# LiteLLM Security Breach Exposed Over 2,100 Organizations Malicious LiteLLM releases stole sensitive data from affected systems. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-12 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/43cb1da7-d089-4201-9328-29600b08e15d ## Scale of the Security Breach In March, malicious LiteLLM versions remained on PyPI for 40 minutes. These releases contained code capable of stealing cloud keys, SSH keys, Kubernetes tokens, and database passwords. CloudSEK's data suggests over 2,500 organizations may have been exposed. Major companies like NVIDIA, Cisco, and Siemens were among the potentially affected entities. ## Technical Details of the Attack Attackers injected malicious code into LiteLLM versions 1.82.7 and 1.82.8. This code automatically executed when Python processes started, harvesting environment variables and credentials. Stolen data was encrypted and sent to an attacker-controlled domain. The LiteLLM project confirmed these versions were removed from PyPI but advised treating all installations that day as suspicious. ## Affected Organizations and Data CloudSEK revealed approximately 434,000 files were captured during the attack. These files contained identity signals from organizations' CI/CD environments. High-confidence matches verify which systems the files originated from. However, it remains unknown whether stolen credentials were actually used. Organizations were advised to rotate their credentials immediately. ## Background of the Campaign The LiteLLM incident is part of a broader supply chain attack. Aqua Security's Trivy scanner was also compromised in this campaign. In March, attackers force-pushed malicious commits to 76 Trivy version tags. Google tracks this group as UNC6780. The breach, cataloged as CVE-2026-33634, was added to CISA's Known Exploited Vulnerabilities list. ## Attack Methodology Different accounts exist regarding how malicious LiteLLM releases reached PyPI. CloudSEK claims a poisoned build process published them, while LiteLLM's official report points to direct PyPI uploads bypassing CI/CD. Unit 42 suggests attackers targeted PyPI publishing tokens. CloudSEK maintains these represent different stages of the same attack chain rather than conflicting explanations. ## Data Validation Process CloudSEK verifies file ownership through two independent methods. The first uses CI identity variables, while the second re-derives ownership from log files. Reports are withheld when methods disagree. Final determinations adopt the lower confidence level of the two. This process aims to minimize false positives in attribution. ## Organizational Responses It remains unclear whether affected organizations received pre-disclosure notifications. CloudSEK declined to comment on outreach efforts. Some security firms like Checkmarx warn about potential long-term impacts of such breaches, emphasizing the need for proactive security measures beyond immediate credential rotation. ## Recommended Security Measures The FBI's July advisory warned that stolen credentials could be weaponized long after initial compromise. Organizations should rotate CI/CD secrets, publishing tokens, and cloud credentials accessible during exposure windows. Transitioning from long-lived to temporary tokens is strongly recommended. These measures prove critical in preventing similar supply chain attacks. ## Sources covering this story - https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._