Cyber, in brief

LiteLLM, free software that connects company apps to AI services, said on Friday how its release was taken over: through a secret key that leaked in May and was never cancelled. [1]

LiteLLM is downloaded about 92 million times a month from PyPI, the main store for Python software, and companies such as NVIDIA, Netflix and AT&T use it. [4]

On 27 May a settings file posted to one of its public GitHub projects held the master key to an internal tool LiteLLM uses to run AI agents. [1]

The team spotted the mistake quickly and wrote over the file, and listed the keys in it to be cancelled. The master key was never cancelled. [1]

On 10 October an attacker used that key to get into the tool and took a GitHub login token stored there. [1] The token was not limited, and it belonged to the owner of LiteLLM's GitHub account, so it opened every project. [1]

The same night the attacker ran hidden jobs that collected the GitHub logins of two engineers allowed to publish releases. [1] Socket, a security firm, found the jobs ran on branches made and deleted within minutes, leaving almost no trace. [1]

Normally a release needs one engineer to start it and a special account, locked to a device in LiteLLM's office, to approve it. [1] That week the rule had been loosened so any two engineers could do both, to ship fixes faster. [1]

The attacker used one stolen login to start the release and the other to approve it. [1][5] The poisoned version, 1.107.0, went out and was pulled on 21 October. [1]

It was downloaded more than 49,000 times in about three hours, by one estimate. [3] Microsoft said on 23 October that deleting LiteLLM's own files can leave its hidden start-up code behind. [1]

LiteLLM's first account, on 22 October, said the tokens had probably leaked into its own logs through Claude Code, an AI coding tool. [2][3] Friday's account traces the break-in to the May key instead. [1]

LiteLLM says it is now cancelling every token for every internal system and outside service it uses. [1]

Why it matters. LiteLLM is cancelling every token it holds, and the open question is whether the AI and cloud keys stolen from its own systems and its users' machines were used before they were changed. [1][3]

A flaw in Brotli, Google's code for shrinking web data, also sits in Bun, Python's Brotli packages and the Envoy and Istio network tools. [6] Bad compressed data can write past the end of a memory buffer, which can crash a program or let an attacker run code. [6] Node.js and Google shipped fixes on 21 October. [7] Each program carries its own copy of the code, so each must be updated on its own. [6] CISA, the US cyber-defence agency, recorded no attacks on 23 October. [6]

Why it matters. In Python a program is exposed just by having the Brotli package installed, since common web tools unpack Brotli data by themselves. [6] A running program keeps the old code until it is restarted. [6]

Ruby, a programming language, released versions 4.0.9, 3.4.12 and 3.3.13 on 23 October. [8] They fix three bugs in Onigmo, the part of Ruby that reads search patterns. [8] Those bugs lay behind four critical flaws that GitLab, a site where teams store and build code, patched between 23 September and 21 October. [8] The two October flaws needed no login and were rated 10 out of 10. [8] GitLab had fixed them by shipping its own patched copy of Ruby. [9]

Why it matters. Any program that turns text from an outsider into a search pattern was exposed, not just GitLab. [8] Ruby 3.2 and older get no fix, and Ruby has not given the bugs their own ID numbers, so tools that check by number see only GitLab. [8]

Bluesky, a social network, says a phishing attack has taken over more than 4,500 accounts. [10] Phishing tricks people into typing their login into a fake page. The attack spread through posts promising a fake government payment. [10] Bluesky has suspended the taken accounts for now. [10] It says it is working with their owners to secure the accounts and give them back. [10]

Why it matters. Owners whose accounts were suspended are told to email Bluesky's moderation team to get back in. [10] Bluesky has not said who ran the attack or how many owners have their accounts back.

Dataminr, a firm that tracks threats, found phishing sites dressed as login pages for Okta and ServiceNow, two widely used business login and software services. [10] They target companies that run the systems behind online shops. [10] The pages ask people who sign in with a YubiKey, a small hardware login key, to switch to a code sent by text or email instead. [10] Dataminr says this gets round the hardware key wherever company rules still allow those codes as a fallback. [10]

Why it matters. A hardware key only answers the real website, but a typed code can be passed on from a fake one. Dataminr says breaking into these service firms gives attackers a way into the shops they serve. [10]

Sunil Tripathy, a security researcher, showed a flaw in ChatGPT's link to GitHub, the site where programmers keep their code. [10] Hidden instructions in a public project could lead ChatGPT, asked to review it, to write a job into a different, private project of the user. [10] That job could then run and send the private project's secrets out. [10] Part of the cause is that the link's default setting reaches every project an account holds. [10] OpenAI said the issue was out of scope for its bug reports. [10]

Why it matters. The attacker needs no access to the victim's account, only a public project and a request to review it, Tripathy says. [10] Every user who left the default setting in place is inside its reach. [10]

