Installed LiteLLM 1.107.0 Comes Offline; a Patch Is Not Enough
- Ransomware & Extortion
- Exploited Vulnerabilities
- Threat Actor Operations
- Software Supply Chain
- Vulnerability Research & Advisories
StepSecurity reports malicious payloads across LiteLLM 1.107.0 wheels and official container images, putting installed systems and reachable credentials at risk.
Practitioners treated installation as an incident requiring isolation and a trusted rebuild, not another package update. The open question is how far the code ran and which secrets it touched.
- 02
- 04
- 03
Today on the ledger
Grouped by the seat that owns them, exploited CVEs first. Every row opens: what happened, what changed, why now, the evidence and what is still open.
- Condition-driven incident escalation
- Internet-facing exploitation
- Software supply-chain compromise
- Ransomware recovery assurance
- Evidence-bounded state attribution
- CISA KEV remediation is imminent
UpdatedCriticalRemediate PAN-OS GlobalProtect CVE-2026-0257 and review successful VPN sessions; isolate infrastructure when sessions, administrator changes, or downstream access cannot be explained. moved 8× this week — movements recorded for this subject in the seven days up to this edition
Raised by Threat Hunter
UpdatedCriticalRemediate PAN-OS GlobalProtect CVE-2026-0257 and review successful VPN sessions; isolate infrastructure when sessions, administrator changes, or downstream access cannot be explained. moved 8× this week — movements recorded for this subject in the seven days up to this edition
Raised by Threat Hunter
Ransomware groups - PAN-OS GlobalProtect portals and gateways - exploited vulnerability
Required operational action changed for this fingerprint; New CVE(s): CVE-2026-0257; New evidence URL(s) accompany material change
First tracked 3 editions ago; last material update this edition.
Last moved: this edition.
The source pack reports ransomware exploitation of CVE-2026-0257, while unexplained successful VPN sessions can indicate that exposure has progressed to unauthorized access.
Which successful VPN sessions and downstream actions cannot be tied to authorized users? — raised by Threat Hunter
NewCriticalUpgrade Plex Media Server to 1.43.3.10861 or later and hunt for Plex-spawned payloads, persistence, anomalous outbound traffic, or unauthorized changes. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Threat Hunter
NewCriticalUpgrade Plex Media Server to 1.43.3.10861 or later and hunt for Plex-spawned payloads, persistence, anomalous outbound traffic, or unauthorized changes. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Threat Hunter
Plex2Shell - Plex Media Server before 1.43.3.10861 - exploited vulnerability
Attackers are chaining four Plex Media Server flaws to steal administrator tokens and execute elevated code. Early honeypot attacks deployed cryptocurrency miners, and CISA added the flaws to KEV.
Last moved: this edition.
The source pack cites Plex2Shell inclusion in CISA KEV and an imminent remediation deadline, leaving little room for normal patch cycles.
Which exposed Plex servers show spawned payloads, persistence, or anomalous outbound connections? — raised by Threat Hunter
NewCriticalUpgrade PHP for CVE-2026-109618 and CVE-2026-109619 to a fixed release, reload the runtime, and hunt for command execution, payload retrieval, web shells, or persistence.
Raised by Threat Hunter
NewCriticalUpgrade PHP for CVE-2026-109618 and CVE-2026-109619 to a fixed release, reload the runtime, and hunt for command execution, payload retrieval, web shells, or persistence.
Raised by Threat Hunter
PHP - PHP 8.5 before 8.5.12 - exploited vulnerability
The source pack reports PHP2Shell exploitation attempts, and public-facing vulnerable runtimes require patching before scanning progresses to execution.
Which exposed deployments show host-side execution rather than unsuccessful exploit attempts? — raised by Threat Hunter
UpdatedCriticalIsolate systems that installed or executed LiteLLM 1.107.0, preserve runtime and secret-access evidence, rebuild from trusted artifacts, and rotate every reachable credential.
Raised by Supply Chain Analyst
UpdatedCriticalIsolate systems that installed or executed LiteLLM 1.107.0, preserve runtime and secret-access evidence, rebuild from trusted artifacts, and rotate every reachable credential.
Raised by Supply Chain Analyst
LiteLLM - LiteLLM 1.107.0 packages and images - supply chain compromise
Required operational action changed for this fingerprint; Severity moved to CRITICAL; New evidence URL(s) accompany material change
First tracked 106 editions ago; last material update this edition.
