https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://github.com/advisories/GHSA-5xjx-3w67-w9x9b8daa8711c1dd7cfFri, 30 Oct 2026 20:24:24 +0000Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://git — What to do: Upgrade pypa/gh-action-pypi-publish to 1.14.3 or later. [confirmed · GitHub Advisory Database]ci-cdvulnshttps://www.wiz.io/blog/github-actions-security-pwn-request-reckoningf10a91fc0c0db1e1Mon, 26 Oct 2026 13:24:12 +0000GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it. [confirmed · Wiz]ci-cdhttps://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html137532b55ad09e56Sat, 24 Oct 2026 16:33:33 +0530LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed t [reported · The Hacker News]pypici-cdhttps://www.stepsecurity.io/blog/emudhra-emsign-ca-compromise-python-pip-ci-cd-update2762aabcf0cba475Thu, 22 Oct 2026 19:49:42 +0000Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual environments, and CI/CD images. [confirmed · StepSecurity]pypici-cdhttps://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/5a6bf9a2d68f29c8Thu, 22 Oct 2026 15:12:51 -0400Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...] [reported · BleepingComputer]pypici-cdhttps://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html1d16a3061e0901b8Thu, 22 Oct 2026 13:58:48 +0530LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 [reported · The Hacker News]pypici-cdhttps://securitylabs.datadoghq.com/articles/introducing-pathrunner-aws-privilege-escalation-framework/b51d9e02a286801aTue, 20 Oct 2026 00:00:00 +0000Introducing pathrunner, a modular, cloud-native offensive security framework that automates the exploitation of AWS IAM privilege escalation paths. [confirmed · Datadog Security Labs]ci-cdhttps://www.wiz.io/blog/detect-supply-chain-zero-days-at-publicationeb72a852c9af5ecbMon, 19 Oct 2026 14:39:29 +0000When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a [confirmed · Wiz]ci-cdvulnshttps://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks16e2569f0813fc7fMon, 19 Oct 2026 11:26:53 +0000Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them. [confirmed · Wiz]ci-cd