{"id":3305,"date":"2026-10-23T07:03:29","date_gmt":"2026-10-23T14:03:29","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3305"},"modified":"2026-10-30T13:19:19","modified_gmt":"2026-10-30T20:19:19","slug":"litellm-supply-chain-attack-how-hackers-turned-a-trusted-ai-package-into-a-credential-stealing-backdoor","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/litellm-supply-chain-attack-how-hackers-turned-a-trusted-ai-package-into-a-credential-stealing-backdoor\/","title":{"rendered":"LiteLLM Supply-Chain Attack: How Hackers Turned a Trusted AI Package into a Credential-Stealing Backdoor"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>CYBER.MAG212 | Global Cybersecurity Intelligence<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Published:<\/strong> October 23, 2026<br><strong>By:<\/strong> El Mostafa Ouchen<br><strong>Category:<\/strong> AI Security, Supply Chain Attacks, Malware Analysis, Critical Security Alerts<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">A Trusted AI Tool Became an Attack Delivery System<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On October 21, 2026, attackers compromised the software release pipeline of LiteLLM, an open-source Python library widely used to connect applications with artificial intelligence services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attackers published a malicious version of the package through legitimate software distribution channels, including the Python Package Index (PyPI) and official Docker container registries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The compromised version, <strong>LiteLLM 1.107.0<\/strong>, contained malware designed to steal sensitive credentials and establish infrastructure for remote code execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Developers and organizations that installed or executed the affected software could have exposed cloud credentials, AI API keys, database passwords, GitHub authentication tokens, and other secrets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to LiteLLM&#8217;s official incident report, the attack was contained and the malicious releases were removed. However, environments that executed the compromised software must still be investigated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The incident demonstrates one of the most dangerous weaknesses in modern software development: a trusted dependency can become a delivery mechanism for malicious code.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is LiteLLM, and Why Is It Important?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">LiteLLM is a Python-based interface and proxy gateway that allows applications to communicate with multiple AI model providers using a unified integration layer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations use LiteLLM to centralize AI requests, manage model access, configure API credentials, and monitor usage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a business application may send its request to LiteLLM, which forwards the request to an AI provider and returns the response to the application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This architecture is convenient for developers, but it also creates a security-sensitive component.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An AI gateway may have access to authentication tokens, environment variables, databases, and infrastructure configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If attackers compromise the gateway&#8217;s software supply chain, the resulting exposure may extend beyond the AI application itself.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the Attackers Compromised LiteLLM<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">LiteLLM&#8217;s investigation identified activity involving three compromised developer GitHub accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attacker apparently used stolen GitHub CLI OAuth credentials to manipulate the project&#8217;s release workflow.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The investigation described the following sequence:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 1 \u2014 Compromising developer access<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attacker obtained credentials associated with LiteLLM maintainers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exact initial mechanism used to acquire these credentials was not fully established at the time of the incident report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 2 \u2014 Changing the release pipeline<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A protected release workflow was modified using privileged developer access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attack bypassed branch protections and later used another compromised account to approve the release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 3 \u2014 Building software from attacker-controlled source<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The modified pipeline built release artifacts using an attacker-controlled repository.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Crucially, the legitimate GitHub source tag did not contain the malicious files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This difference helps explain why reviewing public source code alone may fail to detect certain supply-chain attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 4 \u2014 Distributing compromised packages<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Malicious PyPI packages and Docker images were published through official distribution channels.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Developers retrieving the affected versions could receive the malicious artifacts without recognizing that the release pipeline had been compromised.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 5 \u2014 Activating the malware<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The malicious Python package included startup files capable of activating code when Python initialized.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The malware was designed to collect secrets and provide a mechanism for additional remote execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 6 \u2014 Attempted credential exfiltration<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The malicious components searched the local environment for credentials and other sensitive information that could be transmitted outside the compromised system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exact information exposed depends on the permissions, files, network access, and secrets available to each affected environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which Versions Were Compromised?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to the official LiteLLM incident report, the confirmed affected artifacts included:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>Platform<\/th><th>Affected release or tags<\/th><th>Exposure window, October 21 UTC<\/th><\/tr><tr><td>PyPI<\/td><td><code data-no-translation=\"\">litellm==1.107.0<\/code><\/td><td>11:39\u201313:23<\/td><\/tr><tr><td>Docker Hub<\/td><td><code data-no-translation=\"\">v1.107.0<\/code>, <code data-no-translation=\"\">latest<\/code>, <code data-no-translation=\"\">main-latest<\/code>, <code data-no-translation=\"\">main-stable<\/code><\/td><td>11:46\u201314:20<\/td><\/tr><tr><td>GitHub Container Registry<\/td><td>Corresponding affected container tags<\/td><td>Beginning at 11:46; removed or made unavailable earlier than Docker Hub<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The malicious releases were subsequently withdrawn or replaced with clean artifacts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">LiteLLM stated that its separately distributed private enterprise release was not affected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administrators should determine whether any affected version or image digest was actually installed or executed, rather than relying on the currently displayed tag alone.