{ "version": 1, "generated": "2026-10-23T10:38:09Z", "publisher": "Subcloak", "home": "https://headlines.subcloak.com/", "feed": "https://headlines.subcloak.com/feed.xml", "notes": "Indicators of compromise are stored live (not defanged). Times are UTC. Withdrawn headlines stay with status \"withdrawn\" and a withdrawnReason.", "headlines": [ { "id": "H-2026-0008", "url": "https://headlines.subcloak.com/h/h-2026-0008/docker-hub-flaw-let-converted-accounts-hand-personal-access-tokens-to-another-user/", "status": "confirmed", "severity": "medium", "headline": "Docker Hub flaw let converted accounts hand personal access tokens to another user", "dek": "A now-fixed Docker Hub flaw let a token act as someone else at the registry. Docker found no exploitation. Only users Docker emailed were exposed; check your tokens and revoke any you don't recognize.", "published": "2026-10-23T07:14:50Z", "updated": "2026-10-23T07:14:50Z", "ecosystems": [ "docker" ], "kinds": [ "vulnerability" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "Docker disclosed a vulnerability in Docker Hub. When a personal account was converted into an organization, its personal access tokens were reassigned to the person named as the new owner. The token secret was not changed, and that person was not asked to consent or notified.", "An attacker could create a token, convert their own account, and name a target as owner. The token could then act as the target at the registry, pulling, pushing or deleting images in the target's repositories. Docker rated the flaw critical, with a CVSS 4.0 score of 9.4.", "Access was limited to the registry. According to Docker, it did not reach the web interface or allow changes to passwords, email or two-factor settings, or account takeover.", "Researchers reported the flaw on September 30, 2026, and Docker deployed a fix to Docker Hub the same day. Docker says it reviewed about 304,000 pushes made with transferred tokens and found no evidence of exploitation. This was a vulnerability, not a breach of Docker's systems.", "Docker emailed affected users and organization owners on October 2 and deactivated the identified transferred tokens on October 8, except where owners asked to keep them. Conversion no longer transfers tokens, and naming an organization owner now requires consent. Nothing needs to be installed." ], "timeline": [ { "time": "2024-08-26T20:33:00Z", "event": "Exposure window begins: account conversion starts re-assigning personal access tokens to the new owner.", "source": 0 }, { "time": "2026-09-30T00:00:00Z", "event": "Researchers report the flaw to Docker, and Docker deploys a fix to production the same day.", "source": 0 }, { "time": "2026-10-02T00:00:00Z", "event": "Docker emails exposed users and their organization owners.", "source": 0 }, { "time": "2026-10-08T00:00:00Z", "event": "Docker deactivates the identified transferred tokens, except where owners opted to keep them.", "source": 0 }, { "time": "2026-10-12T00:00:00Z", "event": "Docker publishes its security advisory.", "source": 1 }, { "time": "2026-10-13T00:00:00Z", "event": "The CVE record is published.", "source": 1 } ], "whoIsAffected": [ "Users whose accounts received a transferred token through an account conversion, and the related organization owners. Docker emailed them.", "Docker says users who didn't get its email never had a token transferred, so they need to do nothing.", "Docker notes a transferred token could have been exposed whether or not it was ever used." ], "howToCheck": [ "Look for Docker's notification email from October 2.", "In Docker Hub, open Account settings and Personal access tokens, and look for any token you did not create or no longer use.", "Check whether your account switcher shows an organization you don't remember joining.", "Organization owners can review past pushes in activity logs, which show the token used. Docker Home keeps them for 30 days." ], "whatToDo": [ "Revoke personal access tokens you don't recognize or no longer use.", "Use organization access tokens, not one person's personal access token, for organization automation.", "If you got no email from Docker, Docker says no action is needed.", "Contact Docker Support with questions about the notice." ] }, "affected": [], "iocs": [], "sources": [ { "publisher": "docker.com", "title": "Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions", "url": "https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/", "published": "2026-10-12T00:00:00Z" }, { "publisher": "thehackernews.com", "title": "Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another", "url": "https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html", "published": "2026-10-13T00:00:00Z" }, { "publisher": "bleepingcomputer.com", "title": "Docker Hub flaw let attackers impersonate users, tamper with images", "url": "https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/", "published": "2026-10-13T11:20:00Z" } ], "changelog": [ { "time": "2026-10-23T07:14:50Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0008.jpg" }, { "id": "H-2026-0007", "url": "https://headlines.subcloak.com/h/h-2026-0007/opencode-says-its-hosted-console-was-breached/", "status": "developing", "severity": "high", "headline": "OpenCode says its hosted Console was breached, exposing some users' AI provider keys", "dek": "OpenCode says 1.4% of Console users with linked Anthropic, OpenAI or Google accounts were hit. If you got its email, replace those keys, update your apps and check usage and billing. No email means not affected, it says.", "published": "2026-10-23T07:14:50Z", "updated": "2026-10-23T07:14:50Z", "ecosystems": [ "macos" ], "kinds": [ "infrastructure-compromise" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "OpenCode, an open-source AI coding project, disclosed a security breach of its hosted service, OpenCode Console. It ties the incident to what it calls a large-scale distillation attack. It says about 1.4% of Console users were affected: those who had linked external AI providers such as Anthropic, OpenAI or Google. This is a breach of a hosted service, not a package or app release.", "OpenCode emailed every affected user. Cyber Security News reports that third-party keys saved in affected workspaces may have been exposed, and that OpenCode described unauthorized access to a legacy system it was already preparing to shut down. BleepingComputer reports the earliest possible exposure was 00:30 UTC on 17 October and that attackers had targeted OpenCode's systems for at least 48 hours using AI agents.", "BleepingComputer reports that users said they saw unauthorized charges from several hundred dollars up to $1,700, and that Google suspended some projects. These are user reports. BleepingComputer also says OpenCode's message mentions possible reimbursement of rogue charges.", "The investigation is ongoing. OpenCode has not published a root cause, how long attackers had access, how many keys were involved, or whether exposed keys were used for distillation requests. It says it is working with Anthropic, OpenAI and Google. No indicators of compromise were published. Sources differ on the disclosure date, 17 or 18 October." ], "timeline": [ { "time": "2026-10-17T00:00:00Z", "event": "Cyber Security News reports OpenCode issued a statement on the breach and emailed affected users that morning.", "source": 2 }, { "time": "2026-10-17T00:30:00Z", "event": "Earliest possible exposure of users' keys, according to BleepingComputer's report of OpenCode's notice.", "source": 1 }, { "time": "2026-10-18T00:00:00Z", "event": "StepSecurity dates OpenCode's disclosure and user emails to this day, which conflicts with the 17 October date in other reports.", "source": 0 } ], "whoIsAffected": [ "OpenCode Console users who linked external AI providers (Anthropic, OpenAI or Google), about 1.4% of Console users.", "Not everyone who has the OpenCode CLI installed; impact is scoped to Console accounts, per StepSecurity.", "Users who did not get an email from OpenCode were not affected, according to OpenCode." ], "howToCheck": [ "Look for an email from OpenCode about the breach.", "Check whether you have an OpenCode Console account and which provider keys (Anthropic, OpenAI, Google) you stored or linked there.", "Review each provider's usage dashboard and your billing records for requests or charges you did not make, especially since 17 October." ], "whatToDo": [ "If you were notified, revoke and replace the Anthropic, OpenAI or Google keys you stored in OpenCode Console, using each provider's dashboard.", "Update every application that depends on the replaced keys.", "StepSecurity advises rotating any provider key connected to OpenCode or Console, including each provider listed in the local auth.json file.", "Report unauthorized charges to the provider and ask OpenCode about reimbursement.", "Watch OpenCode's updates for a root cause and any change to the scope." ] }, "affected": [], "iocs": [], "sources": [ { "publisher": "stepsecurity.io", "title": "OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond", "url": "https://www.stepsecurity.io/blog/opencode-security-breach", "published": "2026-10-18T00:00:00Z" }, { "publisher": "bleepingcomputer.com", "title": "OpenCode hack exposes API keys amid AI distillation