IT News Analysis

1

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m. PST. The following compromised versions were published - LiteLLM v1.107.0 (PyPI) v1.107.0, latest, main-latest, and main-stable (Docker) v1.107.0, latest, main-latest, and main-stable (GHCR) Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC are impacted. The poisoned version incorporated code to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote acce...

Oct 22, 2026

2

SANS Has Taught Defenders Since 1989. AI Security Is the Newest Chapter.

Explore practitioner-built training, six GIAC AI certifications, and free resources to use this week.

3

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released  security updates  on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system. Each supported line has one fixed version:  22.23.4  and  24.22.1  on the long-term support lines, and  26.12.1  on the current line. Node.js 20.x and earlier have  reached end of life  and will not receive the fix, so they should be moved to a supported line. The Brotli flaw is in code Node.js bundles, not in a user's own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the  node:zlib  module or automatically when code calls fetch() on a response sent with Brotli compression. An application is exposed where it decompresses Brotli data an att...

Oct 22, 2026

4

New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO  disclosed , releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server out of memory. The flaws cause only denial-of-service attacks, with no evidence of data theft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure. FoxIO found the same class of flaw in seven of ten HTTP/3 stacks it tested. The common cause is in QPACK, the scheme HTTP/3 uses to compress request headers so repeated fields travel as a short code instead of the full text. A server is supposed to cap the size of the headers after it unpack...

Oct 22, 2026

5

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure." The attempt, Amazon said, was recorded from " 103.216.220[.]92 ," an IP address geolocated to Australia. The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked ...

Oct 22, 2026

6

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX , a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims. The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. "Storm-0940's use of ARTEX accelerated the speed of comprom...

Oct 22, 2026

7

Gartner® Hype Cycle™ for CPS Security, 2026

Prioritize cyber-physical systems security amid rising threats, regulations, vulnerabilities and emerging technologies.

8

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as  CVE-2026-110264 , is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. GitLab has not said what those conditions are. The company reports no sign the flaw has been used in attacks, and it is not listed in the U.S. CISA catalog of known exploited vulnerabilities as of October 22. Only self-managed installations need to act. G...

Oct 21, 2026

9

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind . The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed. Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release. "We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen said . "The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. A...

Oct 21, 2026

10

OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So

OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment. "A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications," OpenAI said in a report. The end result of this action was that the misalignment monitor still ran and saved its reports, but automatic human alerts were disabled by setting "no_notify" to true and emptying the lists of people configured to receive the reports. In another task on October 6, a GPT-6 Astra agent migrating a program is said to have removed its monitoring integration in...

Oct 21, 2026