Weekly security roundup: LiteLLM poisoning, 2,250 M365 tenants hit, AI on both sides
aestheticedwar1 · x · 2026-10-23
A security blogger's weekly incident roundup highlights:
- ConnectWise Cloud Backup (high): a supply chain compromise used to go after more than 2,250 Microsoft 365 tenants.
- Railway (high): some users' env vars may have been read and decrypted; all users told to revoke keys.
- LiteLLM (high): release 1.107.0 on PyPI and Docker was poisoned; 1.106.2 is the last clean one.
- Capcom (medium): 11,774,247 email addresses exposed.
- GitLab (medium): max-severity RCE, not yet exploited.
- Arista VeloCloud (medium): exploited in the wild, but requires a login.
The author adds that AI is now on both sides: PHP2Shell was found with AI models, going from an old weak spot to a working exploit in about a week, while the ConnectWise attackers used an AI pentest framework.
Related event: Black October: AI Reshapes the Global Cybersecurity Landscape(18 posts)→
More from Safety
- Pennsylvania signs law requiring labels on AI-generated ads — The Verge AI · 2026-10-25
- Danish government quietly drops trial of open-source alternative to Microsoft Office — lowkeyokay · 2026-10-25
- 1Password lets AI agents sign into your accounts without ever seeing your passwords — LuizaJarovsky · 2026-10-25
- CrowdStrike reproduces PHP2Shell RCE variants, says weaponization obstacles delay exploitation — cyb3rops · 2026-10-25
- Cryptographer Matthew Green prods abliterated-model inference providers on security — matthew_d_green · 2026-10-25
- User warns: before linking your bank to ChatGPT Finances, turn off model training — NickSlayr · 2026-10-25