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Dangerous Python Startup Technique<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An especially important element of this attack was the abuse of Python interpreter startup behavior.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technical analysis identified malicious files including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code data-no-translation=\"\">cook.pth<\/code><\/li>\n\n\n\n<li><code data-no-translation=\"\">cook.py<\/code><\/li>\n\n\n\n<li><code data-no-translation=\"\">sitecustomize.py<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Python supports special configuration and customization files used during startup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Le <code data-no-translation=\"\">.pth<\/code> mechanism can execute certain Python statements when the interpreter processes site-package directories.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Likewise, <code data-no-translation=\"\">sitecustomize.py<\/code> may be imported automatically during Python initialization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers can abuse these legitimate features to trigger malicious execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This creates a dangerous condition: <strong>the victim may not need to explicitly import LiteLLM for the malware to activate.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Starting another Python-based utility inside an affected environment could potentially execute the malicious startup code again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That includes Python package-management commands.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For this reason, LiteLLM warned affected users not to begin remediation by running <code data-no-translation=\"\">pip install<\/code> inside a suspected compromised environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Could the Malware Steal?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Security researchers identified credential theft as a central objective of the malware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Potentially exposed information included:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AI service credentials:<\/strong> API keys used to access external model providers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cloud credentials:<\/strong> Tokens and authentication material associated with services such as AWS, Azure, and Google Cloud.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Development credentials:<\/strong> GitHub authentication tokens and SSH private keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Database credentials:<\/strong> Passwords and connection strings available to the affected application or host.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Application secrets:<\/strong> Environment variables, LiteLLM master keys, proxy keys, and other configuration secrets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Browser information:<\/strong> Accessible authentication data and locally stored credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The compromise of an API key may permit unauthorized service usage. Cloud credentials may provide access to infrastructure, while development tokens can potentially enable additional software supply-chain compromises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The actual impact depends on the privileges associated with each stolen credential.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How IT Administrators Can Investigate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Administrators should perform initial checks using trusted shell utilities, preferably from an isolated investigation environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not execute Python or pip inside a suspected compromised environment until the startup mechanism has been contained.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 1 \u2014 Find suspicious Python startup files<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On Linux:<\/p>\n\n\n\n<pre class=\"wp-block-code\" data-no-translation=\"\"><code data-no-translation=\"\"><span style=\"color: #0ae648;\" class=\"stk-highlight\">sudo find \/ -type f \\\n  \\( -name 'cook.pth' \\\n  -o -name 'cook.py' \\\n  -o -name 'sitecustomize.py' \\\n  -o -name 'remote_code_loader.lock' \\) \\\n  2>\/dev\/null<\/span><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The command searches for files associated with the reported compromise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The presence of <code data-no-translation=\"\">sitecustomize.py<\/code> alone does not establish malicious activity because legitimate Python environments may use this file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Investigators must evaluate file paths, contents, timestamps, and package provenance.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 2 \u2014 Find the affected LiteLLM installation<\/h3>\n\n\n\n<pre class=\"wp-block-code\" data-no-translation=\"\"><code data-no-translation=\"\"><span style=\"color: #0ae648;\" class=\"stk-highlight\"><strong>sudo find \/ -type d \\\n  -name 'litellm-1.107.0.dist-info' \\\n  2>\/dev\/null<\/strong><\/span><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This searches for installed Python package metadata associated with the affected version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A missing result does not guarantee that an environment was never compromised.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 3 \u2014 Inspect Docker images<\/h3>\n\n\n\n<pre class=\"wp-block-code\" data-no-translation=\"\"><code data-no-translation=\"\"><span style=\"color: #0ae648;\" class=\"stk-highlight\"><strong>docker image ls --digests\ndocker ps -a --no-trunc<\/strong><\/span><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Review container image history, digest identifiers, and deployment logs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The compromised Docker Hub image index reported by LiteLLM was:<\/p>\n\n\n\n<pre class=\"wp-block-code\" data-no-translation=\"\"><code data-no-translation=\"\"><span style=\"color: #0ae648;\" class=\"stk-highlight\"><strong>sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e<\/strong><\/span><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An image digest is a stronger historical indicator than a mutable container tag such as <code data-no-translation=\"\">latest<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 4 \u2014 Examine suspicious network activity<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Review firewall, DNS, proxy, and EDR records for indicators documented in reputable threat-intelligence reports.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Investigate unusual outbound connections originating from LiteLLM servers, CI\/CD runners, developer workstations, and related cloud workloads.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 5 \u2014 Review authentication activity<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Investigate unusual cloud API requests, unfamiliar source addresses, unexpected token usage, unauthorized repository changes, and anomalous database connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use logs from the period surrounding the installation and continue reviewing subsequent credential activity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Organizations Should Do If Compromised<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Any environment that executed the known malicious release should be treated as potentially compromised.