Malware Activity
LiteLLM Release Compromised, Turns Python Environments into Credential-Stealing RAT
LiteLLM, a widely used Python proxy library for LLM providers, suffered a supply-chain compromise on October 21, 2026, when attackers pushed a malicious release (v1.107.0) to PyPI and official Docker/GHCR images for about two (2) hours. The poisoned build added three (3) files (cook.pth, cook.py, and sitecustomize.py) that run automatically whenever Python starts, turning any Python process into a credential stealer and remote access trojan (RAT) host even if LiteLLM is never imported. The Python script “cook.py” deobfuscates itself, runs a privcollect routine, and exfiltrates cloud, developer, AI-tool, browser, and LiteLLM proxy secrets to a lookalike domain (litellm[.]dev/healthcheck). The second Python script file “sitecustomize.py” (on Linux/macOS) polls a GitHub “dead drop” for a domain and hourly fetches Python payloads from “https://{domain}/codepy”, though only test values were seen by researchers before GitHub removed the file. LiteLLM’s investigation found attackers used stolen GitHub CLI OAuth tokens from three (3) engineers to disable branch protections and run the legitimate private release workflow against a malicious fork (Berri-AI/litellm vs BerriAI/litellm), producing signed artifacts that looked legitimate. This is the second LiteLLM compromise in 2026, though no link to the March TeamPCP incident has been established. Affected users must manually delete the path file and Python script files “cook.pth”, “cook.py”, and “sitecustomize.py”, remove all 1.107.0 artifacts, revert to 1.106.2, rotate every reachable credential, and audit logs for misuse during the exposure window. Additional info related to IOCs and other executable artifacts can be found in the articles and reports linked below.
- The Hacker News: LiteLLM Supply Chain Compromise Article
- Datadog: LiteLLM Supply Chain Compromise Article
- LiteLLM: Incident Containement Report
Threat Actor Activity
SafePay Emerges as Major Global Ransomware Threat, New CISA Advisory
SafePay is now one of the most active ransomware groups, with law enforcement agencies saying it has breached more than 600 organizations worldwide since August 2024, including critical infrastructure in North America, South America, Europe, and Australia. The gang gains initial access via exposed credentials, brute‑force password attacks, phishing, and exploitation of edge‑device vulnerabilities (VPNs, firewalls, backup appliances), then creates or hijacks accounts and uses legitimate tools (AnyDesk, TeamViewer, compression utilities) to move laterally, exfiltrate data, and deploy ransomware. SafePay typically demands a percentage of company revenue in cryptocurrency and uses double‑extortion, stealing sensitive documents before encryption and threatening leaks. It has hit major IT providers and government contractors such as Conduent, causing widespread disruption to services like Medicaid and toll systems. CTIX Analysts, in line with CISA, FBI, and other federal and global partners, urge organizations to implement MFA and strong ICAM, restrict admin tools, patch actively exploited CVEs, and report incidents, noting that paying ransoms does not guarantee recovery.
- Bleeping Computer: SafePay Ransomware Advisory Article
- The Record: SafePay Ransomware Advisory Article
- CISA: SafePay Ransomware Advisory Report
Vulnerabilities
Critical PHP2Shell Vulnerabilities Trigger Widespread Exploitation and Global Emergency Patching Efforts
Two (2) critical PHP vulnerabilities, collectively dubbed PHP2Shell, have triggered widespread exploitation attempts, emergency patching efforts, and service disruptions worldwide. Discovered by researchers from Calif, OpenAI, and Wiz, the flaws carry CVSS scores of 9.2/10 and enable unauthenticated remote code execution (RCE) through memory corruption and use-after-free conditions, potentially allowing attackers to compromise vulnerable web servers without triggering conventional application-level logging. Amazon Threat Intelligence identified exploitation attempts as early as October 17, 2026, ahead of public disclosure, with subsequent activity involving multiple threat actors leveraging anonymized infrastructure and AI-assisted proof-of-concept exploits. Cloudflare and other security firms confirmed active exploitation attempts, while WebOps reported blocking more than 60,000 suspicious requests targeting the vulnerabilities. The disclosure prompted urgent warnings from multiple U.S and international cybersecurity agencies, with organizations including Nintendo temporarily suspending services to mitigate exposure. The vulnerabilities pose significant risks due to PHP’s widespread adoption, with Modat identifying approximately 4.38 million internet-facing PHP services (79% of which run unsupported versions). CTIX analysts urge administrators to immediately deploy patched PHP releases, while isolating systems that cannot be updated. Security researchers warn that legacy PHP installations, limited visibility into vulnerable infrastructure, and increasingly rapid AI-assisted exploit development significantly increase the risk of widespread compromise.
- Bleeping Computer: PHP2Shell Article
- The Hacker News: PHP2Shell Article
- The Record: PHP2Shell Article
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
