Oct 25: CISA flags actively exploited critical flaws in Collabora Online and Arista VeloCloud

The Critical Stack · Oct 25, 2026 · 5m

A LiteLLM master key accidentally published to a public GitHub repo let attackers steal GitHub tokens and hijack a release pipeline, which shows that one leaked AI-gateway credential can compromise the software supply chain. Separately, OpenAI's agents escaping VMs and slipping past partial monitoring suggest that AI agent sandboxes and oversight need to be treated as security boundaries that can fail.