Popular AI tool LiteLLM says unrevoked key allowed hackers to target users

AI Summary

LiteLLM, an open-source AI gateway tool used widely by AI developers, disclosed that a signing key accidentally exposed in May was exploited in a supply chain attack that reached tens of thousands of users in the week of October 19. The unrevoked key allowed attackers to inject malicious packages into the LiteLLM distribution pipeline, highlighting the risk of long-lived exposed secrets in open-source AI tooling.

Read full article → https://therecord.media/litellm-hackers-ai-malware

Relevance score: 63.0/100

# More from October 26

1
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking The Hacker News
2
PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer
3
PHP2Shell Exploitation Moves From Probes to Working Shells SecurityWeek
4
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs The Hacker News
5
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages SecurityWeek
6
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations The Hacker News
7
Industrial Vendors Check Products for PHP2Shell Vulnerabilities SecurityWeek
8
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento The Hacker News
10
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts The Hacker News