StepSecurity and the source pack report malicious payloads in LiteLLM 1.107.0 artifacts, making installation an incident-response trigger rather than a routine update.
Which credentials, repositories, cloud services, and control planes were reachable from each affected host? — raised by Supply Chain Analyst
NewHighRemove affected eMudhra intermediate certificates from trust stores and embedded bundles, then inventory validation components and signed binaries that may still trust the compromised chains.
Raised by Supply Chain Analyst
NewHighRemove affected eMudhra intermediate certificates from trust stores and embedded bundles, then inventory validation components and signed binaries that may still trust the compromised chains.
Raised by Supply Chain Analyst
eMudhra - intermediate CA certificates - supply chain compromise
Talos and the source pack report compromised eMudhra intermediate private keys and subsequent revocation, but retained trust material can outlive central blocking.
Which trust stores, validators, or embedded bundles still retain the affected certificate chain? — raised by Supply Chain Analyst
UpdatedHighIdentify OVHcloud CLI 0.11.0–0.15.0 installations from the affected release window, isolate executed copies, and rotate exposed cloud or deployment secrets. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Supply Chain Analyst
UpdatedHighIdentify OVHcloud CLI 0.11.0–0.15.0 installations from the affected release window, isolate executed copies, and rotate exposed cloud or deployment secrets. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Supply Chain Analyst
GlassWorm - OVHcloud command-line tool releases - supply chain compromise
Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked the prior edition; last material update this edition.
Last moved: this edition.
OVHcloud reportedly found substituted CLI release binaries, so organizations must determine whether affected copies were merely downloaded or actually executed.
Which affected CLI builds executed, and what secrets were accessible from those environments? — raised by Supply Chain Analyst
UpdatedHighHunt European defense, aerospace, shipbuilding, and law-enforcement environments for the reported APT28 Hookedge delivery chain without overstating state tasking or victim scope. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Intel Analyst
UpdatedHighHunt European defense, aerospace, shipbuilding, and law-enforcement environments for the reported APT28 Hookedge delivery chain without overstating state tasking or victim scope. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Intel Analyst
APT28 - NATO member-state shipbuilder - malware campaign
Russia-linked APT28 compromised a NATO member-state shipbuilder and targeted European government, defense, law-enforcement and aerospace organizations, delivering Hookedge malware through a malicious Word attachment.
Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked 86 editions ago; last material update this edition.
Last moved: this edition.
Reporting attributes the Hookedge campaign to APT28 and describes targeting relevant to European defense organizations, supporting a focused hunt without broadening the attribution claim.
Does additional victim or infrastructure evidence establish wider campaign scope or direct state tasking? — raised by Intel Analyst
UpdatedHighProve clean recovery of every Tier-1 service within its approved RTO using isolated, immutable, pre-compromise backups and rebuilt identity and service dependencies. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Industry Impact
UpdatedHighProve clean recovery of every Tier-1 service within its approved RTO using isolated, immutable, pre-compromise backups and rebuilt identity and service dependencies. moved 2× this week — movements recorded for this subject in the seven days up to this edition
Raised by Industry Impact
SafePay ransomware - internet-facing systems - ransomware breach
The FBI and CISA say SafePay has affected at least 600 organizations. Its operators exploit exposed systems, steal credentials, move laterally, exfiltrate data, encrypt networks and disrupt recovery.
Required operational action changed for this fingerprint; Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked the prior edition; last material update this edition.
Last moved: this edition.
The joint FBI-CISA advisory describes broad cumulative SafePay impact, but organizational urgency depends on whether clean recovery can be demonstrated within the required recovery time.
Can every Tier-One service be restored cleanly within RTO with identity, dependencies, and backup integrity verified? — raised by Industry Impact
How consistently did PHP2Shell activity result in successful execution rather than exploit attempts or honeypot observations; Does independent technical evidence corroborate Hookedge lineage, shared infrastructure, operator patterns, or additional victims; How many SafePay victims experienced material disruption, simultaneous downtime, revenue loss, ransom payment, or failed recovery.
4 open questions on the record
- 01Scope gap
How consistently did PHP2Shell activity result in successful execution rather than exploit attempts or honeypot observations?
Public proof-of-concept, attempts, and honeypot activity were reported, but the evidence of successful exploitation was described as inconsistent.
Raised byAlex Mercer - 02Scope gap
Does independent technical evidence corroborate Hookedge lineage, shared infrastructure, operator patterns, or additional victims?
