VulnHub

Real-time Cybersecurity News

Critical

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

The Hacker News
Actively Exploited
Malware

Overview

In March, two malicious LiteLLM packages were available on the Python Package Index (PyPI) for about 40 minutes, containing code designed to steal sensitive information. These packages could extract cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from any systems that installed them. According to CloudSEK, a dataset created from approximately 434,000 files that attackers collected has been linked to over 2,100 organizations potentially affected by this incident. The short availability window raises concerns about the security of third-party package repositories and the risks they pose to developers and organizations relying on them. Users and companies need to be vigilant about the software they install and consider implementing security measures to protect against such attacks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: LiteLLM packages on PyPI, potential exposure for 2,100+ organizations
  • Action Required: Organizations should audit their systems for the presence of these malicious packages and remove any installations.
  • Timeline: Newly disclosed

Original Article Summary

Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more

Impact

LiteLLM packages on PyPI, potential exposure for 2,100+ organizations

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should audit their systems for the presence of these malicious packages and remove any installations. Additionally, implementing stricter controls on package installations and using tools to monitor for malicious activity can help mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Help Net Security

In August 2026, Microsoft released patches addressing over 400 vulnerabilities, including a serious zero-day exploit identified as CVE-2026-68820. This particular flaw is a use-after-free vulnerability affecting the Windows Ancillary Function Driver for WinSock (AFD.sys), which could allow a low-privileged local attacker to gain elevated privileges to the SYSTEM level. This means that attackers with local access could potentially execute malicious applications to take control of affected systems. The urgency of this update is underscored by the fact that the vulnerability is already being exploited in the wild. Users and organizations relying on Windows systems should prioritize applying these updates to mitigate potential risks.

Aug 12, 2026

Ivanti EPM Update Patches Remotely Exploitable Flaws

SecurityWeek

Ivanti has released an update to address vulnerabilities in their Endpoint Manager (EPM) that could allow attackers to exploit systems remotely. These flaws could lead to the leaking of credentials for external SQL connections or even crashing the agent service, potentially disrupting operations for affected organizations. Companies using Ivanti EPM need to prioritize applying this update to safeguard against these security risks. The vulnerabilities underline the importance of keeping software up to date to protect sensitive data and maintain system stability.

Aug 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Security Affairs

A security researcher known as Chaotic Eclipse has released a proof of concept (PoC) for a new zero-day vulnerability named ShieldBreak, affecting Microsoft Defender. This vulnerability successfully bypasses the previously issued patch for CVE-2026-50656, known as RoguePlanet, which was intended to address a race condition. If exploited, ShieldBreak could allow attackers to execute code with SYSTEM-level privileges on affected systems. This presents a serious risk to users of Microsoft Defender, as the flaw can potentially compromise the security of their devices. Companies using Microsoft Defender should take immediate action to assess their systems and apply necessary security measures to mitigate this risk.

Aug 12, 2026

Split-second deepfake glitch blows digital certificate fraudster’s cover

Help Net Security

Spanish police have apprehended a man in Murcia who allegedly used deepfake technology to bypass video identity checks from a certificate provider, aiming to acquire digital signatures for financial fraud. The suspect is reported to have made 38 attempts to deceive the system, targeting over 30 individuals. While the police have not disclosed how many of these attempts were successful, the case came to light after the certificate provider raised concerns. This incident emphasizes the growing threat of deepfake technology being exploited for fraudulent activities, which poses significant risks to individuals and businesses alike, as digital signatures are crucial for verifying identities in various online transactions.

Aug 12, 2026

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

The Hacker News

SAP has identified a serious security flaw in its Commerce Cloud service, specifically affecting the Data Hub Adapter. This vulnerability, labeled CVE-2026-58231, carries a CVSS score of 10.0, indicating its severity. It stems from inadequate authorization checks and poor input validation, which could allow unauthenticated attackers to execute arbitrary code on affected systems. The flaw poses a significant risk as it could lead to unauthorized access and manipulation of data within the Commerce Cloud environment. SAP has released patches to address this issue, urging all users to implement them promptly to safeguard their systems.

Aug 12, 2026

SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform

SecurityWeek

SonicWall has released patches for serious vulnerabilities found in its discontinued Global Management System (GMS) platform. These security flaws could enable attackers to execute arbitrary code remotely without authentication, potentially allowing access to sensitive information. Although the GMS platform is no longer supported, the existence of these vulnerabilities raises concerns about the security of any systems that might still be using it. Users and organizations that have not transitioned away from GMS should take immediate action to secure their environments. It's critical for businesses to stay vigilant about outdated systems, as they can still pose significant risks even after official support has ended.

Aug 12, 2026