CVE-2026-44484 Details

A security incident has been identified in the PyTorch Lightning package versions 2.6.2 and 2.6.3, where released versions have been compromised to include malicious code consistent with a credential harvesting mechanism. The root cause of this compromise is still under investigation.

Users are advised to delete the compromised versions 2.6.2 and 2.6.3 from their systems, pin PyTorch Lightning to version 2.6.1, and rotate all credentials and secrets that may have been exposed. After removing the compromised versions, rebuild affected systems from a known clean state.