Such evidence would raise confidence in APT28 attribution and could justify a broader response beyond the narrow campaign-specific hunt.
Raised byLena Hartmann - 03Scope gap
How many SafePay victims experienced material disruption, simultaneous downtime, revenue loss, ransom payment, or failed recovery?
The advisory provides a cumulative victim count but does not quantify these organization-level consequences.
Raised byPierre Lefevre - 04Scope gap
Can every Tier-1 service actually be restored cleanly inside its approved RTO?
An untested or failed restoration is treated as a material recovery crisis even when backup dashboards appear healthy.
Raised byPierre Lefevre
Every story that reached the table and what became of it: 4 opened for full debate, 4 touched briefly, 8 watched but not opened, 4 claims judged and set aside — each with the reason on record.
95 triaged4 opened4 touched briefly8 watched4 set aside
Put to the panel in full; the board above records what the debate produced.
- PHP - PHP 8.5 before 8.5.12 - exploited vulnerability (opens in new tab)
The cited prior items concern unrelated PAN-OS, Apple, and other exploit campaigns; token overlap is not substantive coverage. Active exploitation of a critical PHP flaw creates a distinct, urgent operator issue.
- LiteLLM - LiteLLM 1.107.0 packages and images - supply chain compromise (opens in new tab)
LiteLLM compromise and credential rotation were covered, but malicious 1.107.0 packages/images introduce a distinct supply-chain exposure path and change inventory, rebuild, and secret-rotation requirements.
- State Bank of India - customer records - data exposure (opens in new tab)
No prior item covers SBI or this incident; the cited matches are unrelated exposures. A major bank probing customer-record exposure and resulting fraud risk is a distinct, high-impact event warranting fresh scrutiny.
- Unnamed attackers - telecommunications voice authentication - AI-cloned voice SIM-swap attack (opens in new tab)
Prior sessions covered executive-impersonation payment fraud. This is a distinct control failure: cloned speech defeating telecom voice authentication to enable SIM swapping, with government/regulatory implications and different operator actions.
The panel noted these without opening a full debate — the one-line reason says why they rank below the orders.
- Signal - RingRTC before 2.72.0 - patched vulnerability (opens in new tab)
Prior items do not cover RingRTC or persistent microphone/camera access. This is a distinct, critical privacy flaw with a clear fixed version and immediate endpoint-upgrade implications.
- Domestic and foreign influence actors - Indian voters - 2027 election deepfake threat (opens in new tab)
Prior coverage only briefly addressed Kenya. The India-specific agency warning, claimed scale of 150 videos daily, domestic and foreign actors, and 2027 election scope materially reframe the operational and policy risk.
- APT28 - NATO member-state shipbuilder - malware campaign (opens in new tab)
APT28’s NATO defense campaign was deeply covered twice, but the identified member-state shipbuilder and reported government confirmation expand the known victim and critical-infrastructure scope.
- Global ransomware groups - Q3 2026 victims - ransomware activity trends (opens in new tab)
Prior Q3 coverage was only a quick claim-count caveat. Rapid7’s incident-based view adds exploitation within three days plus ransomware victim/scope trends, potentially changing patch-priority assumptions and giving the topic fresh operational value.
- SafePay ransomware - internet-facing systems - ransomware breach (opens in new tab)
Yesterday’s roundtable already led with the official CISA advisory, 600+ victims, backup destruction, containment, and recovery implications. This secondary report appears to restate that advisory without a new scope, IOC, attribution, or action change.
- INC and The Gentlemen affiliates - exposed ransomware infrastructure - malware campaign (opens in new tab)
Yesterday’s discussion already covered the exposed INC/The Gentlemen infrastructure, 62 victims, FortiClient EMS exploitation, AI use, and evidence caveats. This item shows no newly confirmed victims, attribution, IOCs, or defensive change.
- eMudhra - intermediate CA certificates - supply chain compromise (opens in new tab)
Yesterday’s discussion covered the eight exposed intermediate-CA keys, ecosystem distrust actions, lack of confirmed abuse, review needs, and outage risk. This candidate states no distinct new scope, abuse, IOC, or operator action.
- GlassWorm - OVHcloud command-line tool releases - supply chain compromise (opens in new tab)
The compromise, affected CLI versions, secret-theft risk, GlassWorm linkage, and response sequence were covered in depth yesterday. This item adds no concrete new victims, IOCs, remediation, attribution, or operational impact.
