A researcher-named PHP remote-code-execution bug and OpenAI's own coordinated vulnerability-disclosure push land the same week a study finds Qwen3-Coder writes less secure code when told the request is for a US persona, and a compromised LiteLLM package on PyPI installs a credential-stealing backdoor.