Scrubbing tokens from source code is not enough, as shown by the publishing of a Python Software Foundation access token with administrator privileges to a container image on Docker Hub. A personal ...
The Python Software Foundation team has invalidated all PyPI tokens stolen in the GhostAction supply chain attack in early September, confirming that the threat actors didn't abuse them to publish ...
We clarify the three major obstacles that frequently occur in Dynamic Tool Execution for autonomous AI agents—"infinite loops ...
I found OAuth credential exposure flaws in the official MCP Python and TypeScript SDKs. Why patching CVE-2026-115563 and CVE-2026-104850 may not be enough.
LiteLLM says hackers used GitHub tokens from its own logs to publish a poisoned release. Wiz cited 49,000 downloads and saw stolen AWS keys tested.
Attackers compromised LiteLLM's release pipeline to ship a credential stealer and backdoor, then tested stolen AWS credentials.
An unrevoked LiteLLM master key enabled GitHub token theft and a malicious PyPI release that steals credentials and installs a backdoor.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results