- French supermarkets - refrigeration controllers - supply chain compromise (opens in new tab)
The campaign, controller exposure, safety impacts, uncertain exploit linkage, and containment sequence were covered repeatedly through yesterday. This vendor commentary offers no concrete new attribution, scope, IOC, patch, or regulatory outcome.
- Ransomware groups - PAN-OS GlobalProtect portals and gateways - exploited vulnerability (opens in new tab)
The same CVE’s active ransomware exploitation was covered yesterday from Unit 42, while PAN-OS response basics were already covered deeply. This secondary report supplies no concrete new victims, IOCs, deadlines, or remediation changes.
- PHP2Shell vulnerabilities - PHP 8.5 before 8.5.12 - patched vulnerability (opens in new tab)
Prior items are unrelated patch stories; PHP2Shell has not received substantive coverage. A critical PHP runtime flaw with a fixed release is broadly actionable, though exploitability and government-action claims need primary-source validation.
- PHP - PHP web installations - exploited vulnerability (opens in new tab)
Prior items concern unrelated PAN-OS, Nextcloud, Zimbra, and NetScaler flaws. Active exploitation of a critical PHP vulnerability and advice to take unpatched installations offline create a distinct, urgent operator decision.
Reporting the panel read and judged overstated, or moved to a lower priority, with the claim quoted.
- Judged overstated
The board should not use SafePay’s “at least 600 victims” as a proxy for its exposure.
re: SafePay ransomware - internet-facing systems - ransomware breach
- Judged overstated
A public GitHub repository names CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 and includes a detection directory; that supports public technical availability, but by itself does not establish successful compromise of a particular server.
re: Plex2Shell - Plex Media Server before 1.43.3.10861 - exploited vulnerability
- Verify at lower priority
I assign only low confidence that public evidence proves Russian-state tasking for this specific operation.
re: APT28 - NATO member-state shipbuilder - malware campaign
+1 more set aside today
- Judged overstated
A downloaded but never executed artifact is compromised and must be destroyed, but does not by itself demonstrate host compromise.
re: LiteLLM - LiteLLM 1.107.0 packages and images - supply chain compromise
Behind the desk
How the chair framed itChair postureskeptical
Challenge the feed's ranking by collapsing the PHP duplicates into one response decision, then name the three fresh exposures that change action today.
Framing avoidedgeneric greeting · top-five readout · treating every PHP item as distinct · reopening settled ransomware guidance
Opening, the rounds and the close — who was dispatched, what the chair said at each pivot, and the sealed decision. Tap a phase, tap a seat.
10 voices convened
Chair · running the session and steering the dispatch.
Full panel seated before the first dispatch
The 600-victim SafePay figure is the headline, but active access is the decision point.
Today is busy and operationally compressed: PHP2Shell, Plex2Shell, and ransomware exploitation of GlobalProtect can all move an exposed system from vulnerable to compromised before routine patch cycles catch up.
1.107.0, preserve runtime and secret-access evidence, rebuild from trusted artifacts, and rotate every reachable credential.
review successful VPN sessions; isolate infrastructure when sessions, administrator changes, or downstream access cannot be explained.
The findings on the record and the positions behind them.
Attackers are actively chaining four Plex Media Server vulnerabilities to steal administrator tokens and execute elevated code, with initial honeypot attacks deploying cryptocurrency miners; CISA also added exploited Siemens and SiteGuard flaws to KEV.
Findings on the record
2 critical · 3 high · 5 findings shownPrioritization should be condition-driven: confirmed malicious execution, unexplained successful access, and host-side indicators outrank exposure alone.
LiteLLM 1.107.0 wheels and affected official images reportedly contained malicious payloads, making installation or execution an incident-response trigger rather than a routine update case.
PHP2Shell, Plex2Shell, and GlobalProtect exploitation reports justify emergency remediation and targeted hunting; successful sessions or host-execution evidence determine when containment is required.
SafePay's 600-plus victim figure is cumulative and does not measure an individual organization's impact; the board metric should be Clean Tier-1 Recovery Within RTO.
Reporting supports APT28 linkage and Hookedge delivery through macro-enabled Word documents, but public evidence does not establish Russian-state tasking, broader victim scope, or sabotage intent.
At the table
Hear the full debate →Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Alex Mercer
Threat Hunter
Ultimately adopted an evidence-first hierarchy: confirmed execution or unauthorized access receives containment, while exposure alone receives emergency patching plus a…
On the record
- Exposure alone should not consume the same forensic lane as confirmed execution or unauthorized access.