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Isolate affected workloads.<\/strong> Restrict network exposure and prevent continued unauthorized communication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Preserve forensic evidence.<\/strong> Collect relevant logs, system metadata, deployment records, and suspected artifacts before rebuilding, where practical.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Rebuild from trusted sources.<\/strong> Create clean virtual environments or container images rather than relying solely on deleting suspicious files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Rotate accessible secrets.<\/strong> Replace AI API keys, GitHub tokens, cloud credentials, database passwords, and other secrets available to the affected workload.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Audit cloud infrastructure.<\/strong> Review identity activity, role assumptions, API calls, and potential access from unfamiliar systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6. Examine software release systems.<\/strong> Review GitHub permissions, workflow modifications, signing procedures, and trusted publishing configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>7. Strengthen future deployments.<\/strong> Pin dependency versions and immutable image digests, protect release credentials, scan build artifacts, and limit runtime permissions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">LiteLLM&#8217;s October 21 advisory recommended pinning installations to version <code data-no-translation=\"\">1.106.2<\/code> or another explicitly identified earlier clean release while remediation continued.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administrators should consult the project&#8217;s latest official security guidance before redeployment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Bigger Cybersecurity Lesson<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This incident highlights a critical difference between traditional malware attacks and modern supply-chain compromises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker does not necessarily need to exploit a vulnerability in every individual customer environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By compromising software production or distribution, one attacker may reach numerous organizations through otherwise routine installation and deployment processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The incident also shows why organizations must secure developer identities, build workflows, cloud credentials, and AI infrastructure as part of one interconnected security architecture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An organization&#8217;s defenses cannot end at its firewall.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Protection must extend to the code it trusts, the packages it installs, the images it deploys, and the credentials its applications can access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion: Trust the Process, but Verify the Artifact<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The LiteLLM compromise is a warning to organizations rapidly adopting artificial intelligence services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same tools that accelerate software development can also expand the consequences of compromised developer credentials or release automation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The priority for affected organizations is not simply to uninstall a vulnerable package. It is to investigate possible execution, rebuild clean environments, rotate exposed secrets, and verify the integrity of the software delivery process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A trusted package is only as secure as the systems, identities, and workflows used to build and distribute it.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Sources and Further Reading<\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>LiteLLM \u2014 Official Security Incident Report, October 21, 2026<br><a href=\"https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026<\/a><\/li>\n\n\n\n<li>Datadog Security Labs \u2014 LiteLLM Supply Chain Compromise: What You Need to Know<br><a href=\"https:\/\/securitylabs.datadoghq.com\/articles\/litellm-compromised-pypi-docker\/\" target=\"_blank\" rel=\"noopener\">https:\/\/securitylabs.datadoghq.com\/articles\/litellm-compromised-pypi-docker\/<\/a><\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">About CYBER.MAG212<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CYBER.MAG212<\/strong> publishes cybersecurity news, technical analysis, critical vulnerability reports, and practical guidance for IT administrators, security engineers, developers, and technology professionals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Auteur:<\/strong> El Mostafa Ouchen<br><strong>Website:<\/strong> <a href=\"https:\/\/cyber.mag212.com\/fr\/\">https:\/\/cyber.mag212.com<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Editorial note: This article reflects verified disclosures available through October 23, 2026. Technical findings may change as the investigation continues.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading mag212-related\">Related coverage on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list mag212-related-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/black-october-2026-php2shell-emudhra-gitlab-and-litellm-what-happened-and-what-to-do-now\/\">Black October 2026: PHP2Shell, eMudhra, GitLab and LiteLLM \u2014 What Happened and What to Do Now<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/mag212-cyber-weekend-edition-ai-agents-storm-the-cloud-oct-21-24-2026\/\">MAG212 CYBER Weekend Edition: AI Agents Storm the Cloud (Oct 21\u201324, 2026)<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/skyw4lker-device-code-phishing-microsoft-365\/\">SkyW4lker Device-Code Phishing: How It Hijacks Microsoft 365 Accounts and How to Stop It<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/shell-week-php2shell-node2shell-and-the-race-between-the-leak-and-the-patch\/\">Shell Week: PHP2Shell, Node2Shell and the Race Between the Leak and the Patch<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>CYBER.MAG212 | Global Cybersecurity Intelligence Published: October 23, 2026By: El Mostafa OuchenCategory: AI Security, Supply Chain Attacks, Malware Analysis, Critical Security Alerts A Trusted AI Tool Became an Attack Delivery System On October 21, 2026, attackers compromised the software release pipeline of LiteLLM, an open-source Python library widely used to connect applications with artificial intelligence [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":3302,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[25,27,23,29,31,28,32,24,30],"class_list":["post-3305","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-incidents","tag-cisa","tag-cyber-threat-intelligence","tag-cybersecurity-news","tag-ethical-hacking","tag-incident-response","tag-network-security","tag-php","tag-ransomware","tag-zero-day-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3305","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3305"}],"version-history":[{"count":2,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3305\/revisions"}],"predecessor-version":[{"id":3652,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3305\/revisions\/3652"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3302"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3305"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}