Security
Vulnerabilities, breaches and supply-chain attacks. Every story links its sources.
- Malicious LiteLLM 1.107.0 release on PyPI and Docker carried a credential stealer (thehackernews.com)A poisoned LiteLLM release on PyPI and Docker carried a credential stealer and an hourly backdoor. Affected builds, how the malware worked and how the attacker got in.
- Arista says VeloCloud Orchestrator flaw is being actively exploited (arista.com)CVE-2026-114625 (CVSS 9.9) in on-prem VeloCloud Orchestrator lets any authenticated user gain operator privileges. Fixes are in 5.2.3.18, 6.1.3.10 and 6.4.2.12.
- PHP security releases fix two remote code execution bugs after early leak (thephp.foundation)Releases across PHP 8.x fix two RCE flaws reported by Wiz Research. Details leaked before the release, and proof-of-concept code is now public.
- GitLab fixes CVSS 10.0 flaw affecting self-managed releases back to 7.0 (thehackernews.com)CVE-2026-110264 could allow an unauthenticated attacker to run code on self-managed GitLab servers. Instances updated on 12 October are in range again.
- Railway says intruder may have accessed customer environment variables (blog.railway.com)Railway detected anomalous activity on systems storing customer environment variables, some of which may have been decrypted. Deployments are paused while it investigates.