October 25, 2026
- LiteLLM's post-mortem traces the poisoned 1.107.0 release to an unrevoked master key (earlier coverage). A config file committed to the public
LiteLLM-Labs/lite-harness repo on May 27 carried the Agent Platform master key; the commit was force-pushed over but the key was never rotated. On October 10 the attacker used it to pull an unscoped GitHub CLI OAuth token tied to the org owner's account, exfiltrated two maintainers' tokens via a webhook.site endpoint, then on October 21 overrode branch protection and repointed the release pipeline at a lookalike Berri-AI/litellm repo. PyPI quarantined the package 1h17m after publication. (The Hacker News)
· AI & Model Security - SOCRadar mapped an exposed AI intrusion ecosystem used by INC and The Gentlemen ransomware affiliates. The framework, called Phantom, runs on OpenCode with OpenRouter-hosted commercial models under an "AI-executed, human-approved" structure: a human supplies a victim-specific prompt and reviews each step. An open directory at 45.227.254.43 logged 8,257 messages across 133 sessions. When models refused a request, the operator rewrote it as an authorised red-team assessment rather than switching models. Exploitation records name CVE-2024-57727 (SimpleHelp), CVE-2026-35616 (FortiClient EMS), and CVE-2026-41940 (cPanel/WHM) as actively exploited, with SonicWall, WordPress, LiteLLM and Drupal bugs staged or developed. In one case a single reused password unlocked VPN, servers, RMM, backup and security management platforms at once. (The Hacker News)
· Threat Activity
in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox
October 24, 2026
- LiteLLM now traces its poisoned release to a master key exposed in May that was never revoked, replacing the earlier theory that GitHub tokens were stolen from internal gateway logs. The key was used on October 10 to obtain a GitHub org owner's OAuth token; malicious CI workflows then harvested more maintainer credentials, and stolen identities approved the pipeline that published the backdoored v1.107.0 on October 21. Socket independently recovered malicious workflows executed on October 10 and 12 (LiteLLM, BleepingComputer) — a materially different root cause than the earlier post-mortem.
· Supply Chain & Trust
in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug
October 23, 2026
- LiteLLM's post-mortem points at its own AI gateway logs. The project says it observed Claude Code responses containing GitHub CLI OAuth tokens that could land in gateway logs, and suspects attackers reached its internet-facing internal LiteLLM deployment, lifted tokens, used an organization-owner token to disable branch protections and served poisoned artifacts from a lookalike repository. How attackers got into the gateway is still unconfirmed (earlier coverage). LiteLLM, The Hacker News
· Supply Chain & Identity
in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them
October 22, 2026
- LiteLLM 1.107.0 shipped a credential stealer and backdoor in all seven PyPI wheels and a published container image. Socket says startup hooks execute whenever Python starts—even without importing LiteLLM—and can steal cloud, developer and AI credentials or load remotely supplied Python. Container provenance points to
Berri-AI/litellm, a lookalike of the legitimate BerriAI/litellm. Approximately 23 million downloads per week measures package reach, not infections. Stop deploying 1.107.0; investigate environments where Python ran, rebuild from verified artifacts and rotate exposed secrets. SafeDep adds technical analysis. (discussion)
· Supply Chain & Developer Security
in PHP2Shell Is Already in the Wild
October 15, 2026
- LiteLLM gateway flaws chain to full system compromise. Check Point found that missing authorization on
/config/update, combined with environment-variable injection, enabled remote code execution and arbitrary file access through the widely used LLM management layer. Check Point Research
· AI & Model Security
in A Crafted Attachment Can Root Cisco’s Secure Email Gateway
September 11, 2026
- Wiz scanned ~3,000 internet-facing LiteLLM gateways and found 9.6% accepted the documented example master key
sk-1234 or required no auth at all — which turns a post-auth root RCE via custom code guardrails (CVE-2026-59821) into an effectively pre-auth one. An MCP endpoint auth bypass (CVE-2026-59822) lets any Bearer token mint a valid session, was confirmed exploitable on hundreds of instances, was added to CISA KEV on 2 September, and Wiz saw it exploited in the wild on its honeypots. A pass-through endpoint with no URL validation enables cloud credential theft and was not assigned a CVE or fixed. Patches exist for the rest; the work was presented at DEF CON 34 (Wiz, The Hacker News).
· AI Infrastructure & Agent Security
in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign
August 28, 2026
- Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court facing 14 combined offences over alleged membership in TeamPCP, the group behind the March 2026 compromises of open-source scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM (The Hacker News). The AFP describes a syndicate that "created malicious open-source software to rob thousands of global businesses"; Krebs has the deepest account of the multi-year package-registry campaign and the US–Australian cooperation behind the arrests (KrebsOnSecurity).
· Supply Chain & Takedowns
in Australia Charges Two Over the TeamPCP Supply-Chain Spree
August 13, 2026
- Two malicious LiteLLM releases — traced to the earlier Trivy compromise — mapped potential exposure to 2,100+ organizations. The rogue PyPI packages sat live ~40 minutes in March but carried credential-stealing code that harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords; CloudSEK's dataset was built from ~434,000 captured files, per The Hacker News and SecurityWeek. Kevin Beaumont, who confirmed the leak against multiple victim orgs, calls it a "massive supply chain" incident rooted in orgs adopting GenAI tooling without secrets hygiene. (discussion)
· AI & Model Security
in ShieldBreak Turns a "Patched" Defender Bug Back Into SYSTEM