Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Enterprise CISOs are being asked to do more than ever. Their role is now two-fold: protector of the business and enabler of its growth. They need to reduce risk across a vast and changing digital environment, protect the business, satisfy customers, and meet compliance requirements. What’s more, they want to showcase the positive impacts of their security program to executive leadership and the board and support the growth of their organization.

We just published a deep breakdown of the Trivy supply chain attacks yesterday. Twenty-four hours later, we’re writing about the next one. Same threat actor. Different target. Worse implications. This time it’s LiteLLM, the Python library that acts as a universal API gateway for over 100 LLM providers. If you’re building anything with AI agents, MCP servers, or LLM orchestration, there’s a good chance LiteLLM is somewhere in your dependency tree.

When it comes to fraud prevention, most of us know that small steps can make a big difference: use strong passwords and a password manager, turn on multifactor authentication, and so on. But for banks, fintechs and payment processors, those small steps are just the beginning.

If you operate a fundraising platform, process donations, or work with nonprofit organizations, you’re expected to verify that those organizations are legitimate before doing business with them. This process is known as nonprofit Know Your Business (KYB) or non-profit verification, which requires confirming 501(c)(3) status and ensuring the nonprofit is in good standing. But the verification process for nonprofit KYB isn’t as straightforward as it sounds.

Part 1 covered CanisterWorm, the self-spreading npm worm. This post covers the next wave: a malicious LiteLLM PyPI package carrying the most capable credential stealer TeamPCP has deployed yet. On March 24, 2026, two versions of litellm, one of the most widely used Python libraries for working with AI language model APIs, were published to PyPI carrying a hidden credential stealer. Versions 1.82.7 and 1.82.8 never appeared on the official LiteLLM GitHub repository.

We're excited to announce that BlueVoyant's Third-Party Risk Management (TPRM) solution is now available on Google Cloud Marketplace. This milestone makes it easier than ever for organizations to purchase, deploy, and start managing supply chain cyber risk while getting more value from their existing Google Cloud Platform (GCP) investment.

“We have backups” might be the most dangerous phrase in law firm IT. According to the ABA’s 2023 Legal Technology Survey, only 34% of law firms have an incident response plan – and far fewer regularly test their ability to actually recover from a disaster. Having backups and being able to recover from them are two very different things.

Securonix threat researchers have been tracking an ongoing campaign targeting French-speaking corporate environments through fake resumes. The campaign uses highly obfuscated VBScript file disguised as resume/CV documents, delivered through phishing emails. Once executed, the malware deploys a mutli-purpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization.

For channel partners, AI has quickly moved from a future conversation to a current customer problem. Clients are already using AI across their organisations, often faster than governance can keep up. What’s emerging is not just another technology trend, but a new class of risk that customers cannot fully see or control. Our latest research, based on insights from senior security leaders in highly regulated industries, highlights the scale of the issue.

Microsoft SharePoint, a core platform for enterprise collaboration, is facing active exploitation through a newly confirmed vulnerability, tracked as CVE-2026-20963. Rooted in unsafe deserialization of user-controlled data, this vulnerability allows remote code execution with low-privileged authenticated access, making it a high-priority threat for organizations worldwide.