Critical LiteLLM RCE Vulnerability Actively Exploited in the Wild Threat actors are actively exploiting a critical unauthenticated remote code execution (RCE) vulnerability in LiteLLM, a widely used open-source AI proxy gateway, by chaining two CVEs to bypass authentication and execute arbitrary commands on vulnerable systems. Researchers at Horizon3.ai confirmed the exploitation path on June 1, 2026, revealing that CVE-2026-42271 a command injection flaw in LiteLLM’s MCP server test endpoints can be combined with CVE-2026-48710, a Starlette "BadHost" Host Header validation bypass, to achieve unauthenticated RCE. The combined attack chain carries a CVSS score of 10.0 (Critical). ### Exploitation Details CVE-2026-42271 targets two LiteLLM MCP server endpoints: - `POST /mcp-rest/test/connection` - `POST /mcp-rest/test/tools/list` These endpoints allow attackers to supply malicious commands, arguments, and environment variables, which are then executed as subprocesses on the host. Initially, exploitation required a valid proxy API key, limiting its severity. However, CVE-2026-48710 affecting Starlette versions 1.0.0 and earlier enables attackers to manipulate Host header values, bypassing authentication entirely. When both vulnerabilities are present, threat actors can gain unauthenticated RCE on vulnerable LiteLLM deployments. ### Impact of Successful Exploitation A compromised LiteLLM instance grants attackers: - Arbitrary OS command execution on the host - Access to model provider credentials and API keys (e.g., OpenAI, Anthropic, Azure OpenAI) - Theft of stored secrets within the proxy - Lateral movement into connected AI infrastructure - Compromise of downstream systems integrated with the gateway Given LiteLLM’s role in enterprise AI pipelines, a breach could expose an organization’s entire AI operations layer. ### Affected Versions & Mitigation - Vulnerable: LiteLLM 1.74.2–1.83.6 + Starlette 1.0.0 or earlier - Patch: LiteLLM 1.83.7 (released May 8, 2026) introduces authorization controls and updates Starlette dependencies. Starlette should be upgraded to 1.0.1 or later. - Interim Mitigations: - Block external access to `/mcp-rest/test/connection` and `/mcp-rest/test/tools/list` - Restrict network access to trusted segments - Rotate all stored credentials and API keys - Monitor logs for unusual Host header values and unexpected subprocess execution Active exploitation makes this a high-priority patch for organizations running self-hosted LiteLLM instances.

Critical Trivy Scanner Vulnerability Added to CISA’s Exploited Flaws Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-33634, a severe vulnerability in Aquasecurity’s Trivy scanner, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, classified under CWE-506 (embedded malicious code), allows threat actors to compromise CI/CD pipelines by exploiting the security tool itself. The vulnerability stems from malicious code embedded in Trivy’s architecture, turning a trusted scanning utility into a vector for unauthorized access. If exploited, attackers can extract authentication tokens, SSH keys, cloud credentials, and database passwords from memory during scans. Since Trivy requires elevated permissions for deep container and infrastructure-as-code (IaC) analysis, successful exploitation grants full control over the development environment. CI/CD pipelines are prime targets for supply chain attacks, as compromised environments enable attackers to distribute malicious updates directly to end users, bypassing traditional security measures. CISA has set a remediation deadline of April 9, 2026, for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 22-01, though private organizations are urged to act with equal urgency. Aquasecurity has released patches, but if unavailable, CISA advises discontinuing Trivy’s use to mitigate risk. Beyond patching, security teams must rotate all exposed credentials including cloud tokens, SSH keys, and database passwords and audit cloud environments for suspicious activity, as the flaw’s memory exposure may have already led to breaches.

Enterprise AI Agents Pose Unprecedented Security Risks, Report Finds In late 2024, enterprise AI evolved from chatbots into autonomous agents systems capable of acting, planning, and executing tasks without human intervention. These agents now interact with file systems, APIs, databases, and email inboxes, creating a new and rapidly expanding threat surface that traditional security tools were not designed to address. According to NeuralTrust’s *State of Agentic AI Security 2026 report, 48% of AI agents in enterprise production environments operate without meaningful security controls*, handling real data and executing critical functions. The report highlights alarming trends: - 88% of enterprises with deployed agents have experienced at least one security incident (Shattered.0.io, 2026). - 34% of enterprise agents have been affected by prompt injection attacks, where adversarial content manipulates agent behavior. - The average cost of an AI agent-related data breach reached $4.7 million (IBM, 2025). - Between December 2025 and April 2026, AI agent deployments doubled in enterprise environments, while monitoring coverage remained stagnant at 52%, widening the security gap. ### The Core Problem: Runtime Threats Beyond Code Review Traditional application security assumes that reviewed and tested code determines system behavior. However, AI agents operate dynamically, making decisions at runtime based on external inputs documents, emails, or API responses that can be manipulated. As Victor Garcia, CTO of NeuralTrust, notes: "You can audit the code, red-team the system prompt, and restrict tool permissions, but an agent can still be exploited by a malicious document it retrieves mid-task." Key runtime threats include: - Prompt injection & indirect attacks – Malicious payloads embedded in documents or API responses redirect agent behavior, evading static analysis. - Tool & permission abuse – A compromised agent with access to email, databases, or file storage becomes a trusted insider threat, granting attackers broad access. - Memory & context poisoning – Agents that retain memory across sessions can be persistently corrupted, affecting future operations undetected. - Multi-agent trust propagation – A single compromised sub-agent in an orchestrated network can cascade attacks, inheriting elevated permissions. ### The Shadow Agent Challenge Many enterprises lack visibility into their own AI agent fleets. Deloitte’s 2026 *State of AI in the Enterprise found that 80% of organizations lack mature governance for AI agents, while Gartner’s 2026 survey revealed that 38% of large enterprises operate over 100 agents* most of which security teams cannot reliably track. Unmonitored "prototype" agents, deployed informally, often remain in production, creating blind spots. ### A New Security Framework for Agentic AI NeuralTrust’s whitepaper, Agentic AI Security at Runtime, proposes a behavioral-based security model built on four pillars: 1. Observe – Real-time monitoring of agent actions. 2. Enforce – Semantic-level controls to restrict unintended behavior. 3. Detect – Identifying runtime threats, including indirect prompt injections and memory corruption. 4. Respond – Automated mitigation to contain compromised agents. The framework provides practical guidance for open-source agent frameworks like LangChain, CrewAI, AutoGen, and Semantic Kernel, which were designed for speed rather than security. Enterprises adopting these measures can secure agentic AI without slowing adoption, enabling safer scaling of autonomous systems.

