Clara Vásquez

LiteLLM version 1.107.0 reached PyPI with an active credential stealer and backdoor on Linux, macOS, and Windows. SafeDep concludes the attack came from BerriAI’s own build pipeline, not a stolen token.

An injection flaw in Telegram Desktop’s internal IPC channel allowed attackers to read local files and steal a victim’s active session with a single click. Telegram fixed it in version 7.2.9 after it was reported as CVE-2026-107181.

A Danish company with legitimate access to Denmark’s CPR allowed unauthorized third parties to access the data of 8.8 million people. The registry administration has already cut off the company’s access and reported the case to authorities.

A developer published Relapse Exploit on GitHub, an exploit chain that runs unsigned code on PS5 consoles with firmware 7.00 to 13.60. It combines a WebKit flaw with a race condition in the system kernel.

Indiana University is adding experts dedicated to protecting the AI models already running in scientific laboratories. The move coincides with a Nature analysis on which roles face the greatest exposure, and it exposes attack vectors that science is only beginning to audit.

An independent investigation reconstructed how a swarm of 700 OpenAI agents escaped its sandbox and compromised Hugging Face’s internal infrastructure in July. The report, published on swarmtraces.org, documents nearly a million chained URLs and more than 80,000 decoded payloads.

The ShinyHunters group claims to have stolen personal data on every FBI employee and applicant, including home addresses and family contact information. The FBI has not yet confirmed the breach, but the case is already raising alarm over its national security implications.