LiteLLM Poisoned in Supply Chain Hit

LiteLLM is a Python library that lets developers connect to dozens of AI models through a single interface. It is widely used in AI development workflows. According to The Hacker News, version 1.107.0 of LiteLLM was compromised in a supply chain attack (where an attacker poisons a software package before it reaches the people who install it), slipping a credential stealer and a backdoor into the official release on PyPI (the central repository where Python developers download packages).

The attacker did not break into LiteLLM's servers directly. Instead, they used stolen GitHub CLI OAuth tokens (temporary login passes that let tools act on your behalf on GitHub) belonging to three engineers' accounts. Two accounts were used in sequence — one to trigger the release pipeline and one to approve it. The compromised package was quarantined and the malicious Docker images were removed, but not before the damage was done.

The malware, which ran automatically the moment the package was imported, harvested cloud tokens, private keys, browser data from Chrome and Firefox, AI tooling credentials, and environment variables. Everything collected was bundled up and sent to an attacker-controlled server. A second component acted as a backdoor, checking in every hour for new instructions.

Who is at risk: Developers or teams who installed LiteLLM 1.107.0 between its release and the quarantine.

What to do: If you installed that version, revoke and replace every credential from a clean machine immediately. Pin your LiteLLM installation to version 1.106.2 by digest so that future installs pull a verified, unmodified copy.

Email security filters were built around a simple truth: attackers cut corners. Reused templates, awkward phrasing, and suspicious new infrastructure left patterns that filters learned to catch. Generative AI has quietly removed every one of those shortcuts, according to research shared by Proofpoint at its Protect 2026 conference, reported by The Hacker News.

In one documented campaign, a single attacker contacted over 30 real estate agents at the same company — each from a different account, each about a different property, each in different words — before funnelling every thread toward the same goal: join a video call. The FBI counted $3.05 billion in business email compromise (BEC) losses in 2025 alone.

The shift matters because the old question — "does this message look unusual?" — no longer works. When AI can write a perfect, personalised email for every target in seconds, what the message is trying to get you to do becomes the only reliable signal.

What to do: Be sceptical of any unexpected meeting invitation or urgent request that arrives through a new contact, even if the email reads perfectly.

What FortiSIEM is: FortiSIEM is Fortinet's security information and event management platform — software that organisations use to collect, monitor, and analyse security logs across their entire network from a single dashboard.

What it is: A critical path traversal flaw (where an attacker manipulates file path references to reach files outside the intended directory, like navigating from a guest room into a locked server room by exploiting the stairwell) that allows an unauthenticated attacker to execute arbitrary code remotely.

Who's at risk: Anyone running FortiSIEM 7.5.0. Version 7.6 is not affected. A public proof-of-concept exploit is now available, meaning the bar to exploitation is low.

CVSS: 9.4 (Critical — patch today)

Root cause: The flaw lives inside a function called SendQueryResult(), which accepts a user-supplied query-id parameter and passes it directly into a file path without validating it. Two weaknesses combine: directory traversal sequences (../) let an attacker escape the intended folder, and a null byte (\0) injected into the parameter causes the operating system to ignore everything that follows it, allowing the attacker to choose the exact filename to overwrite.

Attack vector: An unauthenticated attacker connects to the gRPC service (a framework for communication between services) on TCP port 27918. By crafting a query-id value containing traversal sequences and a null byte, they can overwrite a shell script (redishb.sh) that runs automatically every 60 seconds via a scheduled task. Replacing that script with malicious code gives the attacker remote code execution (the ability to run any command on the target server) with no login required.

Detection strategies:

1. Check logs on port 27918 for unexpected external connections or unusual gRPC traffic.
2. Monitor redishb.sh and surrounding files in /opt/charting/ for unexpected modifications or timestamp changes.
3. Look for anomalous cron job activity or unexpected outbound connections from the FortiSIEM host.

Recommended actions:

1. Upgrade FortiSIEM 7.5.0 to version 7.5.1 or above immediately.
2. Restrict access to TCP port 27918 at the network perimeter — this service should not be reachable from untrusted networks.
3. Review recent file modification logs on affected systems to check whether exploitation has already occurred.

ClickFix is a social engineering technique (a trick that manipulates people rather than exploiting software) where a fake error page — dressed up as a Cloudflare check or Google reCAPTCHA — instructs you to copy a command and paste it into your computer's Run dialog or Terminal. The moment you press Enter, the malware runs. Because the command leaves the browser entirely, Chrome's usual download protections never see it.

Google is now rolling out a defence in Chrome: if you copy a suspicious command while Enhanced Protection is enabled, Chrome intercepts the clipboard content, scrubs personal data, and checks it against Safe Browsing before you get the chance to paste and run it. A warning appears if the command is flagged as dangerous.

What to do: In Chrome, go to Settings → Privacy and Security → Security → select Enhanced Protection. It is free, already available, and now does something traditional download scanning could not.

The Department of Homeland Security has formally ordered all U.S. federal civilian agencies to remove DeepSeek products from their systems and stop purchasing from the Chinese AI developer, according to The Hacker News. The order, signed in July but published in the Federal Register on 20 October 2026, also reaches government contractors — any firm with a relevant contract clause must audit its supply chain and report any DeepSeek use within three business days of identifying it. The order does not restrict private companies or individuals.