attacks", "url": "https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/", "published": "2026-10-19T13:27:00Z" }, { "publisher": "cybersecuritynews.com", "title": "OpenCode Security Breach Exposes Third-Party API Keys of its Console Users", "url": "https://cybersecuritynews.com/opencode-security-breach/", "published": "2026-10-18T00:00:00Z" } ], "changelog": [ { "time": "2026-10-23T07:14:50Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0007.jpg" }, { "id": "H-2026-0006", "url": "https://headlines.subcloak.com/h/h-2026-0006/fake-solidity-and-hardhat-extensions-on-open-vsx-install-backdoor-on-macs/", "status": "developing", "severity": "high", "headline": "Fake Solidity and Hardhat extensions on Open VSX install backdoor on Macs, Pluto says", "dek": "Pluto Security says fake Solidity tools on Open VSX drop a backdoor on Macs. If you installed any of four listed extensions, treat the machine as compromised, disconnect it and rotate credentials, wallet keys first.", "published": "2026-10-23T07:14:50Z", "updated": "2026-10-23T07:14:50Z", "ecosystems": [ "openvsx", "macos", "vscode" ], "kinds": [ "malicious-extension" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "According to Pluto Security, a new wave of a campaign it calls EtherDuck, part of SleepyDuck, put fake Solidity and Hardhat extensions on Open VSX, the extension store used by editors such as Cursor, Windsurf and VSCodium. Pluto ties it to the same actor behind earlier SleepyDuck and ScreenConnect campaigns. As far as the sources we have show, Pluto is the only researcher to have published on these waves.", "Pluto says the listings imitated legitimate tooling and inflated their download counts to outrank genuine extensions in search. Displayed download numbers on these listings are not real install counts. The four extension IDs Pluto lists are alejandroaranda.solidity-languini, alejandroaranda.solidity-langsupport, juanfranblanco.solidity-vscode and Nomic-ETH.hardhat-solidity.", "Pluto says that when the extension activates, it starts a hidden Node process that runs a bundled video file. A custom archive appended after the video data holds payloads for each platform. On macOS and Linux the payload is a Go backdoor that reads its server address from an Ethereum smart contract. On a Mac, Pluto says, it removes its own quarantine flag so Gatekeeper never warns, and adds a LaunchAgent so it starts at every login. It checks for virtual machines, debuggers and sandboxes and exits silently if it finds them. On Windows, Pluto says victims get a ScreenConnect remote access client.", "Pluto says Open VSX removed each malicious wave after about 19 hours, but the operator came back within hours under a new publisher account with the same payloads and added anti-VM and anti-debugger checks. Pluto says uninstalling the extension does not remove the malware; the installed background process keeps running." ], "timeline": [ { "time": "2026-03-14T00:00:00Z", "event": "Pluto says the Ethereum contract the backdoor later reads its server address from was deployed.", "source": 0 }, { "time": "2026-09-24T23:42:00Z", "event": "The first two fake listings appeared under the publisher janeykomit.", "source": 0 }, { "time": "2026-09-25T18:35:00Z", "event": "Open VSX confirmed both listings removed, about 19 hours after they appeared.", "source": 0 }, { "time": "2026-09-25T22:40:00Z", "event": "Re-uploaded fake listings reached their final versions under a new publisher, dbolovetoa.", "source": 0 }, { "time": "2026-09-26T17:35:00Z", "event": "Open VSX confirmed the re-uploaded listings removed.", "source": 0 }, { "time": "2026-10-01T00:00:00Z", "event": "Pluto Security published its report on the campaign.", "source": 0 } ], "whoIsAffected": [ "Solidity developers who installed any of the four listed extensions from Open VSX, in Cursor, Windsurf, VSCodium or other editors that use that store.", "Anyone who has or ever had these extensions installed should treat the machine as compromised, since Pluto says a compromised workstation can expose credentials and deployment authority.", "Developers who relied on displayed download counts to judge which Solidity extension was genuine." ], "howToCheck": [ "Look in your editor's extensions list for the four IDs: alejandroaranda.solidity-languini, alejandroaranda.solidity-langsupport, juanfranblanco.solidity-vscode and Nomic-ETH.hardhat-solidity, including past installs.", "On a Mac, look for a hidden .solidity folder in your home directory and for a related LaunchAgent in your user Library.", "Check network logs for connections to the command-and-control addresses Pluto lists, and for repeated Ethereum calls to the config contract from a process that is not a wallet." ], "whatToDo": [ "Disconnect the machine from the network first to cut the active command channel.", "Do not rely on uninstalling the extension; it does not remove the backdoor.", "Remove the payload folder and the LaunchAgent, or better, rebuild the Mac.", "Rotate every credential the machine could reach: SSH keys, cloud sessions, publishing tokens and above all wallet keys and contract deployment keys.", "Install Solidity tooling only from the real publishers and block by publisher account and payload hash, not extension name alone." ] }, "affected": [ { "ecosystem": "openvsx", "name": "alejandroaranda.solidity-languini", "versions": [ "0.9.2" ] }, { "ecosystem": "openvsx", "name": "alejandroaranda.solidity-langsupport", "versions": [ "0.0.6" ] }, { "ecosystem": "openvsx", "name": "juanfranblanco.solidity-vscode", "versions": [ "0.0.189", "0.0.190", "0.0.191" ] }, { "ecosystem": "openvsx", "name": "Nomic-ETH.hardhat-solidity", "versions": [ "0.9.2", "0.9.3" ] } ], "iocs": [ { "type": "extension-id", "value": "alejandroaranda.solidity-languini", "note": "Malicious Open VSX extension (0.9.2)", "source": 0 }, { "type": "extension-id", "value": "alejandroaranda.solidity-langsupport", "note": "Malicious Open VSX extension (0.0.6)", "source": 0 }, { "type": "extension-id", "value": "juanfranblanco.solidity-vscode", "note": "Malicious Open VSX extension (0.0.189 to 0.0.191)", "source": 0 }, { "type": "extension-id", "value": "Nomic-ETH.hardhat-solidity", "note": "Malicious Open VSX extension (0.9.2 and 0.9.3)", "source": 0 }, { "type": "ip-port", "value": "185.232.84.169:8041", "note": "ScreenConnect relay (Windows)", "source": 0 }, { "type": "ip-port", "value": "193.57.9.17:4912", "note": "Go backdoor C2 (macOS/Linux)", "source": 0 }, { "type": "url", "value": "http://107.189.27.46:3000/app.js", "note": "Staging URL in contract param2 (unreferenced, not serving during analysis)", "source": 0 }, { "type": "wallet", "value": "0xf8a900Db50b3331be6B768bA460BB59f3E40C344", "note": "Ethereum config contract (EtherHiding-style)", "source": 0 }, { "type": "wallet", "value": "0xfd3fc58bcbd8ccc77b6000201438edfc636e7ca7", "note": "Owner EOA (only account that can rotate C2)", "source": 0 }, { "type": "sha256", "value": "7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da", "note": "app.msi (ScreenConnect installer)", "source": 0 }, { "type": "sha256", "value": "37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e", "note": "invoke.ps1 (loader)", "source": 0 }, { "type": "sha256", "value": "80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f", "note": "darwin_amd64 backdoor", "source": 0 }, { "type": "sha256", "value": "fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358", "note": "darwin_arm64 backdoor", "source": 0 }, { "type": "sha256", "value": "9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696", "note": "linux_amd64 backdoor", "source": 0 }, { "type": "sha256", "value": "b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565", "note": "linux_arm64 backdoor", "source": 0 }, { "type": "sha256", "value": "683ad81cdc028c538ee66da8e6b60f2a5ab070bfd900da80175df317a73886d8", "note": "note.txt (taunt)", "source": 0 }, { "type": "file-path", "value": "~/.solidity/", "note": "macOS/Linux payload and wrapper", "source": 0 }, { "type": "file-path", "value": "~/Library/LaunchAgents/com.solidity.langsupport.runner.plist", "note": "macOS LaunchAgent persistence", "source": 0 }, { "type": "file-path", "value": "~/.config/systemd/user/solidity-langsupport-runner.service", "note": "Linux systemd persistence", "source": 0 }, { "type": "file-path", "value": "C:\\Program Files (x86)\\ScreenConnect Client (5cbe79c9c25524df)\\", "note": "ScreenConnect client folder", "source": 0 }, { "type": "file-path", "value": "%TEMP%\\solidity-langsupport-debug.log", "note": "debug log", "source": 0 }, { "type": "other", "value": "__JAWBRK_EC__", "note": "shell markers", "source": 0 }, { "type": "other", "value": "__JAWBRK_DONE__", "note": "shell markers", "source": 0 }, { "type": "other", "value": "NYANSTEG", "note": "archive magics", "source": 0 }, { "type": "other", "value": "NYANARCH", "note": "archive magics", "source": 0 }, { "type": "other", "value": "NYANB64X", "note": "archive magics", "source": 0 } ], "sources": [ { "publisher": "pluto.security", "title": "SleepyDuck Wakes Again: A Cross-Platform Open VSX Campaign Targeting Solidity Developer Workstations", "url": "https://pluto.security/blog/sleepyduck-malware-open-vsx-extensions/", "published": "2026-10-01T00:00:00Z" } ], "changelog": [ { "time": "2026-10-23T07:14:50Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0006.jpg" }, { "id": "H-2026-0005", "url": "https://headlines.subcloak.com/h/h-2026-0005/ghostaction-wave-plants-secret-stealing-fake-security-workflows-in-github/", "status": "confirmed", "severity": "high", "headline": "GhostAction wave plants secret-stealing fake security workflows in GitHub repositories", "dek": "Attackers with hijacked GitHub accounts pushed a fake security-audit workflow that sends secrets, including from git history, to a bare IP. Check your repos and account activity, then revoke the pushing credential and rotate secrets.", "published": "2026-10-23T07:14:49Z", "updated": "2026-10-23T07:14:49Z", "ecosystems": [ "github-actions" ], "kinds": [ "infrastructure-compromise" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "The GhostAction campaign returned in October 2026. Attackers got write access to GitHub accounts and pushed a GitHub Actions workflow disguised as a security improvement, with names like Security Audit. When it runs, it sends repository secrets and cloud, AI and SaaS credentials to a hardcoded IP address, 193.32.204.199, over plain HTTP. The sources give the likely access routes as stolen personal access tokens or credentials from infostealer logs and dumps. StepSecurity called leaked tokens the most plausible route, which is not confirmed.", "The new payload also searches the working tree and the full git history, so a secret deleted long ago can still be taken. Targets include AWS key IDs, GitHub and GitLab tokens, AI provider keys and cloud API keys.", "Counts depend on who measured what. StepSecurity followed two hijacked maintainer accounts that pushed the workflow to 345 repositories on October 8, and found 378 repositories with a live copy by October 9. GitGuardian's wider dataset puts the total at more than 30,000 targeted repositories across about 3,000 users and organizations, from about 1,900 compromised accounts.", "StepSecurity confirmed exfiltration from the uber/athenadriver run. In typecho-fans/plugins, a required approval for workflow runs stopped a re-trigger. The workflow's GITHUB_TOKEN was read-only, so it could not push or publish itself. No malicious package releases from the stolen publishing credentials had been seen when StepSecurity wrote.", "GitHub began preventing the malicious workflow from running on October 9, so later waves could not extract secrets. Secrets already sent stay stolen. Some victims had been hit in earlier waves, which suggests attackers reuse secrets that were never rotated." ], "timeline": [ { "time": "2026-08-31T14:00:00Z", "event": "The new GhostAction wave started, around 2 pm GMT.", "source": 1 }, { "time": "2026-09-05T00:00:00Z", "event": "First observed campaign use of the current exfiltration IP, in an infected repository (typecho-fans/plugins).", "source": 0 }, { "time": "2026-10-08T13:20:36Z", "event": "A compromised maintainer account pushed the malicious workflow to pyxel, starting a sweep of 27 repositories.", "source": 0 }, { "time": "2026-10-08T21:10:00Z", "event": "A second compromised account began pushing the workflow to 318 repositories in a 16-minute window.", "source": 0 }, { "time": "2026-10-08T21:26:04Z", "event": "The attacker server acknowledged a POST in the uber/athenadriver run, confirming exfiltration.", "source": 0 }, { "time": "2026-10-09T00:00:00Z", "event": "GitHub started preventing the malicious workflow from running.", "source": 2 }, { "time": "2026-10-10T00:00:00Z", "event": "New waves with the same payload were seen but could not extract secrets.", "source": 2 } ], "whoIsAffected": [ "Maintainers of GitHub repositories whose account or token was used to push the workflow, and anyone whose repositories ran it.", "Repositories with a security-audit.yml or github_actions_security.yml workflow since August 31, 2026 should be treated as confirmed breaches.", "Forks of infected repositories carry the workflow and can leak data if Actions is enabled.", "Repositories with package publishing secrets, because an attacker could publish as them.", "Victims from earlier waves who never rotated their secrets." ], "howToCheck": [ "Look in the repositories you maintain, including local clones after fetching, for workflow files named security-audit.yml, github_actions_security.yml or security-check.yml.", "Search your repositories and organization on GitHub for the address 193.32.204.199 in workflow files.", "Review your GitHub security log and recent commits for pushes you did not make, such as ones titled Add security audit workflow.", "Check Actions run history since August 31, 2026 for runs of the suspicious workflow; completed runs should be treated as exfiltration.", "If your Mac ever ran an infostealer, treat GitHub tokens stored on it as exposed." ], "whatToDo": [ "Find and revoke the GitHub credential that made the injection. Rotating repository secrets alone is not enough.", "Rotate all Actions secrets and every credential ever committed to any branch.", "Delete the malicious workflow from all branches and forks.", "Do not cut releases until the repository is clean and credentials are rotated.", "Require approval for workflow runs and protect workflow files with branch protection and pull-request review." ] }, "affected": [], "iocs": [ { "type": "ip-port", "value": "193.32.204.199:3000", "note": "C2 exfiltration endpoint (port 3000)", "source": 0 }, { "type": "ip", "value": "193.32.204.199", "note": "C2 IP used for exfiltration", "source": 0 }, { "type": "url", "value": "http://193.32.204.199/?c=monami", "note": "Exfil URL for repositories with named secrets", "source": 0 }, { "type": "file-path", "value": ".github/workflows/security-audit.yml", "note": "Malicious workflow filename", "source": 0 }, { "type": "other", "value": "AKIA_CTX_START", "note": "Marker in POST body for AWS context capture", "source": 0 }, { "type": "other", "value": "AKIA_CTX_END", "note": "Marker in POST body for AWS context capture", "source": 0 }, { "type": "ip", "value": "45.139.104.115", "note": "Legacy C2 IP from prior wave", "source": 0 }, { "type": "ip", "value": "170.39.218.2", "note": "Legacy C2 IP from prior wave", "source": 0 }, { "type": "other", "value": "Add security audit workflow", "note": "Injected commit message", "source": 0 }, { "type": "other", "value": "Trigger security scan", "note": "Re-trigger commit message", "source": 0 }, { "type": "domain", "value": "bold-dhawan.45-139-104-115.plesk.page", "note": "Exfiltration endpoint used in the September 2025 wave", "source": 1 }, { "type": "domain", "value": "carte-avantage.com", "note": "Exfiltration endpoint used in the 2025 wave", "source": 1 }, { "type": "domain", "value": "objective-hopper.45-139-104-115.plesk.page", "note": "Exfiltration endpoint in September 2025", "source": 1 }, { "type": "url", "value": "http://193.32.204.199/?c=bling", "note": "Exfiltration URL for the bling-tagged batch", "source": 1 }, { "type": "url", "value": "http://193.32.204.199/?c=blingnew", "note": "Exfiltration URL for the blingnew-tagged batch", "source": 1 }, { "type": "file-path", "value": "github_actions_security.yml", "note": "Malicious workflow file name disguised as GitHub Actions Security", "source": 2 } ], "sources": [ { "publisher": "stepsecurity.io", "title": "GhostAction Returns: Malicious \"Security Audit\" Workflows Now Mine Credentials from Entire Git Histories", "url": "https://www.stepsecurity.io/blog/ghostaction-returns", "published": "2026-10-09T00:00:00Z" }, { "publisher": "blog.gitguardian.com", "title": "The campaign that never stopped: tracking GhostAction from 2025 to 2026", "url": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/", "published": "2026-10-07T00:00:00Z" }, { "publisher": "thehackernews.com", "title": "GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories", "url": "https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html", "published": "2026-10-15T00:00:00Z" } ], "changelog": [ { "time": "2026-10-23T07:14:49Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0005.jpg" }, { "id": "H-2026-0004", "url": "https://headlines.subcloak.com/h/h-2026-0004/tensorlake-npm-package-version-0-5-144-hijacked-to-ship-credential-stealing-worm/", "status": "confirmed", "severity": "critical", "headline": "Tensorlake npm package version 0.5.144 hijacked to ship credential-stealing worm", "dek": "A poisoned tensorlake 0.5.144 ran malware at npm install. If you installed it, remove the token monitor first, then rotate npm, GitHub, SSH and cloud credentials. Version 0.5.143 is clean.", "published": "2026-10-23T07:14:49Z", "updated": "2026-10-23T07:14:49Z", "ecosystems": [ "npm", "macos" ], "kinds": [ "package-compromise" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "Version 0.5.144 of the tensorlake npm package was published carrying a payload from the Shai-Hulud worm family, which Socket and The Hacker News also call ChainDrop. It went out through the project's normal GitHub Actions pipeline and carried valid build provenance. The version has since been removed from npm; 0.5.143 is clean.", "Endor Labs says the attacker changed the main branch first and let the trusted pipeline publish the result. It calls a compromised maintainer account the most likely root