Skip to content
Start with Identity
Join free
This Week in Identity · Issue 19 · 2026-10-27 · Covers 2026-10-21 to 2026-10-27

This Week in Identity, Issue 19

Issue 19 of This Week in Identity. Most of this week's stories are about credentials nobody was watching: a key that was deleted but not revoked, app identities customers had consented to years ago, tokens sitting in infostealer logs. The attacker did not need a new exploit when an old credential still worked.

In brief

  • LiteLLM's malicious 1.107.0 release on October 21 traces to an administrative key committed to a public repository on May 27 and deleted three hours later but never revoked; on October 10 it returned a GitHub organization owner's unscoped CLI OAuth token, which led to stolen maintainer tokens and the release.
  • Microsoft attributed the ConnectWise cloud app compromise to Storm-0940, which used the identities of ConnectWise cloud applications, with permissions customers had already consented to, to attempt sign-ins to more than 2,250 Microsoft Entra ID tenants.
  • Arctic Wolf Labs analyzed more than 400 incidents in which attackers flooded an inbox with sign-up emails, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist, in some cases reaching payload execution in under 15 minutes.

The big story

A deleted key that was never revoked became LiteLLM's poisoned release. On October 21 LiteLLM disclosed that attackers had published litellm==1.107.0, an AI gateway package carrying a credential stealer and a backdoor. The PyPI wheels were live from 11:39 to 13:23 UTC and the compromised Docker Hub tags from 11:46 to 14:20 UTC, built from a lookalike repository, so the official source tag is clean. The Hacker News, citing Wiz, reported that the attacker later tested AWS instance role credentials from compromised CI runners and Kubernetes nodes and queried Bedrock. Two days later LiteLLM published the chain: on May 27 an opencode.json file holding an administrative key for its internal Agent Platform was committed to a public repository, deleted about three hours later, and left valid. In LiteLLM's words, "nobody followed through on revoking the administrative key." On October 10 the attacker used it, an agent-listing API call returned the GitHub CLI OAuth token of one of two organization owners, and within an hour workflows were posting CI secrets, including two more maintainers' tokens, to an outside endpoint. On October 21 those tokens overrode branch protection, approved the production gate and shipped the release.

Why it matters: the control that failed is revocation. Deleting a secret from a repository hides it from the next reader, not from anyone who already copied it, and one forgotten key chained into three human-linked tokens because the agent platform stored an owner's personal CLI token instead of a scoped credential. An AI gateway also holds every provider key an organization uses, so a poisoned gateway is a bulk theft of non-human identities. Treat any secret that reached a public commit as compromised and rotate it the same day, give automation a GitHub App or a fine-grained token instead of an owner's token, and require release approvals from identities that cannot also trigger the build. If 1.107.0 ran anywhere, follow LiteLLM's cleanup steps before running pip, pin to 1.106.2, and rotate the instance role and every key the proxy held. Sources: Poisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker and LiteLLM traces its poisoned release to an admin key leaked in May.

Patch this week

  • GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 (October 21) fix CVE-2026-15723 (CVSS 8.2), an LDAP account takeover when OmniAuth SAML and LDAP auto-linking are both enabled, and CVE-2026-112212 (CVSS 7.5), poisoning of a shared cache's OIDC discovery document. GitLab reported no exploitation. Post.
  • Okta Access Gateway before 2026.10.2: CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the gateway's service account. Upgrade to 2026.10.2 or later; the earlier 2026.9.1 update does not cover it. Post.
  • Microsoft Authenticator for Android: CVE-2026-80097 (CVSS 8.6, "AuthMask") let a zero-permission app pose as Teams and receive Microsoft Graph tokens for the work account. Fixed in 6.2606.4246. Post.
  • HPE ArubaOS: three authentication bypasses (CVE-2026-79844 and CVE-2026-79845 in AOS-10, CVE-2026-79850 in AOS-8) among eight maximum-severity flaws in HPE's October 22 advisory. HPE knew of no public exploit code. Until patched, keep management interfaces on a dedicated segment. Post.
  • Tailscale 1.104.4 fixes TS-2026-014, which let an SSH peer allowed to forward ports reach root-only sockets such as Docker or the tailscaled local API, and TS-2026-016 in Serve. Post.

The pattern

Machine credentials outlive the reason they were issued. LiteLLM's key was deleted in May and still worked in October. Storm-0940 did not need to phish anyone at the 2,250 tenants it reached; it used ConnectWise app identities those tenants had consented to, then added new app credentials for persistence. Wiz's Gheist campaign ran on GitHub tokens recovered from infostealer logs and earlier supply-chain leaks, and Railway's attacker went looking for AI provider keys in decrypted environment variables. The technique pages for this class are secrets in repositories and CI and static API key abuse. The common fix is a lifecycle, not a scanner: every credential gets an owner, an expiry and a revocation path, and consented apps get reviewed like people do.

What else happened

  • Storm-0940 and ConnectWise. Before switching to app identities, the group password-sprayed 327 accounts at eight organizations from October 10 to 14 with no successful sign-in. Microsoft saw one management app assign itself Global Administrator and bulk secret reads from Azure Key Vault. Search sign-in logs by application ID, not display name. Post.
  • Access broker k0t got into FortiWeb, PAN-OS GlobalProtect and FortiGate edges, decrypted FortiGate configuration files with the default-key weakness CVE-2019-6693, and exposed more than 70,000 credentials tied to network devices and LDAP dumps, according to Group-IB and NyxLab. Rotate every credential stored in an edge device's configuration after a compromise, not just the admin password. Post.
  • Huntress tracked one actor replaying stolen Microsoft 365 sessions into 79 organizations, from AiTM relays and device-code phishing, then registering rogue Entra devices and swapping MFA methods within three hours to survive password resets. A password reset alone does not end a token replay. Post.
  • Railway says an attacker decrypted environment variables for at most 1.85% of workspaces, about 100,000, and searched for AI provider keys. It revoked all Railway API tokens; customers should rotate whatever their variables held. Post.
  • Gheist planted more than 13,500 ci-sync- branches from 850-plus compromised GitHub accounts, printing every reachable secret into Actions logs in base32 so log masking missed it, then deleting the runs. Look for sync-check.yml workflows and deleted runs in your audit log. Post.
  • Fake IT help desk on Teams. Arctic Wolf says 30 to 40 percent of the 400-plus cases came from free onmicrosoft.com tenants. Restrict Teams external access to known domains and teach staff that IT never asks for a Quick Assist code over chat; this is help desk social engineering moved into chat. Post.
  • Infisical raised a $40 million Series B at a $600 million valuation and says it will invest in Agent Vault, a broker that lets AI agents make authenticated requests without holding the underlying credentials. Post.

New from Start with Identity

Free to read and share. Independent and community-driven, no sponsorship. Subscribe to get the next issue.