When supply chains wobble, keep your email upright

A few attacks that didn’t start in email are landing squarely on email teams. That’s new pressure—and fixable, if you work the right list in the right order.

What changed: three shocks, one inbox

LiteLLM’s 1.107.0 release was hijacked with a credential stealer and backdoor pushed to PyPI and Docker around 4 a.m. on Oct. 21 before being quarantined, according to our report on the incident (LiteLLM release hijacked). Microsoft separately said a China‑linked group, Storm‑0940, used an AI pentest toolkit to hit 2,200+ tenants via ConnectWise Cloud Backup (Storm‑0940 used AI). And eight eMudhra intermediate CA keys were recoverable, prompting fast browser blocks and urging email system updates as eMudhra exits global SSL/TLS (eMudhra keys cracked).

First 24 hours: freeze, find, and fence

If you ship through CI that pulls from PyPI or Docker, freeze upgrades immediately and pin to the last known‑good version dated before 4 a.m. Oct. 21 for any LiteLLM dependency. Inventory which mail systems—ESP plugins, webhook relays, DKIM signers, or in‑house list tools—were built or deployed during that window to isolate risk from the backdoored 1.107.0.

Next, fence credentials. If a tainted container or package ran on hosts with access to SMTP credentials, DKIM private keys, OAuth tokens for Microsoft 365, or webhook secrets, rotate them now. Don’t wait for indicators; the cost of rotation is lower than a week of reputation bleed after quiet abuse from a stolen key.

Finally, restrict blast radius. Lock inbound webhooks to a fixed IP range and mutual TLS where supported, and pause nonessential automations that can send at scale until you verify no unauthorized code paths exist. The goal is to turn a potential compromise into a contained configuration event.

Prove your auth again: SPF, DKIM, DMARC

SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are your first lines; DMARC (Domain‑based Message Authentication, Reporting & Conformance) ties them to the visible From. If your signing service or build chain touched tainted code, add a new DKIM selector and publish the key, then retire the old selector after live traffic confirms passes for at least 48 hours. Track DMARC alignment and forensic data to spot drift. We published a step‑by‑step tune‑up that fits 2026 realities if you need a plan (DMARC just got real: a 4‑week plan).

Stripe now requires DMARC on custom sender domains and will fall back to stripe.com when DNS slips, which affects how billing emails authenticate and display (Stripe makes DMARC table stakes). That’s a reminder that partners can change the rules under your feet—so keep DMARC at enforcement and monitor reporting, not just pass/fail.

TLS got bumpy: check chains and catch‑up patches

With eight eMudhra intermediates cracked, mail transfer agents (MTAs) and sending tools that bundle their own trust stores may fail TLS handshakes until stores update. Test STARTTLS to Microsoft, Gmail, and Yahoo and record which chain you present. If you rely on pinned or custom CAs, refresh bundles and verify negotiated ciphers and versions after changes. Our eMudhra coverage details why email servers needed updates even though browsers blocked fast (Email needs patches too).

Where outbound TLS breaks, many receivers will still accept mail opportunistically, but some enterprise gateways will not. That turns a silent chain problem into a deliverability outage, so log TLS outcomes next to DKIM/DMARC in your daily checks.

OAuth and app identities: lessons from ConnectWise

Microsoft tied the Cloud Backup compromise to Storm‑0940’s automated runs across thousands of tenants (Storm‑0940 used AI). An earlier incident showed a single credential let actors access 173 Microsoft 365 tenants; ConnectWise pulled the service and disabled seven app identities (Cloud Backup pulled). If your email routing touches Microsoft 365—shared inboxes, delegated send, or transport rules—review OAuth application permissions, consent logs, and service principals created by third parties. Remove unused apps and enforce admin consent for new scopes.

For anything that can send as your domain, shrink scopes to the minimum—avoid “send as any user,” prefer “send on behalf of” for specific mailboxes, and enforce Conditional Access with sign‑in risk checks. If a vendor integration is paused, ensure your fallback path (like SMTP AUTH) is throttled to prevent accidental volume spikes that irritate receivers.

Web touchpoints: fix the leak that poisons lists

Our PHP2Shell report noted exploits landed before the patch, and millions of PHP hosts likely stayed vulnerable afterward (PHP2Shell went live). If your subscription forms, preference centers, or unsubscribe endpoints are PHP‑backed, patch the runtime, disable dangerous functions, and enable a WAF rule for known payloads. Compromised forms don’t just skim data; they inject garbage addresses that inflate bounces and complaints, tripping blocklists and reputation filters you then have to dig out of.

Add proof‑of‑work or modern bot defenses to form posts, and log each form’s user‑agent and IP so you can prune poisoned signups fast. If you need to understand blocklist signals, our coverage of Spamhaus’ September trends and CSS check tool offers concrete debugging steps (Spamhaus flags record risky domains).

Data exposure isn’t abstract: plan for phishable users

Capcom said attackers grabbed 11.7 million CAPCOM ID email addresses, changed 196 passwords, and viewed limited personal data for 43 people (Capcom breach exposes 11.7m emails). When a set that large hits the wild, expect a wave of convincing lures impersonating your brand. Pre‑empt by enabling BIMI (Brand Indicators for Message Identification) once DMARC is enforced, and publish consistent From: names that help recipients spot spoofs. Then stage a notification cadence for at‑risk segments without driving complaints—a short, factual alert beats a long apology.

Internally, tighten your abuse desk workflow. Route suspicious‑mail reports directly into tooling that correlates them with DMARC failures and blocklist hits. If your CRM writes back “unsubscribe” or “complaint” flags via webhooks, re‑check those integrations weren’t caught in any dependency rollbacks.

Test like a receiver: evidence over gut feel

After rotations and patches, send a controlled campaign to seed accounts at major providers and log results within 24 hours. Confirm: DKIM passes on the new selector, DMARC alignment holds, SPF includes match, TLS chains are accepted, complaint rates don’t spike, and any BIMI logo still renders. For Gmail, our panel piece on the end of reputation “colors” explains which underlying data you can still monitor when volume surges (Gmail reputation colors are gone). Keep those checks in a runbook so the next incident takes hours, not days.

Finally, write a one‑page SBOM‑ish map for your email path: build tools, packages, CAs, OAuth apps, and where keys live. Tie each to an owner and a rotation date. When the next 4 a.m. release goes sideways, you’ll know exactly which screws to turn.