Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
LiteLLM Supply Chain Compromise: Leaked Master Key Led to Malicious PyPI Package — Detection and Response Guide
Introduction LiteLLM disclosed on Friday that a threat actor pushed a malicious version of its widely deployed Python package after obtainin...
LiteLLM Supply-Chain Compromise: Malicious PyPI Package and Docker Images Steal Cloud Credentials — Detection and Response Guide
LiteLLM Release Pipeline Compromised: What Defenders Need to Do Right Now The LiteLLM project — one of the most widely deployed open-source ...
LiteLLM 1.107.0 Supply Chain Compromise: Detecting Python Startup Hook Credential Theft and Remediating Exposed AI Pipelines
Introduction Microsoft Threat Intelligence has published a detailed analysis of a supply chain compromise affecting LiteLLM 1.107.0, one of ...
ThreatsDay Defense Playbook: Laravel Auth Bypass, AI Secrets Leak, PingCAP Source Theft, LiteLLM Supply-Chain Risk and Tor Relay Hijacks
ThreatsDay Defense Playbook: Laravel Auth Bypass, AI Secrets Leak, PingCAP Source Theft, LiteLLM Supply-Chain Risk and Tor Relay Hijacks Thi...
LiteLLM 1.107.0 Supply Chain Compromise: PyPI Credential Stealer and Backdoor — Detection and Remediation Guide
Introduction The LiteLLM Python package — one of the most widely deployed libraries for routing calls to large language model APIs — has bee...
CVE-2026-35029 and CVE-2026-59823: LiteLLM Gateway Defense, Detection, and Remediation Guide
CVE-2026-35029 and CVE-2026-59823: LiteLLM Gateway Defense, Detection, and Remediation Guide LiteLLM sits in a dangerous place in enterprise...
LiteLLM Default Admin Key 'sk-1234' Exposed on 10% of Internet-Facing Gateways — Detection and Remediation Guide
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key In February 2026, Wiz Research scanned internet-facing Lite...
LiteLLM Under Attack: Defending Against Default-Key Auth Bypass, Unauthenticated MCP Sessions, and Root-Level Code Execution in Cloud AI Gateways
LiteLLM Under Attack: Defending Against Default-Key Auth Bypass, Unauthenticated MCP Sessions, and Root-Level Code Execution in Cloud AI Gat...
CVE-2026-59822: BerriAI LiteLLM MCP Authentication Bypass — Detection and Remediation Guide
Introduction On September 2, 2026, CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that an improp...