The cyberattack on RIBridges, Rhode Island’s online public benefits system managed by Deloitte, compromised the personal data of approximately 650,000 Rhode Islanders. The breach, executed by the cybercriminal group Brain Cipher, exposed sensitive information such as names, bank accounts, and Social Security numbers, some of which was later uploaded to the dark web. Affected individuals included users of public benefit programs like Medicaid, SNAP (Supplemental Nutrition Assistance Program), and HealthSource RI (the state’s health insurance marketplace). The incident led to multiple class-action lawsuits, with plaintiffs alleging Deloitte’s failure to secure, encrypt, or adequately destroy personal data, resulting in financial losses for victims. Deloitte settled with the state for $5 million to cover breach-related expenses and is under ongoing civil investigation by the Rhode Island Attorney General. The breach severely damaged trust in the system, prompting the state to explore alternative vendors for modernization before Deloitte’s contract expires in 2026.

A threat actor using the alias '303' allegedly breached Deloitte's systems and leaked sensitive internal data on a dark web forum. The breach involves GitHub credentials and source code from internal project repositories belonging to Deloitte’s U.S. consulting division. The leaked data includes GitHub credentials that could potentially grant unauthorized access to Deloitte’s internal development infrastructure, as well as source code from proprietary projects. This incident adds to Deloitte’s ongoing cybersecurity challenges, with multiple breach allegations in recent months.

Rhode Island Secures $12 Million Settlement from Deloitte Over 2024 RIBridges Data Breach The Rhode Island Department of Administration has finalized a $7 million settlement with Deloitte Consulting LLP, bringing the state’s total recovery from the 2024 RIBridges data breach to $12 million. The agreement, signed by Deloitte Principal Lindsay Musser Hough on April 15 and Acting Department Director Thomas Verdi on April 16, requires payment within 30 days unless an extended deadline is granted. Deloitte, the vendor behind RIBridges a state platform handling Medicaid, food stamps, and health insurance applications had already provided $6 million in additional system enhancements and support at no cost to Rhode Island. The breach, discovered in December 2024, stemmed from a cyberattack by the group Brain Cipher, which infiltrated the system’s backend in July 2024 using stolen credentials from a Deloitte representative. The threat actors remained undetected for months, exfiltrating data from 28 of RIBridges’ 338 backend environments before triggering alerts in late November. Governor Dan McKee first publicly disclosed the breach on December 13, 2024, after Deloitte confirmed the incident following a dark web post by Brain Cipher. The attack compromised the personal information of an estimated 644,401 individuals, including applicants and beneficiaries of state benefits. A third-party forensic report by CrowdStrike later revealed that the last malicious activity occurred on Thanksgiving Day 2024, though Deloitte did not notify the state until December 5. In February 2025, the state received an initial $5 million from Deloitte to cover breach-related expenses. The latest settlement resolves all legal disputes between the parties, with both agreeing to refrain from further litigation, public disparagement, or encouraging third-party lawsuits. The agreement also includes a non-disparagement clause, requiring coordinated public statements. Separately, Deloitte settled a class-action lawsuit in October 2025, which included Rhode Island as a "released party," shielding the state from additional claims. Over 47,000 class members filed claims for compensation, with most receiving around $100 and others eligible for higher reimbursements with documented losses. While the forensic report attributed the breach to Deloitte’s failure to detect the intrusion, the settlement explicitly states that neither party admits liability. The state’s legal recourse appears exhausted, though Governor McKee previously stated that Deloitte bore responsibility for oversight lapses.

On November 8, 2022, the Vermont Office of the Attorney General reported that Deloitte Tax LLP experienced an inadvertent disclosure of personal information related to shareholders of APC on September 30, 2022. The notification does not specify the number of affected individuals but mentions that certain personal information was disclosed without evidence of improper use.

Deloitte, an accounting business, revealed that a sophisticated breach hijacked its global email server. The Guardian initially reported the problem, which claims that hackers may have obtained usernames, passwords, and personal information of high-profile clients of prominent accounting firms in addition to emails belonging to corporate customers. Hackers have access to IP addresses, company architectural blueprints, and health data in addition to emails. Although Deloitte attempted to downplay the occurrence, it was established that it was immediately reported to government authorities and the impacted clients. In my opinion, incidents of this nature are always significant.