tag: Python · 7 items
- Engineer — Act: Confirmed supply-chain compromise of a widely-used Python LLM-integration package (LiteLLM 1.107.0). Audit your dependency tree for that version, inspect CI/CD build logs for exposure since May 27, 2026, and rotate any credentials or tokens accessible to LiteLLM in your pipelines.
- SOC/IR — Act: Active supply-chain compromise with a measurable exposure window starting May 27, 2026. Sweep deployed environments for LiteLLM 1.107.0, hunt for anomalous outbound connections or credential-access events attributable to Python runtime activity during the exposure period, and check GitHub token usage logs for unexpected access.
- Leader — Act: A popular AI/LLM integration package was weaponized via a leaked master key — a systemic supply-chain event. Confirm whether LiteLLM is in your software inventory or vendor stack, assess exposure across the May 27–disclosure window, and brief leadership if any internal pipelines may have run the compromised version.
- Engineer — Act: LiteLLM is widely used in AI/ML workloads; a confirmed supply-chain compromise with credential theft and remote code loading is an immediate Act trigger. Audit all dependency trees and container images for version 1.107.0, rotate any API keys or cloud credentials accessible from affected environments, and review the Microsoft post’s IOCs against build/runtime logs.
- SOC/IR — Act: Microsoft published TTPs and detections for this compromise; hunt for abuse of Python startup hooks (usercustomize/sitecustomize) across Python-capable hosts since the 1.107.0 release window, and sweep for the remote code-loading IOCs detailed in the post.
- Leader — Act: A confirmed supply-chain compromise of a widely-adopted AI/LLM proxy library with credential theft impact; direct engineering this week to assess whether LiteLLM 1.107.0 is in use and report on any exposed credentials, and be prepared to brief leadership on scope if exposure is confirmed.
- Engineer — Act: Pillow is ubiquitous in Python web apps that accept image uploads; a public PoC exists on GitHub making exploitation straightforward. Patch Pillow to the fixed release immediately, or disable EPS/Ghostscript support via environment variable if a patch window is unavailable.
- SOC/IR — Plan: No active exploitation yet (EPSS 0.00, not in KEV), but the public PoC lowers the bar. Build or tune a detection for web-tier processes (Python/Gunicorn) spawning Ghostscript, which should not normally invoke child shells — flag any unexpected child process tree from gs/gswin.
- Leader — Skip
- Signals: CVE-2026-112900 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Learn: If you’re running AI agents with tool-call capabilities, this CLI offers a lightweight way to audit transcripts for scope overreach — worth evaluating as a pipeline integrity check, but no immediate patching or configuration action required.
- SOC/IR — Skip
- Leader — Learn: As AI agents proliferate in enterprise environments, tooling that enforces scope boundaries and provides audit trails is a governance signal worth noting when developing AI usage policies.
- Engineer — Learn: Highlights how Unicode case-folding edge cases in str.lower() can silently break security-sensitive comparisons (e.g., allowlist checks, hostname validation). No active exploitation or CVE, but worth auditing any Python code that uses case normalization for access control or identity checks.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Teams using Marimo in AI/ML workflows should update to the patched version; the attack surface (opening a crafted notebook in edit mode triggers a local subprocess via MCP) is a real supply-chain-style risk, but no KEV listing, public PoC, or active exploitation signals mean this isn’t an emergency patch.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Starlette is widely used in Python ASGI applications; a host-header auth bypass with a public GitHub PoC is a real exposure for any service relying on host-based access control. EPSS is 0.01 and no KEV listing, so immediate emergency patching isn’t warranted, but you should upgrade Starlette to the patched version within your next patch window and audit any middleware that trusts the Host header for routing or authorization decisions.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-48710 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub