LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

thehackernews.com Oct 22, 2026

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

Curated by Shubham · TechCapsules · Oct 22, 2026

AI-summarised brief · reviewed before publication

LiteLLM revealed that threat actors breached its release pipeline on October 21, 2026, pushing a malicious 1.107.0 version to Docker Hub and PyPI. The poisoned package contained a credential‑stealing backdoor that exfiltrated secrets to a remote server and fetched additional payloads from a GitHub‑hosted domain file. Users who installed the unpinned version between 11:39 a.m. and 1:23 p.m. UTC were affected. The incident exposed a compromised GitHub CLI token and an exposed internal deployment, enabling the attackers to hijack the release workflow.

💡 Why It Matters

· The breach demonstrates how a single compromised credential can unlock an entire open‑source supply chain, turning a widely used library into a vector for large‑scale credential theft and cloud infrastructure exploitation.

Capsules Cybersecurity

Read full article on thehackernews.com

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft revealed that the China‑aligned threat actor Storm‑0940 exploited the ARTEX AI framework to compromise the ConnectWise Cloud Backup supply chain. Using ARTEX, the group performed rapid scanning, password spraying, and OAuth abuse, targeting over 2,250 tenants at 2,900 attempts per minute. The attack, active since 2021, reached privileged cloud access within hours, affecting sectors from aerospace to finance. The incident underscores the growing use of AI‑driven tools for automated, high‑speed cyber intrusions.

💡 The case shows how AI accelerates credential abuse, shrinking detection windows and enabling attackers to pivot quickly across cloud environments. It signals a new era where automated tools can turn routine supply‑chain vulnerabilities into global, multi‑sector breaches.

thequantuminsider.com · Oct 22

Black Kite Adds Quantum Readiness Checks for Third-Party Vendors

Black Kite has launched Quantum Readiness controls within its Cyber Rating platform to evaluate third‑party vendors’ preparedness for post‑quantum cryptography. The new checks scan for hybrid key exchange, certificate signature readiness, and assets lacking migration plans, and feed results into the SSL/TLS Strength category. The feature aims to help organizations identify supply‑chain gaps, track vendor progress, and meet looming regulatory deadlines such as NIST’s 2030 deprecation of RSA and EU’s 2026 cryptographic roadmap.

💡 By exposing which vendors are already adopting quantum‑safe encryption, the tool forces supply chains to confront an imminent threat that could compromise data long before quantum computers become mainstream.

thehackernews.com · Oct 22

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported…

Node.js issued security patches on Oct 21 for its three supported branches—22.x, 24.x and 26.x—addressing ten vulnerabilities. The most critical flaw is in the bundled Brotli decoder, where malformed input can cause an out‑of‑bounds write and potentially remote code execution when an app processes attacker‑controlled Brotli data via zlib or fetch(). Fixed versions are 22.23.4, 24.22.1 and 26.12.1; earlier lines (20.x and older) are end‑of‑life and remain vulnerable. The patch applies an upstream Brotli 1.2.1 fix that validates input earlier. A proof‑of‑concept caused a crash and limited memory read on builds, but no live exploits have been reported. Other fixes cover TLS certificate validation, DNS resolution and random‑number generation bugs, and the update blocks Indian CA keys while refreshing bundled components.

💡 Millions of web services rely on Node.js’s built‑in compression, so the unpatched Brotli bug could let attackers execute code on any vulnerable server that handles compressed traffic.

appleinsider.com · Oct 22

Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix

Attackers are exploiting two newly disclosed PHP vulnerabilities, CVE‑2026‑109618 and CVE‑2026‑109619, to compromise internet‑exposed network‑attached storage (NAS) devices. The flaws permit unauthenticated remote code execution on PHP versions 8.2 through 8.5, which many NAS manufacturers embed in their web interfaces or run in Docker containers. Amazon’s security team observed an exploitation attempt on October 17, four days before the PHP project issued patches on October 21. The vulnerabilities affect both vendor‑supplied firmware and third‑party applications, meaning any NAS with a reachable PHP service is at risk of data theft or ransomware deployment. Users are urged to apply the official PHP updates immediately and to restrict external access to NAS management ports. Failure to patch could expose photos, documents, and backup archives on your NAS.

💡 Unpatched NAS devices can become open gateways for attackers to hijack critical personal and business data.

ign.com · Oct 22

Playasia Store Pulled Offline After Weeks of ‘Increasingly Sophisticated and Relentless Attacks’

Hong Kong‑based online retailer Playasia announced it had shut down temporarily after weeks of sophisticated cyberattacks targeting the company and its partners. CEO Jan Neuhäußer said the attacks were part of a coordinated, systemic campaign, prompting a full security audit and system hardening. Playasia, founded in 2002, has served gamers for nearly 24 years with region‑exclusive games and collectibles. The shutdown occurs amid “Black October,” when a critical PHP flaw threatens 70% of websites, though no direct link has been confirmed.

💡 The incident underscores how even established niche e‑commerce platforms are vulnerable to large‑scale, targeted attacks, highlighting the growing sophistication of cyber threats in the gaming industry. It also illustrates the broader impact of systemic vulnerabilities, such as the PHP flaw, on global digital infrastructure.

9to5mac.com · Oct 22

What’s going on with the web? The PHP issue and sites going…

A widespread outage has affected thousands of websites after a critical security flaw was discovered in PHP, the scripting language that powers roughly 70% of the internet. The flaw, identified by AI models and a cybersecurity researcher in mid‑August, combines two vulnerabilities that could grant attackers direct access to a site’s file system or database, risking massive data exposure. The PHP Foundation has issued a patch, but many sites remain unpatched, prompting the NSA to advise taking vulnerable sites offline until updates are applied.

💡 The incident exposes how a single, under‑secured core technology can jeopardize data security on a global scale, forcing major organizations to halt operations and reevaluate their reliance on legacy code.