Cybersecurity briefing, 2026-04-29

A pre-authentication SQL injection in LiteLLM is being actively exploited, and attackers are going straight for the keys behind every AI gateway it fronts.

• LiteLLM SQLi Exposes Keys Behind AI Gateways
• Supply-Chain Victims Become VECT’s Ransomware Pool
• GitHub Internal Protocol Flaw Exposes Entire Repos
• Medtronic Breach Exposes Corporate Data, Not Products
• Sleeper Extensions Turn Open VSX Into Malware Delivery
• LeRobot Deserialization Flaw Can Take Over Robots and Controllers
• Stolen Data Forums Turn Small Breaches Into Bigger Risk
• Ransomware Rivals Expose Each Other’s Operations
• State Privacy Fines Turn Into Multi-State Enforcement
• macOS Users Become the Weak Link in Fake Updates
• Bluetooth Firmware Flaws Put Bikes and Scooters at Risk
• Marimo Zero-Day Turns AI Demo Hosting Into Malware Delivery

Recent editions

• Tuesday, April 28, 2026: Trusted Data Tool Poisoned, Then Its Container Image Too · 11 stories
• Monday, April 27, 2026: Cisco Firewall Backdoors Survive Patching · 14 stories
• Sunday, April 26, 2026: GopherWhisper Turns Collaboration Tools Into Espionage Channels · 9 stories
• Saturday, April 25, 2026: Cisco Firewall Backdoors Survive Patching · 19 stories
• Friday, April 24, 2026: Cisco Firewall Backdoors Survive Patching · 18 stories
• Thursday, April 23, 2026: iPhone Notification Cache Exposed Deleted Signal Messages · 17 stories
• Wednesday, April 22, 2026: ActiveMQ Brokers Exposed to Active Exploitation at Scale · 18 stories