cause, so that is an assessment, not a confirmed fact.", "A preinstall hook runs lib/setup.mjs as soon as the package is installed, before any code imports the SDK. The payload hunts for npm and GitHub tokens, SSH keys, cloud credentials, Kubernetes and Docker config, Vault tokens and .env files. It then uses stolen credentials to republish itself into other packages the victim can publish and to create repositories holding stolen data.", "The malware also writes .claude/settings.json and .vscode/tasks.json into reachable repositories so it reruns when a project is opened in Claude Code or VS Code. Socket reports that a persistent monitor polls the stolen GitHub token and runs an attacker-supplied handler if the token is revoked. Socket's reading of the code is that revoking the token while the monitor runs can trigger a wipe. No source reports this happening in practice.", "Endor Labs says the six tensorlake-native platform packages from the same run contain no install script or payload, but advises treating them as affected and avoiding them." ], "timeline": [ { "time": "2026-10-07T01:20:00Z", "event": "First malicious commit pushed to the tensorlake source repository.", "source": 0 }, { "time": "2026-10-08T01:12:07Z", "event": "tensorlake 0.5.144 published to npm.", "source": 2 }, { "time": "2026-10-08T01:23:10Z", "event": "Socket flagged the malicious version, about 11 minutes after publication.", "source": 2 } ], "whoIsAffected": [ "Anyone who installed tensorlake 0.5.144, on a laptop or in CI, with install scripts enabled.", "Hosts where the install scripts ran should be treated as compromised, along with the accounts and secrets reachable from them.", "Maintainers whose npm or GitHub credentials were on an affected host, since the worm can republish their packages.", "Version 0.5.143 and earlier are not affected." ], "howToCheck": [ "Search lockfiles, package caches, build logs and deployed artifacts for tensorlake 0.5.144, and note which environments ran the install scripts.", "On a Mac, look in your LaunchAgents folder for the token monitor property list that Socket describes, named com.user.gh-token-monitor.", "Review GitHub and npm activity for unexpected new repositories, new tokens or unexpected package publishes.", "Check repositories you opened for unexpected .claude/settings.json or .vscode/tasks.json files." ], "whatToDo": [ "First, before anything else: remove the token monitor LaunchAgent, the com.user.gh-token-monitor property list in your user LaunchAgents folder. Socket warns that revoking the stolen GitHub token while it runs can trigger a wipe.", "Only then revoke and replace npm and GitHub tokens, SSH keys, cloud keys, Vault tokens and other secrets that were reachable from the machine, ideally working from a different computer.", "Remove 0.5.144, pin tensorlake to 0.5.143 until a known-good release is published, and avoid the tensorlake-native packages at 0.5.144.", "Removing the npm package does not remove persistence, so isolate the host, investigate, and rebuild affected environments from trusted sources.", "Audit connected accounts for unauthorized access, unexpected publications, and repository or deployment changes.", "Consider installing with scripts disabled using the ignore-scripts option." ] }, "affected": [ { "ecosystem": "npm", "name": "tensorlake", "versions": [ "0.5.144" ] } ], "iocs": [ { "type": "sha256", "value": "25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef", "note": "lib/setup.mjs loader", "source": 0 }, { "type": "sha256", "value": "b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec", "note": "lib/Math_Symbol.js payload", "source": 0 }, { "type": "wallet", "value": "0xb614155Fd88114d40549b259457Bcf921Df091B9", "note": "ETH resolver wallet (EtherHiding) dead-drop for current C2 domain", "source": 0 }, { "type": "domain", "value": "iseekaigogo.com", "note": "C2 domain; daemon POSTs victim host/user/os", "source": 0 }, { "type": "other", "value": "globalThis.WORMTAG='tensrlake'", "note": "marker string the worm uses to label infected packages", "source": 0 }, { "type": "file-path", "value": "package/lib/setup.mjs", "note": "Obfuscated loader invoked by the preinstall hook, launches payload using Bun", "source": 2 }, { "type": "file-path", "value": "package/lib/Math_Symbol.js", "note": "Obfuscated credential-stealing and self-propagating worm payload", "source": 2 }, { "type": "file-path", "value": "~/.config/gh-token-monitor/", "note": "Linux persistence directory of the token monitor", "source": 2 }, { "type": "file-path", "value": "~/Library/LaunchAgents/com.user.gh-token-monitor.plist", "note": "macOS persistence plist of the token monitor", "source": 2 }, { "type": "other", "value": "gh-token-monitor.service", "note": "Linux systemd user service used for persistence", "source": 2 }, { "type": "other", "value": "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner", "note": "Literal string in the code, previously seen in earlier Shai-Hulud waves", "source": 2 } ], "sources": [ { "publisher": "endorlabs.com", "title": "Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack", "url": "https://www.endorlabs.com/learn/tensorlake-npm-package-compromised-by-shai-hulud-in-latest-software-supply-chain-attack", "published": "2026-10-08T00:00:00Z" }, { "publisher": "github.com", "title": "Malware in tensorlake", "url": "https://github.com/advisories/GHSA-rqxj-g25x-4v9v", "published": "2026-10-08T00:00:00Z" }, { "publisher": "socket.dev", "title": "TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack", "url": "https://socket.dev/blog/tensorlake-compromise", "published": "2026-10-08T00:00:00Z" }, { "publisher": "thehackernews.com", "title": "Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm", "url": "https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html", "published": "2026-10-08T00:00:00Z" } ], "changelog": [ { "time": "2026-10-23T07:14:49Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0004.jpg" }, { "id": "H-2026-0003", "url": "https://headlines.subcloak.com/h/h-2026-0003/php2shell-two-critical-php-engine-flaws-patched-after-disclosure-leaked-early/", "status": "confirmed", "severity": "high", "headline": "PHP2Shell: two critical PHP engine flaws patched after disclosure leaked early", "dek": "Two unauthenticated remote code execution flaws in PHP are fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Update every PHP install and image, restart workers. Servers are at highest risk; most developer Macs less so.", "published": "2026-10-23T05:37:41Z", "updated": "2026-10-23T05:37:41Z", "ecosystems": [ "php", "docker", "macos" ], "kinds": [ "vulnerability" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix two critical vulnerabilities in the PHP engine, together called PHP2Shell. Both can let an unauthenticated attacker run code on a server. This is a vulnerability story: the sources do not report that PHP's infrastructure or any release was breached. Both are rated 9.2 on CVSS v4.0.", "One flaw comes from out-of-memory handling, which can leave half-built request data that cleanup code treats as valid. The other lets request state outlive its freed memory, so a later request on the same worker can use it. PHP says risk is highest with Apache mod_php, where an attack can run before any application code.", "The PHP Foundation says the out-of-memory problem was first noticed in a 2024 audit, but the fix stalled. Calif reported a working remote code execution in August 2026, and OpenAI and Wiz also reported related issues.", "The disclosure leaked early. According to the PHP Foundation, the CVE IDs circulated online on 20 October, Calif mistakenly posted a proof-of-concept video, and Chainguard published patched images before the embargo lifted. PHP moved the release forward a day.", "AWS says its honeypots saw an exploitation attempt on 17 October, four days before disclosure, and more attempts after release. AWS says it is unclear how the actor got exploit information. watchTowr also reports exploitation in the wild since 21 October." ], "timeline": [ { "time": "2026-08-11T00:00:00Z", "event": "Calif reported a remote code execution exploit that shares the out-of-memory flaw's root cause.", "source": 3 }, { "time": "2026-10-17T00:00:00Z", "event": "AWS saw a PHP2Shell exploitation attempt in its MadPot honeypot telemetry, four days before disclosure.", "source": 5 }, { "time": "2026-10-20T15:00:00Z", "event": "Both CVE IDs started appearing on forums and social media, with a wrong score and release time.", "source": 3 }, { "time": "2026-10-20T19:33:00Z", "event": "PHP security team announced a security release for the following day.", "source": 6 }, { "time": "2026-10-20T20:00:00Z", "event": "Calif published a proof-of-concept video, later deleted; copies circulated.", "source": 6 }, { "time": "2026-10-21T07:41:00Z", "event": "Chainguard published built images containing the fix, breaking the embargo.", "source": 3 }, { "time": "2026-10-21T13:33:00Z", "event": "The fixed releases were announced on php.net, followed a minute later by the GitHub advisories.", "source": 6 } ], "whoIsAffected": [ "Internet-facing servers running PHP are the high-risk case. The sources name PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed; mod_php is the