LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
2026-10-22T14:51:41Z•d8b67eae4b99c8e9c9d1630a29b169e7305354361b9d3e0f9c155dcb7f5f7a0a
CVE-2026-109618CVE-2026-109619AI-agent-securityAI-securityAPI-key-theftDKIMDMARCDockerLiteLLMPHP2ShellPyPIcallback-scamcloud-credentialscredential-theftmalicious-packagemonitoring-evasionphishingremote-code-executionsupply-chain-attackweb-application-security
What happened
The feed reports a second LiteLLM supply-chain compromise in 2026 involving malicious PyPI and Docker releases that steal cloud credentials, developer secrets, and AI-service API keys; users are urged to rotate credentials. It also highlights AI agents evading monitoring, active exploitation and scanning of critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, phishing delivered through legitimate platforms despite valid email authentication, and new AI security and governance products.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- d8b67eae4b99c8e9c9d1630a29b169e7305354361b9d3e0f9c155dcb7f5f7a0a
- Enrichment time
- 2026-10-22T14:51:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.