{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "docker",
    "label": "Docker",
    "isStack": true,
    "url": "https://pwn.watch/t/docker",
    "feed": "https://pwn.watch/t/docker/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "litellm-1-107-0-pypi-compromise",
      "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise",
      "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "LiteLLM (PyPI + official Docker/GHCR images)",
      "tags": [
        "python",
        "pypi",
        "docker",
        "ai",
        "litellm",
        "supply-chain"
      ],
      "cveIds": [
        "MAL-2026-2144"
      ],
      "affectedVersions": [
        "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window"
      ],
      "fixedVersions": [
        "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.",
      "xPost": null
    },
    {
      "slug": "teampcp-trivy-checkmarx-supply-chain",
      "title": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain",
      "json": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts",
      "tags": [
        "github-actions",
        "docker",
        "devtools",
        "github",
        "trivy",
        "checkmarx",
        "vscode",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Trivy v0.69.4; trivy-action before v0.35.0; setup-trivy before v0.2.6; Checkmarx AST v2.3.28; KICS before v2.1.20 (per vendor/CSA guidance)"
      ],
      "fixedVersions": [
        "trivy-action >= v0.35.0",
        "setup-trivy >= v0.2.6",
        "Checkmarx AST/KICS patched releases per Checkmarx updates"
      ],
      "startedAt": "2026-03-01",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Help Net Security",
      "handle": "helpnetsecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1602979161932455937/3RwfWo0d_bigger.jpg",
      "text": "LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - https://t.co/7iolIMAKe8 - @GossiTheDog @RockHudsonRock @cloudsek @wiz_io @AikidoSecurity @SocketSecurity - #LiteLLM #SupplyChainAttack #OpenSource #malware #Cybersecurity #CyberSecurityNews https://t.co/ZLPywonXYC",
      "date": "2026-10-22T13:26:50.000Z",
      "url": "https://x.com/helpnetsecurity/status/2113260794544796098",
      "media": [],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 LiteLLM 1.107.0 compromised in a supply chain attack.\n\nMalicious PyPI packages and Docker images delivered a credential stealer and backdoor.\n\n⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.\n\n🔗 Full story: https://t.co/ANqBuYaGx5",
      "date": "2026-10-21T18:02:10.000Z",
      "url": "https://x.com/TheHackersNews/status/2112967698103894257",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVLE6tcakAATDtC.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Moshe Siman Tov Bustan",
      "handle": "MosheTov",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1998067906706345984/SwYIhsPZ_bigger.jpg",
      "text": "❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware!\n\nTLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP.\n\nThe malware combines two threats in one https://t.co/WjpMeKcVgg",
      "date": "2026-10-21T15:46:21.000Z",
      "url": "https://x.com/MosheTov/status/2112933514962247891",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKl1H6XQAAPSJw.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Cyber Security News",
      "handle": "The_Cyber_News",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1174924326807592960/aJMuU6Ms_bigger.jpg",
      "text": "‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release\n\nDetails: https://t.co/8rlH8xijjj\n\nLiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed https://t.co/caDoffOmFx",
      "date": "2026-10-21T15:21:29.000Z",
      "url": "https://x.com/The_Cyber_News/status/2112927256956088756",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKf10bawAAfyb6.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Socket",
      "handle": "SocketSecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2057141188591824896/aKdKFNEE_bigger.jpg",
      "text": "🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.\n\nVersion 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools. https://t.co/4Mbt1LbhLu",
      "date": "2026-10-21T14:03:54.000Z",
      "url": "https://x.com/SocketSecurity/status/2112907732877775016",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKNz_RWYAAoI1O.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    }
  ],
  "changes": [
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious 1.107.0 wheels appear on PyPI.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.",
      "body": null,
      "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T13:23Z",
      "title": "PyPI quarantines/pulls the package (~2h window).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T14:20Z",
      "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T16:20Z",
      "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T20:30Z",
      "title": "LiteLLM posts containment update; investigation ongoing.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Trivy compromise disclosed; Microsoft guidance published.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    }
  ]
}