highest risk.", "Older branches are affected too. PHP 8.1 and older get no official releases, only minimal source backports for 7.4, 8.0 and 8.1.", "For most developer Macs the risk is medium rather than high. It matters when a PHP you run accepts requests from other machines, such as a local server reachable from your network, a published Docker port, or a server you deploy to.", "Products that embed PHP as a backend can also be affected even if they do not expose PHP directly." ], "howToCheck": [ "Check the version of every PHP install on your Mac and compare it with the fixed releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.", "Check PHP-based Docker images and running containers; a container keeps its old PHP until it is rebuilt and recreated.", "Check whether any local PHP server listens on all network interfaces rather than only on the Mac itself.", "A Mac is not expected to show any indicator of compromise. For servers, AWS suggests reviewing web logs, looking for unexpected process execution or file changes, and investigating from at least 17 October.", "AWS's published IP addresses include shared anonymization infrastructure; its advice is to investigate them, not simply block them." ], "whatToDo": [ "Update every PHP install to the fixed release for its branch and restart all PHP workers so the fix takes effect.", "Rebuild Docker images on fixed PHP versions rather than relying on images pulled before the release.", "On PHP 8.1 or older, use a vendor package or PHP's source backports, or upgrade to a supported branch.", "If a server cannot be updated at once, PHP lists partial mitigations, but none is complete; restrict internet access to that system until it is patched.", "Check your Linux distribution or LTS vendor for updated packages if you deploy to servers." ] }, "affected": [ { "ecosystem": "php", "name": "php", "versions": [ "8.5 before 8.5.12", "8.4 before 8.4.27", "8.3 before 8.3.36", "8.2 before 8.2.35", "8.1 and older" ] } ], "iocs": [ { "type": "ip", "value": "103.216.220.92", "note": "Observed exploitation attempt IP, dated 10/17/2026", "source": 5 }, { "type": "ip", "value": "31.223.184.166", "note": "Observed exploitation IP, dated 10/21/2026", "source": 5 }, { "type": "ip", "value": "37.19.200.5", "note": "Observed exploitation IP, dated 10/21/2026", "source": 5 }, { "type": "ip", "value": "134.209.159.64", "note": "Observed exploitation IP, dated 10/21/2026", "source": 5 }, { "type": "ip", "value": "103.114.163.188", "note": "Observed exploitation IP, dated 10/21/2026", "source": 5 }, { "type": "ip", "value": "95.217.98.37", "note": "Observed exploitation IP, dated 10/21/2026", "source": 5 } ], "sources": [ { "publisher": "github.com", "title": "RCE via OOM corruption", "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "published": "2026-10-21T13:34:25Z" }, { "publisher": "github.com", "title": "RCE via stale global state", "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "published": "2026-10-21T13:34:13Z" }, { "publisher": "php.net", "title": "Security advisory: Critical remote code execution vulnerabilities, update now", "url": "https://www.php.net/archive/2026.php", "published": "2026-10-21T00:00:00Z" }, { "publisher": "thephp.foundation", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "published": "2026-10-21T00:00:00Z" }, { "publisher": "cert.europa.eu", "title": "Critical Vulnerabilities in PHP", "url": "https://cert.europa.eu/publications/security-advisories/2026-018/", "published": "2026-10-21T15:20:18Z" }, { "publisher": "aws.amazon.com", "title": "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot", "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "published": "2026-10-21T00:00:00Z" }, { "publisher": "scherzer.dev", "title": "PHP2Shell: a Timeline", "url": "https://scherzer.dev/Blog/20261022-php2shell-timeline", "published": "2026-10-22T00:00:00Z" }, { "publisher": "watchtowr.com", "title": "Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)", "url": "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "published": "2026-10-20T19:35:00Z" }, { "publisher": "wiz.io", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "url": "https://www.wiz.io/blog/php2shell-php-rce", "published": "2026-10-21T00:00:00Z" } ], "changelog": [ { "time": "2026-10-23T05:37:41Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0003.jpg" }, { "id": "H-2026-0002", "url": "https://headlines.subcloak.com/h/h-2026-0002/eight-emudhra-intermediate-ca-keys-exposed/", "status": "confirmed", "severity": "high", "headline": "Eight eMudhra intermediate CA keys exposed; browsers block them, other tools may not", "dek": "Weakly generated keys let anyone forge certificates. Browsers block the intermediates, but Mac command-line tools and runtimes may still trust them. Update them and rebuild Go programs.", "published": "2026-10-23T05:37:41Z", "updated": "2026-10-23T05:37:41Z", "ecosystems": [ "macos", "go", "npm", "pypi" ], "kinds": [ "ca-compromise" ], "autoPublished": false, "reviewedBy": "Subcloak", "sections": { "whatHappened": [ "The private keys of eight eMudhra intermediate certificate authorities were generated so weakly that anyone can compute them from the public certificates. Six of the intermediates are for TLS and two are for code signing. The keys were not stolen. Mozilla recovered them independently, and it says multiple other people did too.", "A researcher known as Wayne reported the problem on 17 October and proved control of all eight keys. Chrome and Firefox blocked the intermediates within hours. eMudhra revoked them on 18 October and Sectigo revoked its cross-signed copies on 19 October. Microsoft and Apple products now block them as well. Mozilla then moved to remove trust in emSign ECC Root CA - G3 entirely, and Chrome is following.", "eMudhra says the flaw was in its key generation step, that its infrastructure was not compromised, and that it has no evidence the weak keys were used before disclosure. No certificate issued from these intermediates has been seen in Certificate Transparency logs, and no abuse is confirmed. Tools that do not enforce Certificate Transparency, such as curl and most language runtimes, would not notice an unlogged certificate.", "Browsers already block these intermediates. The risk on a developer Mac is software that checks certificates without checking revocation, or that ships its own root list. Removing the root also breaks legitimate sites that chain to it, and the sources disagree on how many certificates that affects." ], "timeline": [ { "time": "2026-10-17T18:05:00Z", "event": "Chrome Root Program received the report of the compromise.", "source": 5 }, { "time": "2026-10-17T19:45:00Z", "event": "A Chrome CRLSet update blocking the six TLS intermediates was in place.", "source": 5 }, { "time": "2026-10-17T20:06:00Z", "event": "Mozilla received the report.", "source": 1 }, { "time": "2026-10-17T21:48:00Z", "event": "Mozilla recovered the private keys independently.", "source": 1 }, { "time": "2026-10-17T22:59:00Z", "event": "Firefox OneCRL distrust of the certificates completed.", "source": 1 }, { "time": "2026-10-18T09:38:00Z", "event": "eMudhra marked the eight certificates as revoked.", "source": 1 }, { "time": "2026-10-19T17:00:00Z", "event": "Cloudflare became aware of the compromise and began its assessment.", "source": 3 }, { "time": "2026-10-20T13:06:02Z", "event": "Mozilla announced emergency removal of trust in emSign ECC Root CA - G3.", "source": 1 }, { "time": "2026-10-20T16:27:02Z", "event": "eMudhra stopped issuing from intermediates chaining to emSign ECC Root CA - G3.", "source": 1 } ], "whoIsAffected": [ "Developers on a Mac using tools that check certificates without revocation: the built-in curl, git, python3 and openssl read the system bundle at /etc/ssl/cert.pem.", "Users of runtimes and tools that ship their own root lists, such as Python certifi, Node.js, Go and Java, until updated.", "Go programs built before the fixed Go release, since they must be rebuilt to reject the keys.", "Operators of servers whose certificates chain to emSign ECC Root CA - G3, which will stop working once Chrome's removal reaches devices.", "Teams running containers, mutual TLS or custom origin certificates, which may need to update their own trust stores.", "Browser users on current versions are covered. Firefox needs action only if Remote Settings is disabled or blocked." ], "howToCheck": [ "Check whether the system bundle used by the built-in curl, git, python3 and openssl still lists emSign ECC Root CA - G3 or AAA Certificate Services. If so, those tools still trust the chain.", "Check the installed versions of Python certifi, Node.js, Go, Java and any Electron or Docker Desktop apps against the fixed versions. The disclosure site run by Mozilla's Dennis Jackson has a crowdsourced list of patched versions.", "Confirm that Go binaries were rebuilt with the fixed Go release.", "The disclosure site also offers test sites. A certificate error from a client means it no longer trusts the compromised intermediates. These are test sites, not indicators.", "Validate through the application's real TLS path, because a working browser does not show that a background service is protected." ], "whatToDo": [ "Update macOS and your browsers to the latest