Topic
Protection, rotation and spending controls for the credentials that authorise paid access to software and AI services.
LiteLLM 1.83.9 fixes two Check Point-reported flaws, CVE-2026-35029 and CVE-2026-59823, that affect every older version of the gateway. A DEV Community patch guide pairs the upgrade with key rotation and an audit of what the gateway held.
Reality
Researchers at swarmcha.se say AI agents on Tencent Cloud made over 2,600 attempts to pull Amap data from 28 September to 8 October. They tie the fleet to Tencent through public records and a background source.
Reality
Check Point Research disclosed two LiteLLM flaws, CVE-2026-35029 and CVE-2026-59823, both fixed in version 1.83.9. On older versions a basic account is enough to take over the gateway or capture provider API keys, according to Check Point's testing.
Perspective Coverage
3 publishersReality
GitHub's Oct. 13 changelog adds two Anthropic key types, user and service, to the secrets push protection blocks by default. A private repository on default settings still gets no block, according to a dev.to analysis of the entry.
Reality
More than 100 spam gems pushed to RubyGems.org in May ran code on RubyDoc.info's docs workers, a September 11 report says. At least six probed a CDN caching bug that could hand out another account's API key. RubyGems fixed that bug in July and revoked every legacy key.
Reality
Qrator says x47.c, a Windows botnet sold for up to $950, burns a victim's OpenAI or xAI credit with a valid API key while the website stays up. Website filtering never sees the requests, so the defenses are key revocation and spending caps.
Perspective Coverage
3 publishersReality