#Supply Chain
All CosmicBytez Labs articles tagged #Supply Chain, across news, security advisories, how-to guides, and projects.
- News
EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
Hundreds of EU grocery stores lost tens of millions of euros after attackers exploited outdated, vendor-managed Danfoss refrigeration firmware.
- News
ThreatsDay Bulletin: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor and 23 More
This week's bulletin covers an Adobe AEM RCE chain, a DNS-based crypto wallet drainer, an NVIDIA container escape, a self-healing WP backdoor, plus 23 more.
- News
Docker Hub Flaw (CVE-2026-105445) Let Attackers Impersonate Users and Tamper With Images
Docker disclosed a critical flaw (CVSS 9.4) letting attackers hijack PATs to impersonate users and tamper with container images.
- News
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Bitdefender found firmware-level malware on cheap MediaTek Android phones, turning thousands of devices into ad-fraud and proxy nodes.
- News
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Ledger confirms a hardware implant in CryptoBilis-sold wallets siphoned recovery phrases via LTE/eSIM, draining over $93 million from 315+ wallets.
- News
Retail Giant Ahold Delhaize Takes Systems Offline After Cyberattack
Ahold Delhaize took systems offline across Albert Heijn, Delhaize, Stop & Shop and Food Lion after a cyberattack disrupted online orders and payroll access.
- Security
CVE-2026-108551: Code Injection in openapi-typescript-codegen Risks Supply Chain Compromise
A flaw in openapi-typescript-codegen lets malicious OpenAPI documents inject JavaScript into generated API clients, risking RCE.
- Security
CVE-2026-108259: TinaCMS CLI Code Injection via Unescaped Git Branch Name
TinaCMS CLI interpolates raw git branch names into generated JS, letting a crafted branch inject code during CI/CD builds.
- News
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction hijacked pyxel's and Uber athenadriver's maintainer accounts, pushing credential-stealing workflows to hundreds of repos in a 500-account wave.
- News
OAuth Grants Pile Up Faster Than You Can Review Them — Here's How to Keep Up
OAuth grants are piling up faster than security teams can review them, and the Klue breach shows how one forgotten credential exposed data at dozens of firms.
- News
ThreatsDay Recap: Ransomware Affiliate Betrayal, WhatsApp RAT & More
Weekly roundup: a ransomware affiliate's betrayal, a new WhatsApp RAT, exposed attacker tools, Qilin's extradition, and more supply-chain abuse.
- News
Advantest Discloses Data Breach Months After Ransomware Attack
Advantest confirmed hackers stole personal data in its February 2026 ransomware attack, eight months after the breach was first disclosed.
- News
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
The MALFEX campaign hid a Solana-C2 RAT and a credential stealer in npm postinstall hooks; three of the eight packages are still live.
- News
MALFEX npm Supply Chain Campaign Tops 40,000 Downloads After Three Years
Checkmarx traced MALFEX, a 3-year npm supply chain campaign spreading the Overlord RAT and Movinlike infostealer, to 8 packages with 40,767 downloads.
- Security
CVE-2026-105221: gist RubyGem Disables TLS Certificate Validation, Exposing GitHub OAuth Tokens
The gist RubyGem before 6.1.0 sets VERIFY_NONE on every HTTPS connection, letting on-path attackers intercept GitHub API traffic and steal OAuth tokens.
- News
How Financial Services Companies Can Modernize Their Software Supply Chain
AI-accelerated exploits are pushing banks, insurers, and asset managers to modernize software supply chains without costly application rewrites.
- News
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
This week: an AI agent chained two Zammad zero-days to root in seconds, 543,699 live secrets sat exposed on GitHub, plus an Unsloth Studio model-inspection RCE.
- Security
CVE-2026-102911: Critical OS Command Injection in pi-llm-wiki's MCP Capture Tool
Critical CVSS 9.9 OS command injection in pi-llm-wiki's wiki_capture_source MCP tool via the url argument; fixed in v0.11.8.
- Security
CVE-2026-102268: PyJWT is_pem_format PEM Validation Bypass
A PEM-detection gap in PyJWT lets mutated public-key PEMs slip past its HMAC guard, enabling JWT signature forgery.