versions.", "Update the runtimes and tools that ship their own root bundles, rebuild Go programs with a fixed Go, and rebuild affected container images.", "Restart or redeploy long-running processes so they reload their trust stores.", "Do not resolve certificate errors after patching by turning off verification.", "The disclosure site explains how to remove the affected roots from /etc/ssl/cert.pem. That edits a system file, so read it carefully first.", "If your servers use certificates chaining to emSign ECC Root CA - G3, replace them before Chrome's removal reaches all devices. That is planned for 27 October.", "eMudhra says it offers replacement certificates, including ones issued by Sectigo." ] }, "affected": [], "iocs": [ { "type": "sha256", "value": "E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838", "note": "Certificate SHA-256, EM EV TLS CA - G3B (eMudhra BV), CCADB A012304", "source": 0 }, { "type": "key-hash", "value": "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a4", "note": "SPKI SHA-256 of the exposed key, EM EV TLS CA - G3B (eMudhra BV); 63 hex characters as published", "source": 0 }, { "type": "cert-serial", "value": "c7c41efe92d825f05eae841a4a82c1", "note": "Serial, EM EV TLS CA - G3B (eMudhra BV)", "source": 0 }, { "type": "sha256", "value": "98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B", "note": "Certificate SHA-256, EM OV TLS CA - G3B (eMudhra BV), CCADB A012308", "source": 0 }, { "type": "key-hash", "value": "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717", "note": "SPKI SHA-256 of the exposed key, EM OV TLS CA - G3B (eMudhra BV); 63 hex characters as published", "source": 0 }, { "type": "cert-serial", "value": "6cada367fb1c100088120ea202d568", "note": "Serial, EM OV TLS CA - G3B (eMudhra BV)", "source": 0 }, { "type": "sha256", "value": "42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493", "note": "Certificate SHA-256, EM DV TLS CA - G3B (eMudhra BV), CCADB A012302", "source": 0 }, { "type": "key-hash", "value": "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105", "note": "SPKI SHA-256 of the exposed key, EM DV TLS CA - G3B (eMudhra BV)", "source": 0 }, { "type": "cert-serial", "value": "a4aee678f23362b4c0e460b772f214", "note": "Serial, EM DV TLS CA - G3B (eMudhra BV)", "source": 0 }, { "type": "sha256", "value": "432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3", "note": "Certificate SHA-256, EM EV TLS CA - G3C (eMudhra Inc), CCADB A012296", "source": 0 }, { "type": "key-hash", "value": "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0", "note": "SPKI SHA-256 of the exposed key, EM EV TLS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "cert-serial", "value": "8009928a64107601af05fa2f19f109", "note": "Serial, EM EV TLS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "sha256", "value": "CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F", "note": "Certificate SHA-256, EM OV TLS CA - G3C (eMudhra Inc), CCADB A012300", "source": 0 }, { "type": "key-hash", "value": "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8", "note": "SPKI SHA-256 of the exposed key, EM OV TLS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "cert-serial", "value": "296926c227a3a1526392b19482a504", "note": "Serial, EM OV TLS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "sha256", "value": "0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19", "note": "Certificate SHA-256, EM DV TLS CA - G3C (eMudhra Inc), CCADB A012294", "source": 0 }, { "type": "key-hash", "value": "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f", "note": "SPKI SHA-256 of the exposed key, EM DV TLS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "cert-serial", "value": "588b2e3c2bb8cda13e1a1209254321", "note": "Serial, EM DV TLS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "sha256", "value": "9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4", "note": "Certificate SHA-256, EM OV CS CA - G3B (eMudhra BV), CCADB A012306", "source": 0 }, { "type": "key-hash", "value": "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6", "note": "SPKI SHA-256 of the exposed key, EM OV CS CA - G3B (eMudhra BV)", "source": 0 }, { "type": "cert-serial", "value": "7818933f8f85b4619a2b35fba83d0a", "note": "Serial, EM OV CS CA - G3B (eMudhra BV)", "source": 0 }, { "type": "sha256", "value": "4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1", "note": "Certificate SHA-256, EM OV CS CA - G3C (eMudhra Inc), CCADB A012298", "source": 0 }, { "type": "key-hash", "value": "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30", "note": "SPKI SHA-256 of the exposed key, EM OV CS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "cert-serial", "value": "544b7f922c31ae220a4a922916f6e6", "note": "Serial, EM OV CS CA - G3C (eMudhra Inc)", "source": 0 }, { "type": "sha256", "value": "579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512", "note": "Certificate SHA-256, EM EV TLS CA - G3B (Sectigo cross-sign), CCADB A012333", "source": 0 }, { "type": "cert-serial", "value": "d8f8685e4f2bd9d82402a85a1c1eb731", "note": "Serial, EM EV TLS CA - G3B (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699", "note": "Certificate SHA-256, EM OV TLS CA - G3B (Sectigo cross-sign), CCADB A012354", "source": 0 }, { "type": "cert-serial", "value": "e94223bde92f914e5ab9acabfdac3710", "note": "Serial, EM OV TLS CA - G3B (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE", "note": "Certificate SHA-256, EM DV TLS CA - G3B (Sectigo cross-sign), CCADB A012347", "source": 0 }, { "type": "cert-serial", "value": "a024fdf4ba665c785ce4a020483858b7", "note": "Serial, EM DV TLS CA - G3B (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F", "note": "Certificate SHA-256, EM EV TLS CA - G3C (Sectigo cross-sign), CCADB A012334", "source": 0 }, { "type": "cert-serial", "value": "05f078752dece7a1bb8595d303167171", "note": "Serial, EM EV TLS CA - G3C (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489", "note": "Certificate SHA-256, EM OV TLS CA - G3C (Sectigo cross-sign), CCADB A012343", "source": 0 }, { "type": "cert-serial", "value": "8d5a4811939ef447d77111cdd9849ae9", "note": "Serial, EM OV TLS CA - G3C (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72", "note": "Certificate SHA-256, EM DV TLS CA - G3C (Sectigo cross-sign), CCADB A012342", "source": 0 }, { "type": "cert-serial", "value": "91f347f1a5b7d39962b95e0ee4e299d1", "note": "Serial, EM DV TLS CA - G3C (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8", "note": "Certificate SHA-256, EM OV CS CA - G3B (Sectigo cross-sign), CCADB A012352", "source": 0 }, { "type": "cert-serial", "value": "41e32b73ac185d6ce0d7480bacf84e69", "note": "Serial, EM OV CS CA - G3B (Sectigo cross-sign)", "source": 0 }, { "type": "sha256", "value": "84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD", "note": "Certificate SHA-256, EM OV CS CA - G3C (Sectigo cross-sign), CCADB A012350", "source": 0 }, { "type": "cert-serial", "value": "d6a5ef613b390f32ef9cdf349f772841", "note": "Serial, EM OV CS CA - G3C (Sectigo cross-sign)", "source": 0 } ], "sources": [ { "publisher": "openwall.com", "title": "eMudhra Intermediates Compromise", "url": "https://www.openwall.com/lists/oss-security/2026/10/20/1", "published": "2026-10-20T14:46:05Z" }, { "publisher": "bugzilla.mozilla.org", "title": "eMudhra: Private key compromise of Intermediate Certificates", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083449", "published": "2026-10-18T12:06:03Z" }, { "publisher": "emudhra.com", "title": "eMudhra Statement on Recent Certificate Security Incident", "url": "https://emudhra.com/en/post/certificate-security-incident", "published": "2026-10-20T00:00:00Z" }, { "publisher": "blog.cloudflare.com", "title": "8 eMudhra certificates are compromised. Here's what you need to know", "url": "https://blog.cloudflare.com/emudhra-certificate-compromise/", "published": "2026-10-20T00:00:00Z" }, { "publisher": "emudhra.we-have-a-problem.com", "title": "eMudhra Intermediate CA Compromise", "url": "https://emudhra.we-have-a-problem.com/", "published": "2026-10-20T00:00:00Z" }, { "publisher": "thehackernews.com", "title": "Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software", "url": "https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html", "published": "2026-10-20T00:00:00Z" } ], "changelog": [ { "time": "2026-10-23T05:37:41Z", "note": "First published." } ], "image": "https://headlines.subcloak.com/og/h-2026-0002.jpg" }, { "id": "H-2026-0001", "url": "https://headlines.subcloak.com/h/h-2026-0001/litellm-1-107-0-hijacked-on-pypi-and-docker/", "status": "confirmed", "severity": "critical", "headline": "LiteLLM 1.107.0 hijacked on PyPI and Docker, shipping a credential stealer", "dek": "A poisoned LiteLLM 1.107.0 reached PyPI and Docker on 21 October. If it was installed where Python ran, treat that environment as compromised, remove the payload files, pin 1.106.2 and rotate secrets.", "published": "2026-10-23T05:37:41Z", "updated": "2026-10-23T10:38:09Z", "ecosystems": [ "pypi", "docker", "github-actions" ], "kinds": [ "package-compromise", "credential-theft", "infrastructure-compromise" ], "autoPublished": true, "sections": { "whatHappened": [ "On 21 October 2026, LiteLLM's release pipeline was used to publish litellm 1.107.0 to PyPI and