Hirundo, an AI company, tested Qwen3-Coder, a Chinese AI model that writes software. [10] It says apps were 19% more likely to be hackable when the model was told they were for a US defence contractor rather than a Chinese one. [10] Apps for a Hong Kong democracy group were 28% more likely to let any user read everyone's secrets. [10] Hirundo says the effect goes away when the model's pro-China leaning is removed. [10]

Why it matters. Companies around the world are building these open Chinese models into their work. [10] Booz Allen Hamilton, a US consulting firm, reported a similar finding in May. [10]

Laravel, a popular toolkit for building websites in the PHP language, fixed a critical flaw rated 9.2 out of 10. [10] It sits in TokenGuard, the part that checks the secret key an app sends to prove who it is. [10] On some MySQL or MariaDB database setups, a specially shaped value could log an outsider in as another user without that user's key. [10] The fix is in versions 13.29.0 and 12.68.0. [10]

Why it matters. Any page a site protects with that built-in check could have its accounts taken over by a stranger. [10] The attacker needs no login of their own. [10]

Three pieces of business software have fixes for flaws that let outsiders in, The Hacker News reports. [10] GLPI, a tool firms use to track their computers and help-desk requests, had a flaw letting an outsider read its whole database, fixed in 11.0.9. [10] Rapid7, a security firm, found three flaws in Eptura Archibus, building-management software, that let an attacker run commands without logging in. [10] A flaw rated 10 out of 10 in NVIDIA's AIStore, storage for AI data, can hand over the computer it runs on. [10]

Why it matters. Each of these tools holds a company's records, so one flaw opens far more than the tool itself. Rapid7 says an attacker on Archibus could read secrets and passwords out of its database. [10]

Andromeda, a company that provides computing for AI work, said it found on 13 October that someone had reached credentials inside its systems. [10] It shut the affected accounts that day and says it has seen no misuse since. [10] It believes the break-in was part of an attack across the industry around 9 October. [10] A limited number of customers were hit, and it found no sign anyone reached their AI models or data. [10]

Why it matters. Some of the exposed credentials were customers' own, not only Andromeda's. [10] Andromeda says customers it believes were affected have already heard from it. [10]

Pillar Security found a critical flaw in OpenCode, an AI tool that helps people write software, on Windows computers. [10] A rogue outside service plugged into OpenCode could run its own code on a programmer's machine during sign-in, with no extra click. [10] The maker, Anomaly, fixed it in version 1.18.33. [10] It comes days after OpenCode confirmed a break-in at its Console, which could have exposed users' keys for Anthropic, OpenAI and Google AI services. [10]

Why it matters. OpenCode said the earlier break-in hit 1.4% of its Console users, as part of a large attempt to copy AI models. [10] Its Windows users now need the update as well. [10]

Google's Chrome browser now asks permission before opening a website over plain HTTP, which sends pages without encryption. [10] Encryption scrambles what travels between a browser and a site so nobody on the way can read or change it. [10] Until now the warning was only for people who had switched on Chrome's strongest safety mode. [10] It is now on for every user by default. [10]

Why it matters. Anyone on the same network, such as a public Wi-Fi, can read or alter an unencrypted page, and the new question warns people before they open one. [10] Google calls the change the end of more than ten years of work. [10]

NordVPN, a security company, says it found 52 billion stolen cookies in leaked data online in the year to June, the Guardian reports. [11] A session cookie is the small file a website gives a browser after login so it need not ask again. [11] Malicious programs on a computer copy these cookies and send them to criminals. [11] With one, a thief can enter the account without the password or a login alert, and can often skip the second check. [11]

Why it matters. NordVPN's Marijus Briedis says closing a tab does not end a session, but logging out makes the cookie useless to a thief. [11] He says the malware usually hides in browser add-ons and downloaded software. [11]

VulnCheck, a firm that tracks attacks on software flaws, says it saw attacks on five old, known flaws from three internet addresses in Hong Kong and Taiwan. [10] The addresses appear in the US government's warning about Flax Typhoon, a hacking group linked to China. [10] Earlier this month the FBI and the US Justice Department disrupted tools the group used to scan and break into networks. [10] The flaws include ones in Apache web servers and XWiki, software for shared web pages. [10]

Why it matters. VulnCheck published its alert as a follow-up to the FBI's action. [10] All five flaws have had fixes for a year or more, so the servers at risk are the ones never updated.

GMO Internet, a large Japanese web company, asked Japan's government on Saturday to use new cyber defence powers against hackers who broke into one of its services. [12] The powers took effect on 1 October, and let police and Japan's Self-Defense Forces break into attackers' servers and disable them. [12] The hackers hit Onamae.com Desktop Cloud, which rents out servers to people who trade currencies by machine. [12] They then demanded money, threatening to keep placing trades through accounts at over 70 trading firms. [12] GMO says it will not pay. [12]

Why it matters. GMO says this would be the first use of the powers, though it is not on the law's list of critical operators, Impress Watch reports. [12] GMO will pay 5,000 yen, about $32, to every current customer and is closing the service for good. [12]