Cyber

What changed

Recent reports indicate a troubling trend in ransomware attacks, where criminals are not only locking files and stealing data but are now also threatening employees and their families to compel organizations to pay ransoms. This shift in tactics highlights the evolving nature of cyber threats and the lengths to which attackers will go to achieve their objectives.

The Semperis 2026 Ransomware Risk Report reveals that 37% of successful ransomware attacks involved threats directed at the friends or relatives of employees, underscoring the need for enhanced security measures and employee awareness.

Who is affected

This alarming trend affects a wide range of organizations across various sectors, particularly those with valuable data or critical operations. The following groups are particularly vulnerable:

Companies with significant employee bases are at risk, especially in industries such as healthcare, finance, and technology.

• Healthcare providers managing sensitive patient data.
• Financial institutions handling large volumes of transactions.
• Technology firms with proprietary information and intellectual property.
• Government agencies that may be targeted for sensitive information.

What to do

Organizations must take proactive steps to mitigate the risks associated with these evolving ransomware tactics. This includes implementing robust security protocols and enhancing employee training to recognize and respond to threats.

Additionally, companies should consider developing comprehensive incident response plans that address the potential for threats against employees and their families.

• Conduct regular security training sessions for employees to raise awareness about ransomware threats.
• Implement multi-factor authentication and strong access controls to protect sensitive data.
• Establish a clear communication plan for employees in the event of a ransomware attack.
• Engage with cybersecurity experts to evaluate and strengthen your organization's defenses.

What changed

Recent assessments have revealed two critical vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in the LiteLLM gateway tool. These vulnerabilities could potentially allow unauthorized access and manipulation of data transmitted between AI applications and service providers.

Enterprises utilizing LiteLLM for integration with AI platforms such as OpenAI and Anthropic are particularly at risk, as these flaws compromise the security of sensitive information.

Who is affected

The vulnerabilities impact a range of organizations and products that rely on LiteLLM for AI application connectivity. Enterprises using this tool must be vigilant.

Specifically, the following groups are at risk:

• Organizations leveraging LiteLLM for AI integration.
• Developers and IT teams managing AI applications connected to OpenAI.
• Businesses utilizing LiteLLM to interface with Anthropic's services.
• Any enterprise relying on LiteLLM for data transmission between AI systems.

What to do

Organizations should prioritize immediate assessment of their LiteLLM implementations to identify exposure to these vulnerabilities. It is crucial to apply any available patches or mitigations as soon as they are released.

Additionally, monitoring for unusual activity and reviewing security protocols related to AI application connectivity is recommended.

• Conduct a vulnerability assessment of LiteLLM deployments.
• Implement security patches as they become available.
• Enhance monitoring for suspicious activities related to AI integrations.
• Review and strengthen security policies governing data transmission.