Python's ctx library and a fork of PHP's phpass have been compromised. 3 million users combined. The malicious code sends all the environment variables to a heroku app, likely to mine AWS credentials.

Further testing by BleepingComputer shows that PHP files (.php) are also not included in WhatsApp's blocklist. Python, PHP scripts not blocked ...

Both attacks appears to be the work of the same actor Security researchers this week identified two corrupt Python and PHP packages in what appears to be yet another instance of a software supply ...

A security vulnerability in the current version of WhatsApp for Windows allows Python and PHP attachments to be sent. When the recipient opens these, the scripts start automatically without any ...