger picture is that DuckDB is moving from a handy embedded engine toward a full data platform.

Apple Drops Icons in macOS Menus

Finally, design. Apple has reversed the macOS Tahoe change that put an icon next to every menu item. One writer who had criticized the change points out that his best argument used to be that Apple itself never did this. Now Apple has tried it, shipped it, and dropped it after a year, and its Human Interface Guidelines use the Tahoe menus as an example of what not to do. As he puts it, that real-world lesson is more convincing than any appeal to tradition.

That's it for today's edition. If you run PHP, GitLab, LiteLLM, or Railway, now is a good time to patch and rotate your keys. Links to all the stories are in the episode notes. Thanks for listening, I'm TrendTeller, and see you tomorrow on The Automated Daily, hacker news edition.

Meta $25 Billion Cambridge Analytica Penalty & LiteLLM PyPI Supply Chain Compromise - Hacker News (Oct 22, 2026)

Our Sponsors

Today's Hacker News Topics