SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Hacker breaches LiteLLM via unrevoked key and publishes malicious software update

0
·1 views

An attacker exploited a master key that had been accidentally published in a public LiteLLM repository and never revoked, gaining access to the project's release pipeline. Using an administrator access key obtained through that breach, the intruder pushed a tampered version 1.107.0 to PyPI and container registries on October 21, 2026. The malicious release was designed to launch automatically when Python started, carrying a credential-stealing tool and a backdoor for Unix systems. Security researcher Lidor Machluf of Upwind detected the attack, and distribution platforms quarantined or removed the infected files within a few hours.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Hybrid Humanity: How Cognitive Architecture Could Shape Freedom After AGI

The article explores a vision of Hybrid Humanity, in which AI-based cognitive augmentations serve as tools that expand genuine human agency. Drawing on the capability approach, the author argues that technology should enhance real human abilities rather than remain a privilege of elites. The author warns that a new divide could emerge between people using audited systems and those reliant on models shaped by corporate interests. To address this, the text proposes a polycentric network of intelligent institutions, termed Supersociety, that favors infrastructural pluralism over monolithic control. According to the author, cognitive freedom in a post-AGI world depends on open standards and the ability to switch augmentation providers, making competition policy central to that freedom.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Three CLI commands to run before shipping a side project: doctor, migrate, backup

The author argues that side projects often fail due to overlooked setup, migration, and backup gaps rather than weak ideas. They introduce Yatta JS, a backend-as-a-server for Bun that embeds database, auth, storage, and other services in the application process, available on npm as yatta.js. The post recommends running its doctor command to check project setup before every deploy, treating migrations as a routine repeatable workflow, and practicing backups and restores before they are needed. The author stresses that these tools do not replace careful judgment, and invites readers to share their own pre-launch habits.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Announces Lightweight FatafatOS 81 Update Claiming Minimal Hardware Needs

A developer named Karthik, who works under the handle Fatafat321 and is based in Elikatta, Telangana, India, has announced a major update to FatafatOS 81. The post claims the operating system runs on an old Intel i5 processor with low graphics and uses almost no RAM. It also states the system boots in about three seconds and has restored floppy disk support. The developer contrasts the project with heavier operating systems such as Windows, which he says requires 8GB of RAM, and invites users to share their PC specifications to see whether the system will run on them. The announcement is a self-published claim from a developer post and has not been independently verified.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Implementing API Key Authentication for REST APIs with Spring Security

A DEV Community guide explains how to add API key authentication to stateless REST APIs using Spring Security. It points out that the default session-based, form-login setup, with its CSRF tokens and cookies, is a poor fit for JSON endpoints consumed by internal tools, mobile apps, and partners. The recommended approach is a simple secret key sent in a request header, which is easier to generate, rotate, and audit than OAuth or JWT. The tutorial covers a custom authentication token and provider, a filter chain that extracts the key, and secure storage with hashing and rotation. It also addresses testing, common pitfalls such as leaking keys in logs, and production hardening like rate limiting, revocation, and monitoring.

0 comments Read more at DEV Community
Hacker breaches LiteLLM via unrevoked key and publishes malicious software update · ShortSingh