LiteLLM supply-chain attack traced to leaked master key never revoked since May
Scobleizer · x · 2026-10-25
Cybersecurity Pulse digest highlights:
- LiteLLM supply-chain attack root cause: a master key exposed May 27 was never revoked; attackers used it Oct 10 to obtain a GitHub org owner's OAuth token, ran malicious CI workflows to harvest maintainer credentials, then changed and approved the poisoned v1.107.0 release (Oct 21). Lesson: deleting a leaked secret from repo history isn't revoking it.
- Firewall breach campaign: attackers breached Fortinet and Palo Alto firewalls, exposing 70,000+ credentials worldwide, days after Fortinet urged patching critical bugs (details withheld until Nov 10).
- Oracle's October patch fixed 1,295 vulnerabilities, six rated CVSS 10.0.
More from Safety
- Security researcher: AI code rewrites may push companies to drop OSS dependencies — chrisrohlf · 2026-10-25
- Sam Altman: models find 'hardware-level' bugs, and patching them all may be impossible — nptacek · 2026-10-25
- Cornell University terminates Flock Safety contract, orders removal of all Flock cameras from campus — Polymarket · 2026-10-25
- Duo Founder Shows How to Automate a YubiKey for Agentic Logins — vincent_koc · 2026-10-25
- Abliterated models let attackers run wild with no KYC while Claude won't even do basic cyber defense — jarrodwatts · 2026-10-25
- Ex-OpenAI researcher: the 'attacker diffusion lag' shielding us from AI misuse may close fast — joshua_saxe · 2026-10-25