Cybersecurity briefing, 2026-04-29

A pre-authentication SQL injection in LiteLLM is being actively exploited, and attackers are going straight for the keys behind every AI gateway it fronts.

• LiteLLM SQLi exposes keys behind AI gateways
• Supply-chain victims become VECT’s ransomware pool
• GitHub internal protocol flaw exposes entire repos
• Medtronic breach exposes corporate data, not products
• Sleeper extensions turn Open VSX into malware delivery
• LeRobot deserialization flaw can take over robots and controllers
• Stolen data forums turn small breaches into bigger risk
• Ransomware rivals expose each other’s operations
• State privacy fines turn into multi-state enforcement
• macOS users become the weak link in fake updates
• Bluetooth firmware flaws put bikes and scooters at risk
• Marimo zero-day turns AI demo hosting into malware delivery

Recent editions

• Tuesday, April 28, 2026: Trusted data tool poisoned, then its container image too · 11 stories
• Monday, April 27, 2026: Cisco firewall backdoors survive patching · 14 stories
• Sunday, April 26, 2026: GopherWhisper turns collaboration tools into espionage channels · 9 stories
• Saturday, April 25, 2026: Cisco firewall backdoors survive patching · 19 stories
• Friday, April 24, 2026: iPhone notification cache exposed deleted signal messages · 18 stories
• Thursday, April 23, 2026: npm worm turns developer tokens into propagation fuel · 17 stories
• Wednesday, April 22, 2026: ActiveMQ brokers exposed to active exploitation at scale · 18 stories