Nobody notices a stolen AI provider key until the bill shows up. Railway said AI provider keys its customers stored on the platform were taken in an October breach and used for an estimated $740,000 in unauthorized spending, according to The Hacker News.
The same outlet reports a critical authentication bypass in Xen Orchestra that is being actively exploited to gain admin access. CISA's catalog of exploited vulnerabilities now lists an incorrect authorization flaw in IBM Aspera Faspex that lets an authenticated user escalate privileges.
If your product holds LLM keys, keep them in a secrets vault instead of a platform settings page, give every key a hard spend cap with alerting, and make rotation a one-command job instead of a half day of guesswork. We take on security reviews of payment and account flows, including how keys are stored and rotated, and we can tell you cost and timeline within a day. Message us with what your product stores.