Cybersecurity articles tagged #LiteLLM on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attackshttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacksAustralian Federal Police arrest two men linked to TeamPCP, a cybercrime syndicate behind major software supply chain attacks and data extortion.Tue, 01 Sep 2026 02:41:36 GMTTeamPCPSupply Chain AttackShai HuludGitHubLiteLLMhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgshttps://runtimerebel.com/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgsA supply chain attack attributed to TeamPCP compromised over 2,500 organizations, primarily through Aqua Security's Trivy scanner, not LiteLLM.Sat, 15 Aug 2026 00:42:24 GMTTeamPCPTrivyLiteLLMSupply Chain AttackShai Huludhttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcphttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcpMalicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.Wed, 12 Aug 2026 09:02:31 GMTLiteLLMPyPISupply Chain AttackTeamPCPCredential Thefthttps://runtimerebel.com/blog/litellm-proxy-server-takeover-via-critical-vulnerability-chainhttps://runtimerebel.com/blog/litellm-proxy-server-takeover-via-critical-vulnerability-chainResearchers at Obsidian Security have identified a three-vulnerability chain in LiteLLM that allows low-privilege users to gain full server control.Mon, 15 Jun 2026 17:44:24 GMTLiteLLMObsidian SecurityAI GatewayPrivilege EscalationRCEhttps://runtimerebel.com/blog/cve-2026-42271-berriai-litellm-rce-exploited-in-the-wildhttps://runtimerebel.com/blog/cve-2026-42271-berriai-litellm-rce-exploited-in-the-wildCISA warns of active exploitation of CVE-2026-42271 in BerriAI LiteLLM. This command injection flaw allows attackers to achieve RCE and compromise AI proxies.Tue, 09 Jun 2026 09:15:35 GMTCVE-2026-42271LiteLLMBerriAICISA KEVRCECommand Injectionhttps://runtimerebel.com/blog/litellm-proxy-data-exposure-modification-urgent-patch-requiredhttps://runtimerebel.com/blog/litellm-proxy-data-exposure-modification-urgent-patch-requiredCritical vulnerability in LiteLLM proxy enables unauthorized database read/modify access. Exploitation observed shortly after disclosure. Patch immediately.Wed, 29 Apr 2026 16:39:36 GMTLiteLLMData ExposureLLM SecurityProxy VulnerabilityDatabase Accesshttps://runtimerebel.com/blog/cve-2026-42208-active-exploitation-of-litellm-sql-injectionhttps://runtimerebel.com/blog/cve-2026-42208-active-exploitation-of-litellm-sql-injectionAttackers are actively exploiting CVE-2026-42208, a critical SQL injection flaw in LiteLLM, within 36 hours of disclosure. Patch to prevent database compromise.Wed, 29 Apr 2026 08:52:44 GMTCVE-2026-42208LiteLLMBerriAISQL Injectionhttps://runtimerebel.com/blog/cve-2026-42208-litellm-pre-auth-sqli-actively-exploited-patch-nowhttps://runtimerebel.com/blog/cve-2026-42208-litellm-pre-auth-sqli-actively-exploited-patch-nowHackers are actively exploiting CVE-2026-42208, a critical pre-authentication SQL injection vulnerability in LiteLLM, to access sensitive data.Wed, 29 Apr 2026 00:51:59 GMTCVE-2026-42208LiteLLMSQL InjectionPre AuthenticationLLM Gatewayhttps://runtimerebel.com/blog/litellm-1-82-8-supply-chain-compromise-via-malicious-pth-filehttps://runtimerebel.com/blog/litellm-1-82-8-supply-chain-compromise-via-malicious-pth-fileSecurity analysis of a supply chain compromise in litellm 1.82.8 on PyPI, where a malicious .pth file enables automatic code execution on Python startup.Wed, 08 Apr 2026 12:29:28 GMTLiteLLMPyPISupply Chain AttackPythonRCEhttps://runtimerebel.com/blog/mercor-hit-by-litellm-supply-chain-attack-lapsus-claims-4tb-data-thefthttps://runtimerebel.com/blog/mercor-hit-by-litellm-supply-chain-attack-lapsus-claims-4tb-data-theftAI recruiting firm Mercor is investigating a LiteLLM supply chain attack, with Lapsus$ claiming to have stolen 4TB of sensitive data.Thu, 02 Apr 2026 12:29:10 GMTMercorLiteLLMLapsusSupply Chain AttackData TheftAI Securityhttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-wider-scope-litellm-pypi-compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-wider-scope-litellm-pypi-compromiseAn update on the TeamPCP supply chain campaign details wider Checkmarx impact, LiteLLM PyPI compromise, and a CISA KEV entry.Thu, 26 Mar 2026 20:16:14 GMTTeamPCPSupply Chain AttackCheckmarxLiteLLMPyPICISA KEVhttps://runtimerebel.com/blog/checkmarx-kics-vs-code-plugin-targeted-in-supply-chain-attackhttps://runtimerebel.com/blog/checkmarx-kics-vs-code-plugin-targeted-in-supply-chain-attackTeamPCP exploited Checkmarx KICS, VS Code plugins, and LiteLLM in a supply chain attack targeting code scanners and AI libraries, indicating expanding threats.Wed, 25 Mar 2026 00:37:08 GMTTeamPCPCheckmarx KICSVS CodeLiteLLMSupply Chain Attackhttps://runtimerebel.com/blog/litellm-pypi-supply-chain-attack-teampcp-steals-credentialshttps://runtimerebel.com/blog/litellm-pypi-supply-chain-attack-teampcp-steals-credentialsTeamPCP compromised the LiteLLM PyPI package, backdooring it to steal credentials and auth tokens from hundreds of thousands of devices.Wed, 25 Mar 2026 00:36:46 GMTLiteLLMPyPITeamPCPSupply Chain AttackCredential TheftPython Packagehttps://runtimerebel.com/blog/teampcp-backdoors-litellm-1-82-7-1-82-8-via-ci-cd-compromisehttps://runtimerebel.com/blog/teampcp-backdoors-litellm-1-82-7-1-82-8-via-ci-cd-compromiseTeamPCP threat actors compromised LiteLLM versions 1.82.7 and 1.82.8, deploying credential harvesters and Kubernetes lateral movement tools via CI/CD.Tue, 24 Mar 2026 20:18:30 GMTLiteLLMTeamPCPSupply Chain AttackPython SecurityKubernetes