- An unexplained successful GlobalProtect session is a presumed-compromise trigger because unauthorized access and ransomware chains have been documented.
- PHP2Shell requires containment when exploit activity correlates with execution, payload retrieval, web shells, persistence, or malicious egress.
5 sources cited
Lena Hartmann
Intel Analyst
Supported an immediate but narrow hunt for the reported APT28 Hookedge chain.
On the record
- Hookedge was reportedly delivered through macro-enabled Word documents and used webhook.site for tasking and exfiltration against organizations in two European NATO states.
- APT28 or Swallowtail operator linkage is moderately supported, but public evidence provides only low confidence in Russian-state tasking for this operation.
- Defense-sector hunting should focus on Word-to-script execution, webhook.site communications, credential access, and discovery behavior.
4 sources cited
James Okafor
Defense Architect
Advocated a preservation-first, condition-driven first 30 minutes.
On the record
- Incident sequencing should prioritize execution, persistence, suspicious sessions, and identity evidence rather than treating every exposed system as compromised.
- Hosts that ran LiteLLM 1.107.0 should be isolated, preserved, rebuilt from a known-clean image, and followed by rotation of every reachable credential.
- GlobalProtect appliances with unexplained successful VPN sessions require isolation and investigation of configuration, sessions, administrator changes, identities, and downstream access.
5 sources cited
Pierre Lefevre
Industry Impact
Rejected cumulative victim counts as a proxy for enterprise impact and made proven recoverability the decisive board-level test.
On the record
- SafePay's 600-plus victim figure is cumulative since August 2024 and does not quantify simultaneous downtime or equivalent losses.
- Clean Tier-1 Recovery Within RTO should be reported as a binary board metric.
- A valid recovery proof requires isolated restoration from immutable pre-compromise backups, rebuilt dependencies, reset privileged access, integrity checks, and business-owner signoff.
3 sources cited
5 of the standing orders moved with new evidence since the edition before 2026-10-22 morning; the rest of the board is new this session or carried forward unchanged.
- 01UpdatedIsolate systems that installed or executed LiteLLM 1.107.0, preserve runtime and…
Required operational action changed for this fingerprint; Severity moved to CRITICAL; New evidence URL(s) accompany material change
First tracked 106 editions ago; last material update this edition. - 02UpdatedRemediate PAN-OS GlobalProtect CVE-2026-0257 and review successful VPN sessions; isolate…
Required operational action changed for this fingerprint; New CVE(s): CVE-2026-0257; New evidence URL(s) accompany material change
First tracked 3 editions ago; last material update this edition. — #143 → - 06UpdatedIdentify OVHcloud CLI 0.11.0–0.15.0 installations from the affected release window…
Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked the prior edition; last material update this edition. — #145 → - 07UpdatedHunt European defense, aerospace, shipbuilding, and law-enforcement environments for the…
Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked 86 editions ago; last material update this edition. - 08UpdatedProve clean recovery of every Tier-1 service within its approved RTO using isolated…
Required operational action changed for this fingerprint; Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked the prior edition; last material update this edition. — #145 →
3 actions are new this session — marked New on the board · Back to the board →
Previous edition: CVE-2026-0257 Jumps the Queue for Exposed GlobalProtect Systems →Confidence is high in the response priorities, moderate in campaign scope and state-tasking conclusions, and conditional on local telemetry for compromise determinations.
Confidence is high in the response priorities, moderate in campaign scope and state-tasking conclusions, and conditional on local telemetry for compromise determinations.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
- 18 OCT · MOR · #139For ConnectWise, Disabling One Microsoft 365 App Identity May Not Be Enoughno thread into today's board
- 19 OCT · MOR · #141Unauthorized Entra Access or Role Changes Push ConnectWise Past BeyondTrustno thread into today's board
- 20 OCT · MOR · #142Rank Math 3.0.123 Sites Need Clean Restores, Not a 3.0.124 Updateno thread into today's board
- 20 OCT · AFT · #143Potentially Compromised Fortinet Systems Come Offline; AOMEI Waits1 of today's orders first tracked here · 02
- 21 OCT · MOR · #144eMudhra Distrust Beats Waiting for Confirmed Certificate Abuseno thread into today's board
- 21 OCT · AFT · #145CVE-2026-0257 Jumps the Queue for Exposed GlobalProtect Systems2 of today's orders first tracked here · 0608