TechPulse USA

  By TechPulse USA Staff — 25 October 2026 Photo: File photo of server racks at the NERSC data centre. This is not a photograph of LiteLLM or its offices. Credit: NERSC, via Wikimedia Commons, CC0 public domain dedication. Here is the nightmare version of a software update. You run one routine install, from the official registry, of a tool you already trust — and the update itself is the attacker. That is what happened to users of LiteLLM on Wednesday, 21 October 2026, when version 1.107.0 of the popular open-source AI gateway reached PyPI and Docker carrying a credential stealer and a remote-access backdoor. The poisoned release did not last long. It did not need to. In roughly two hours on PyPI it was downloaded about 49,000 times, according to ClickPy data cited by Wiz Research. And because LiteLLM sits between applications and the AI providers they pay for, the machine it landed on was often exactly the machine holding the keys worth stealing. LiteLLM, built by BerriAI, l...

Update, Oct. 22: the catch-22 is partially resolving Builds returned for Enterprise customers at 03:32 UTC on Oct. 22, according to status-page timelines read by Safeguard.sh and Claroc.io. At 04:17 UTC Railway invalidated ALL Railway API tokens, meaning every Public API integration needs a new token. Redeploys were fixed for Enterprise at 04:52 UTC, deployments progressed slowly through stages at 05:20 UTC, and builds returned for Pro at 06:29 UTC. Free, Trial and Hobby tiers were still pending at last check, and the main incident was still open. The catch-22 is partially resolving: paying tiers can now deploy, which is also when the token invalidation forces every Public API integration to re-token. By Daniel Rao · October 22, 2026 Read Railway's October 21 security disclosure twice, and the contradiction jumps off the page. In one breath, the cloud platform told every customer to immediately roll their API keys, database passwords and private registry credentials — because ...

GhostAction Hijacked 1,900 GitHub Accounts and Tried to Steal 3,174 Secrets By TechPulse USA Newsroom — San Francisco | 15 October 2026 Photo: A server hall — illustrative. GhostAction's targets were the cloud credentials, registry tokens and AI API keys stored in developer build pipelines. (Florian Hirzinger / Wikimedia Commons, CC BY-SA 3.0) The most dangerous line of code pushed last week wasn't written by a developer at all. It was committed by hijacked developer accounts, under commit messages like "Add Github Actions Security workflow," and it turned some of the most trusted automation on the internet into a vacuum cleaner for secrets. Security firm GitGuardian reports that between October 8 and 12, the credential-theft campaign it calls GhostAction accelerated violently: more than 30,000 repositories across 3,000 users and organizations were targeted, after attackers compromised the GitHub accounts of about 1,900 users. "This resulted from compromisi...