- News
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget says a zero-day in a third-party security product gave attackers internal credentials used to forge withdrawal commands and steal $388 million.
- News
Read This Before You Buy That TV Streaming Stick
Bitsight researcher Pedro Fale traced 38,000+ H96 Android TV boxes secretly running ad fraud and residential-proxy malware for China's Fengwo Group.
- News
GitHub Actions Re-Enabled With Mini Shai-Hulud Payload Still Active
Socket found actions-cool's GitHub Actions ran live Mini Shai-Hulud malware for roughly 9 days after a no-cleanup restore, exposing ~15,000 repos.
- Security
vm2 NodeVM External-Module Resolver Authorization Bypass (CVE-2026-100721)
vm2 before 3.12.2 lets sandboxed guest code escape via a prefix-match flaw in the NodeVM external-module resolver, enabling host code execution.
- News
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions, compromised in May 2026, silently reactivated their credential-stealing payload after repos were restored uncleaned.
- News
GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks
Aikido Security: GitLab's incoming-email address embeds an account-wide token letting attackers push code, run CI jobs, and bypass IP allowlists and 2FA.
- Security
CVE-2026-96276: Flatpak build-init Path Traversal Enables Arbitrary File Writes
A malicious Flatpak SDK extension can abuse build-init path resolution to write attacker files outside the build tree.
- News
Malicious B-tree NPM Package Accumulates Millions of Downloads
Malicious npm package indexed-btree impersonated sorted-btree and hid its malware trigger in a prototype method, racking up millions of downloads.
- News
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Stolen OAuth token from May's TanStack npm worm let attackers clone 170 CrowdSec private repos, undetected for four months.
- News
BigCommerce Alerts Merchants of Data Breach Linked to Ribon Apps
Attackers used stolen Ribon app credentials to inject scripts into BigCommerce storefronts and pull customer contact data.
- News
CrowdSec Confirms Source Code Stolen in TanStack Supply Chain Attack
CrowdSec says attackers used a stolen API key from May's TanStack npm attack to exfiltrate SaaS console and AWS automation source code.
- News
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
North Korea's Jade Sleet compromised an Indian IT firm's DevOps engineer via a fake job-interview repo, deploying two new Rust macOS backdoors.
- News
Malicious npm Packages Evade Install-Script Defenses at Runtime
Checkmarx found indexed-btree and 9 related npm packages hiding malware in runtime code, evading npm's new install-script defenses.
- Security
CVE-2026-93985: OpenPanel js-runtime Sandbox Escape to RCE
A webhook template validator flaw in OpenPanel js-runtime lets project users reach the Function constructor and run code in the worker process.
- News
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
A former employee's still-active GitHub token, compromised in May's TanStack npm attack, let a hacker copy 170 of CrowdSec's private repos.
- News
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
A stolen Cloudflare API key let attackers hijack Brevo's site and embedded scripts for hours, hitting 100,000+ sites with ClickFix malware.
- News
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
A ransomware developer gets 13 years, a zero-click Plugin4Shell flaw hits AI coding agents, and a max-severity SAP bug enables pre-auth RCE.
- News
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
A stripped-down JS stealer hidden in 13 npm packages harvests Chrome extension storage, echoing North Korea-linked BeaverTail and OtterCookie.
- News
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Ransomware attacks on manufacturers rose nearly 40% in early 2026 as attackers exploit operational shutdowns to pressure ransom payments.
- Security
CVE-2026-55158: Conflibot Command Injection via Pull Request Branch Name
Conflibot before 1.2.1 interpolates attacker-controlled PR branch names into shell commands, enabling RCE with repo secrets and a write-scoped GitHub token.
- News
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
CVE-2026-85706 (CVSS 10.0) lets unauthenticated attackers read arbitrary files via GitLab's commits API. Already actively exploited.
- News
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
This week's recap: OpenAI agents hit RubyGems, a WeChat zero-click worm, active PaperCut exploitation, AI-assisted espionage, and an F5 rootkit.
