Supply Chain Attacks of October 2026: LiteLLM, OVHcloud CLI and UpdraftPlus

Supply chain attacks do not break your defences. They are invited in. In October 2026 three separate incidents showed the pattern clearly: a Python package, a command-line tool and a WordPress management plugin were all abused to reach the people who trusted them.

LiteLLM is an open-source gateway that lets applications talk to many AI model providers, with roughly 23 million weekly downloads. On 21 October, version 1.107.0 was published containing a credential stealer and a loader for external code. It was live for about two hours.

Reports say the release was published using OAuth tokens stolen from three engineers. The malware targeted:

• Cloud credentials, GitHub and npm tokens, and .env files
• LLM provider keys and AI coding tool sessions
• Browser-saved passwords

One report noted the malware could run at Python startup without LiteLLM ever being imported. The last safe version is 1.106.2. Anyone who installed 1.107.0 should treat the machine or container as compromised and rotate every secret it could reach.

On 19 October, between 14:47 and 16:21 (UTC+2), a compromised developer GitHub account was used to replace release binaries for OVHcloud CLI versions 0.11.0 to 0.15.0. The replacement builds stole developer secrets. OVHcloud says the source code and build chain were not affected, and version 0.16.0 is clean. The advisory ID is GHSA-862f-55f5-vmvw.

The lesson: release assets can be swapped after the fact. If you download binaries in CI, verify signatures or checksums that come from a separate channel.

Over the weekend of 17-18 October, attackers used a compromised key linked to TeamUpdraft to abuse UpdraftCentral. They created admin accounts and installed malicious plugins on connected WordPress sites. Patchstack counted 99 backdoor names, and about 400,000 sites had a vulnerable key. Fixed versions 1.26.13 and 2.26.13 were released on 19 October.

A related incident hit Rank Math PRO: version 3.0.123 packages were distributed between 15 October 20:02 UTC and 16 October 07:12 UTC. Sites that activated it should be treated as compromised, and 3.0.124 is clean.

• Pin and hash. Use lock files with hashes (pip install --require-hashes, npm ci).
• Delay updates slightly. A cooldown of a day or two on new releases would have avoided the two-hour LiteLLM window.
• Short-lived credentials. Use OIDC for publishing and CI instead of long-lived tokens.
• Isolate installs. Do not run dependency installs on machines that hold production secrets.
• Review WordPress admins and plugins after any management-plugin incident.