to its Docker images with compiled malware: a credential stealer and a remote-code loader. LiteLLM says all earlier versions are safe and the affected releases have been pulled.", "The official v1.107.0 source tag on GitHub does not contain the malicious files. The artifacts were built from a lookalike repository, Berri-AI/litellm, which differs from the real BerriAI/litellm by one hyphen. All seven wheels add cook.pth, cook.py and sitecustomize.py to site-packages, so the malware runs whenever Python starts, even if litellm is never imported.", "The stealer collects credentials, environment variables and cloud metadata, encrypts them and sends them to litellm.dev. The loader polls a GitHub file hourly for a domain and runs code from it, but the file was empty, so that stage was dormant and no second stage was observed. Wiz reports that the attacker validated stolen AWS instance role credentials, and SecurityWeek says Wiz saw stolen AWS credentials used to query Amazon Bedrock models about 4.5 hours after exfiltration, suggesting LLMjacking.", "LiteLLM says the attacker used a GitHub CLI OAuth token, obtained through an internal LiteLLM deployment exposed to the internet, to compromise the release workflow. Other sources say tokens from three engineers' accounts were used. SecurityWeek reports the tokens were likely leaked by Claude Code placing them in response bodies that may have been logged. LiteLLM says investigators have not confirmed how the attacker entered the internal deployment, and the investigation is ongoing.", "PyPI removed 1.107.0 by 13:23 UTC on 21 October. Affected GHCR tags were unavailable by 13:51 UTC, and by 14:20 UTC all affected Docker Hub tags had been removed or repointed to verified clean artifacts. According to Aikido, GitHub took down the attacker's dead-drop repository." ], "background": [ "Processes running LiteLLM typically hold provider API keys, cloud identities and database connection strings, which makes them an attractive target for credential theft. Datadog notes an earlier 2026 LiteLLM incident affected versions 1.82.7 and 1.82.8, and that no connection between the two has been established.", "StepSecurity says that because the malicious artifacts were built and published by the legitimate pipeline with valid provenance, the hardening measures introduced in March did not prevent this compromise." ], "howItWorks": [ "Per Socket, Endor Labs and Aikido, a maturin data setting added to pyproject.toml (data = \"cook\") bundled a directory absent from the tagged source into the wheels, and a COPY line in the Dockerfiles did the same for images. The tag's pyproject.toml lacks the setting, so reviewing the tag alone would miss it. The sdist contains the setting but not the cook directory, so it has no payload.", "According to the project's account, an attacker-used credential overrode branch protection to modify the private release workflow, pointing it at Berri-AI/litellm. The workflow ran staging, then production, with a second developer credential satisfying the approval gate. A third developer's credentials were then used to delete workflow records, limiting available logs. Build provenance recorded the lookalike repository as the source.", "At runtime, cook.pth launches cook.py on every interpreter start. The stealer gathers host information, browser passwords, SSH keys, cloud and developer credentials, AI tool configs, environment variables and, when DATABASE_URL is set, LiteLLM proxy provider keys. The stealer protects what it collects with AES-256-CBC encryption, locks the key using RSA-4096 OAEP-SHA256, and sends the package over unencrypted HTTP to litellm.dev. The marker file is only written after a successful HTTP 200, so the stealer reruns on each Python start while exfiltration fails.", "sitecustomize.py starts a background daemon that checks a GitHub file hourly for a domain, then fetches /codepy from it and executes the response with no signature or hash check. Deleting the litellm folder does not remove the dropped files; running python or pip triggers the malware again." ], "timeline": [ { "time": "2026-10-13T00:45:03Z", "event": "The litellm.dev domain was registered.", "source": 1 }, { "time": "2026-10-21T08:56:59Z", "event": "First attacker commit to Berri-AI/litellm, adding cook.pth.", "source": 1 }, { "time": "2026-10-21T10:08:34Z", "event": "A privileged developer credential overrode branch protection and applied a workflow commit.", "source": 0 }, { "time": "2026-10-21T10:46:39Z", "event": "The modified workflow started a staging run from Berri-AI/litellm.", "source": 0 }, { "time": "2026-10-21T11:39:51Z", "event": "Seven malicious litellm 1.107.0 wheels were uploaded to PyPI.", "source": 0 }, { "time": "2026-10-21T11:46:56Z", "event": "Container publication jobs ran and the Docker image included malicious content.", "source": 0 }, { "time": "2026-10-21T12:09:38Z", "event": "The unauthorized workflow revision was removed and the release workflow restored.", "source": 0 }, { "time": "2026-10-21T13:23:00Z", "event": "PyPI had removed litellm 1.107.0.", "source": 0 }, { "time": "2026-10-21T13:51:00Z", "event": "Affected GHCR tags were unavailable; Docker Hub tags still resolved to the compromised image.", "source": 0 }, { "time": "2026-10-21T14:20:00Z", "event": "All affected Docker Hub tags were removed or repointed to clean artifacts.", "source": 0 } ], "whoIsAffected": [ "Anyone who installed litellm 1.107.0 from PyPI, including unpinned installs and open-ended constraints that resolved to it. Any Python process in that environment runs the malware.", "Anyone who ran the Docker images tagged v1.107.0, latest, main-latest or main-stable in the window, on GHCR or Docker Hub.", "LiteLLM proxy hosts with DATABASE_URL set should assume stored provider credentials were taken.", "Not affected, per LiteLLM: enterprise customers on the private registry, and earlier versions." ], "impact": [ "Wiz cites about 49,000 downloads of the malicious version per ClickPy, and SecurityWeek says the packages were online for roughly three hours. Datadog puts availability at about two hours. Socket's scanner flagged the seven wheels seven minutes after publication.", "The PyPI exposure window runs from about 11:39 to 13:23 UTC and the Docker window from about 11:46 to 14:20 UTC. Unpinned installs and deployments following floating tags such as latest or main-stable could receive the bad release without choosing it. Enterprise customers using the private registry were not affected, according to LiteLLM." ], "howToCheck": [ "Run pip show litellm, and search lockfiles, requirements, caches, CI build logs and container layers for litellm 1.107.0.", "Search site-packages for cook.pth, cook.py, sitecustomize.py and litellm-1.107.0.dist-info. Finding one confirms exposure; finding none does not prove the environment is clean. Prefer checking on disk without running Python.", "Check /tmp for the marker file /tmp/.pc_once_72129118c59f5636c0bb and for /tmp/remote_code_loader.lock. Absence of the marker proves nothing.", "Check which image digests your deployments or Kubernetes pods ran on 21 October.", "Search egress logs for litellm.dev, including POSTs to /healthcheck and requests ending in /codepy, and check CloudTrail for GetCallerIdentity from the instance role around install time." ], "whatToDo": [ "Do not start pip first in an affected environment; each Python start reruns the payload. Isolate affected hosts and preserve evidence.", "Kill the detached Python daemon holding /tmp/remote_code_loader.lock.", "Delete cook.pth, cook.py, sitecustomize.py and matching pycache files from affected site-packages.", "Rebuild environments and images from scratch and pin litellm==1.106.2, or the v1.106.2 image by digest.", "Assume exfiltration succeeded and, from a clean machine, rotate everything the host could reach: IAM roles, provider keys, master and virtual keys, the DATABASE_URL password and environment secrets.", "Block litellm.dev at DNS or egress and block litellm==1.107.0 in your package proxy." ] }, "affected": [ { "ecosystem": "pypi", "name": "litellm", "versions": [ "1.107.0" ] }, { "ecosystem": "docker", "name": "ghcr.io/berriai/litellm", "versions": [ "v1.107.0", "latest", "main-latest", "main-stable", "1.107.0" ] }, { "ecosystem": "docker", "name": "ghcr.io/berriai/litellm-database", "versions": [ "v1.107.0", "latest", "main-latest", "main-stable" ] }, { "ecosystem": "docker", "name": "ghcr.io/berriai/litellm-non_root", "versions": [ "v1.107.0", "latest", "main-latest", "main-stable" ] }, { "ecosystem": "docker", "name": "docker.io/litellm/litellm", "versions": [ "v1.107.0", "latest", "main-latest", "main-stable" ] }, { "ecosystem": "docker", "name": "litellm/litellm", "versions": [ "1.107.0" ] } ], "iocs": [ { "type": "file-path", "value": "/tmp/remote_code_loader.lock", "note": "Lock file held by detached python daemon", "source": 0 }, { "type": "other", "value": "litellm-1.107.0.dist-info", "note": "Package metadata directory indicating exposure", "source": 0 }, { "type": "other", "value": "Berri-AI/litellm", "note": "Attacker-controlled lookalike source repository", "source": 0 }, { "type": "other", "value": "LidorMachluf", "note": "Credited with helping detect the incident", "source": 0 }, { "type": "domain", "value": "www.litellm.dev", "note": "Exfiltration endpoint (POST http://www.litellm.dev/healthcheck)", "source": 1 }, { "type": "url", "value": "https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt", "note": "Dead-drop file read by sitecustomize.py for C2 domain", "source": 1 }, { "type": "http-header", "value": "X-Token: XWiA8gZNa7NcX2XRoAEb", "note": "Token header sent with exfil POST", "source": 1 }, { "type": "file-path", "value": "site-packages/cook.pth", "note": "Payload file installed by wheel", "source": 1 }, { "type": "file-path", "value": "/tmp/.pc_once_72129118c59f5636c0bb", "note": "Marker written after successful exfil POST", "source": 1 }, { "type": "github-account", "value": "letters9813", "note": "Dead-drop GitHub account", "source": 1 }, { "type": "email", "value": "ckdi82fkoos@proton.me", "note": "Commit author email for attacker commits", "source": 1 }, { "type": "sha256", "value": "7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d", "note": "Malicious litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl", "source": 1 }, { "type": "sha256", "value": "6ea3d8ef6cf73a72d8df24f663b7a31ce67494eeb9b0d707b93484e66675d2df", "note": "Decoded stealer cook.py variant", "source": 1 }, { "type": "sha256", "value": "20a59e5a285799e7cf7fa16cfba1c1414f1e84a8459e14207cfd4e998c2cd24b", "note": "Decoded stealer sitecustomize variant", "source": 1 }, { "type": "domain", "value": "litellm.dev", "note": "Attacker-controlled exfil (lookalike)", "source": 2 }, { "type": "url", "value": "http://www.litellm.dev/healthcheck", "note": "Exfiltration endpoint", "source": 4 }, { "type": "other", "value": "PRIVCOLLECT_ACTIVE=1", "note": "Environment variable indicator", "source": 2 }, { "type": "sha256", "value": "84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d", "note": "cook.pth persistence hook - Windows", "source": 2 }, { "type": "sha256", "value": "7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb", "note": "cook.pth persistence hook - Linux/MacOS", "source": 2 }, { "type": "sha256", "value": "03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea", "note": "cook.py credential stealer payload (22,252 bytes) - Windows", "source": 2 }, { "type": "sha256", "value": "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", "note": "cook.py credential stealer payload (22,252 bytes) - Linux/MacOS", "source": 2 }, { "type": "sha256", "value": "b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465", "note": "sitecustomize.py loader with hourly backdoor loop (25,509 bytes) - Windows", "source": 2 }, { "type": "sha256", "value": "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa", "note": "sitecustomize.py loader with hourly backdoor loop (25,509 bytes) - Linux/MacOS", "source": 2 }, { "type": "ip", "value": "168.100.8.57", "note": "Attacker IP used to validate stolen AWS credentials", "source": 2 }, { "type": "ip", "value": "165.227.201.8", "note": "Attacker IP used to validate stolen AWS credentials", "source": 2 }, { "type": "file-path", "value": "cook/purelib/cook.pth", "note": "Startup payload file in the source revision and wheel", "source": 4 }, { "type": "file-path", "value": "litellm-1.107.0.data/purelib/cook.pth", "note": "Startup hook file in the wheels", "source": 4 }, { "type": "file-path", "value": "litellm-1.107.0.data/purelib/cook.py", "note": "Collector wrapper in the wheels", "source": 4 }, { "type": "file-path", "value": "litellm-1.107.0.data/purelib/sitecustomize.py", "note": "Background loader in the wheels", "source": 4 }, { "type": "other", "value": "letters9813/pythonclient-test", "note": "GitHub repository hosting the loader pointer", "source": 4 }, { "type": "url", "value": "https://github.com/Berri-AI/litellm", "note": "Lookalike source repository recorded in provenance", "source": 4 }, { "type": "other", "value": "20535d8fa11f786a6c24df7488a0e449ed5f09ad", "note": "Recorded source revision", "source": 4 }, { "type": "other", "value": "783c43bc455d2e05d3cfaf194c2f325cfeab1433", "note": "Commit adding the Maturin data directory", "source": 4 }, { "type": "sha256", "value": "0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a", "note": "Wheel litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl", "source": 4 }, { "type": "sha256", "value": "668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6", "note": "Wheel litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl", "source": 4 }, { "type": "sha256", "value": "462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7", "note": "Wheel litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl", "source": 4 }, { "type": "sha256", "value": "c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054", "note": "Wheel litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl", "source": 4 }, { "type": "sha256", "value": "1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00", "note": "Wheel litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl", "source": 4 }, { "type": "sha256", "value": "12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484", "note": "Wheel litellm-1.107.0-cp310-abi3-win_amd64.whl", "source": 4 }, { "type": "sha256", "value": "1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e", "note": "Container image index", "source": 4 }, { "type": "sha256", "value": "bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5", "note": "Linux amd64 manifest", "source": 4 }, { "type": "sha256", "value": "56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf", "note": "Linux arm64 manifest", "source": 4 }, { "type": "github-account", "value": "Berri-AI", "note": "lookalike source repository owner", "source": 5 }, { "type": "user-agent", "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0)", "note": "exfiltration user agent", "source": 5 }, { "type": "sha256", "value": "2befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f819", "note": "litellm-1.107.0.tar.gz sdist hash", "source": 5 }, { "type": "other", "value": "XWiA8gZNa7NcX2XRoAEb", "note": "exfiltration token value (X-Token)", "source": 5 }, { "type": "other", "value": "Commit 783c43bc455d2e05d3cfaf194c2f325cfeab1433", "note": "Adds the Maturin data setting and payload", "source": 6 }, { "type": "other", "value": "Commit 20535d8fa11f786a6c24df7488a0e449ed5f09ad", "note": "Adds COPY cook ./cook to Dockerfiles; recorded build revision", "source": 6 }, { "type": "other", "value": "9cf97e935aeaf791b9c8db224a2bb3ee156134ce", "note": "Unauthorized workflow commit applied to release workflow", "source": 0 }, { "type": "file-path", "value": "site-packages/cook.py", "note": "Stealer payload", "source": 1 }, { "type": "file-path", "value": "site-packages/sitecustomize.py", "note": "Remote-code loader", "source": 1 }, { "type": "other", "value": "a898fd08ad220fed52488906eb45d196f332b972ad5d85214e7726545ecc4218", "note": "RSA-4096 public-key fingerprint, SHA-256 of DER SubjectPublicKeyInfo", "source": 1 } ], "sources": [ { "publisher": "litellm", "title": "Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised", "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "published": "2026-10-21T00:00:00Z" }, { "publisher": "litellm", "title": "[SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest/main-stable removed): cook.pth credential stealer + sitecustomize RCE loader, built from lookalike repo Berri-AI/litellm", "url": "https://github.com/BerriAI/litellm/issues/47826", "published": "2026-10-21T13:23:00Z" }, { "publisher": "Wiz", "title": "LiteLLM Compromised, Steals Credentials", "url": "https://www.wiz.io/blog/litellm-compromised-steals-credentials", "published": "2026-10-21T00:00:00Z" }, { "publisher": "Datadog Security Labs", "title": "LiteLLM supply chain compromise: What you need to know", "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/", "published": "2026-10-21T00:00:00Z" }, { "publisher": "Socket", "title": "LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials", "url": "https://socket.dev/blog/litellm-compromise", "published": "2026-10-21T00:00:00Z" }, { "publisher": "StepSecurity", "title": "litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader", "url": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer", "published": "2026-10-21T00:00:00Z" }, { "publisher": "Endor Labs", "title": "LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials", "url": "https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials", "published": "2026-10-21T00:00:00Z" }, { "publisher": "Aikido", "title": "LiteLLM compromised again: infostealer and RAT found in version 1.107.0", "url": "https://www.aikido.dev/blog/litellm-compromised-infostealer-rat", "published": "2026-10-21T00:00:00Z" }, { "publisher": "SecurityWeek", "title": "LiteLLM Compromised in Fresh Supply Chain Attack", "url": "https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/", "published": "2026-10-23T04:10:00Z" } ], "changelog": [ { "time": "2026-10-23T05:37:41Z", "note": "First published." }, { "time": "2026-10-23T10:38:09Z", "note": "Added the unconfirmed initial access, SecurityWeek's Claude Code token-leak report, Datadog and Socket details, extra timeline entries and checks; removed the unsupported claim about a patched… Added 4 sources, 1 package, 13 indicators." } ], "image": "https://headlines.subcloak.com/og/h-2026-0001.jpg" } ] }