While you were patching PHP, LiteLLM went and got compromised again.
https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919
#ThreatIntel #ThreatIntelligence #IFIN
IFIN - The Independent Federated Intelligence Network
npub1qm…nh363
2026-10-21 20:56:46 UTC
Author Public Key
npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363Seen on
wss://relay.momostr.pinkPublished at
2026-10-21 20:56:46 UTCEvent JSON
{
"id": "51bc00f54454fb8a4cf0824ccc2d6729e35e6efe7bf748be79e09e762857c243",
"pubkey": "06eab22dbb1f669b7c8ec534a0f9011c3cf56c56c57900334b3cbb16c6afcb03",
"created_at": 1792616206,
"kind": 1,
"tags": [
[
"t",
"threatintelligence"
],
[
"t",
"ifin"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/@ifin/117480895740969628",
"web"
],
[
"proxy",
"https://infosec.exchange/ap/users/115741367687413652/statuses/117480895740969628",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/115741367687413652/statuses/117480895740969628",
"pink.momostr"
],
[
"-"
]
],
"content": "While you were patching PHP, LiteLLM went and got compromised again.\n\nhttps://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919\n\n#ThreatIntel #ThreatIntelligence #IFIN",
"sig": "d94df33b806a79f8b8047745c93053dec5be1797402b56afcaf717b5b100e0a56aafb6d9c3d485156200e4faa2c5f861606d2d995f21f72508d1c6a58ccd3c0b"
}