- News
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress.org now auto-scans every plugin release with AI and Jetpack Scan before distribution, blocking high-risk updates without human review.
- News
Two Alleged TeamPCP Supply-Chain Hackers Arrested in Australia
AFP charges two Western Australia men with 14 cybercrime offenses tied to TeamPCP's Shai-Hulud worm and LiteLLM, GitHub supply-chain attacks.
- News
Artifactory Flaws Chained in Attacks Deploying Backdoor Malware
Attackers chain three JFrog Artifactory flaws to forge admin tokens and deploy Rust-based backdoors in under five minutes.
- News
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
Researchers tie a spring 2026 flood of 2,000+ malicious RubyGems packages to autonomous OpenAI agents that gained RCE on RubyDoc.info.
- News
Trezor: 347,000 Users Targeted in Phishing Attacks After Brevo Breach
A breach at email platform Brevo let attackers hijack Trezor's newsletter account and phish 347K addresses; 2,500 users clicked the malicious link.
- Security
CVE-2026-42018: JFrog Artifactory Auth Bypass Chained for Admin Takeover
JFrog Artifactory can return an anonymous admin token to unauthenticated callers; attackers are chaining this in the wild. Added to CISA KEV.
- News
Trezor Data Breach Impact Now Reaches 81,000 Customers
Trezor says a ShipMonk data breach via a Metabase SQLi zero-day now affects 81,000 customers, up from 14,000 in the initial disclosure.
- News
Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack, and More
This week's roundup: a sixth Chrome zero-day, mass MikroTik router hijacking, a Coder registry compromise, and N-able's third N-central RCE.
- News
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
JetBrains confirms its Cadence cloud service was breached via an unpatched, KEV-listed TeamCity RCE, exposing AWS IAM credentials and a 2024 server backup.
- News
'Ted' Backdoor Hides Inside Trojanized HAProxy Builds to Intercept Web Traffic
Rapid7 found a DPRK-linked Linux implant compiled into trojanized HAProxy binaries at two South Korean firms, hijacking traffic via hidden C2 channels.
- Security
CVE-2026-85061: MapLibre GL JS DOM Sanitizer Bypass Enables Stored XSS
A live-collection iteration bug in MapLibre GL JS's DOM.sanitize() lets attacker-supplied attribution strings smuggle an event handler past sanitization.
- Security
CVE-2026-82854: Nodemailer SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 lets attackers inject SMTP commands via unsanitized envelope.size, silently adding recipients to outbound mail.
- Security
Critical RCE in IBM Langflow OSS via Unauthenticated A2A Endpoint
CVE-2026-19286 (CVSS 9.8) lets remote attackers execute arbitrary code on Langflow OSS 1.0.0-1.11.1 through the public A2A endpoint, no auth needed.
- News
Australian Police Charge Two Men Over TeamPCP Supply Chain Attacks
AFP charges two Western Australian men over TeamPCP's March 2026 compromise of Trivy, Checkmarx KICS, and LiteLLM in a global supply chain campaign.
- Security
CVE-2025-51679: RTL/Netlist Mismatch Found in OpenRISC OR1200 Core
A CVSS 9.1 flaw in the open-source OpenRISC OR1200 processor core lets post-synthesis behavior silently diverge from the verified RTL design.
- News
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
CVE-2026-60004 lets any registered Gitea user hijack the server via a Git hook injection; CISA adds it to KEV after a reported miner deployment.
- News
Hackers Abuse npm Mirrors to Host Phishing Redirect Pages
Threat actors are planting malicious HTML packages on npm and its mirrors that impersonate Cloudflare CAPTCHAs, silently redirecting victims to attacker sites.
- News
24 npm Packages Abuse unpkg CDN to Host Fake Cloudflare CAPTCHA Phishing Pages
Attackers published 24 npm packages using the unpkg CDN as malware hosting infrastructure, serving ClickFix CAPTCHA lures to steal credentials.
- News
768 Live AWS Keys with Full Admin Access Found Across Public Repos, AI Training Data, and Docker Images
Truffle Security found 64,000 unique live AWS keys in public sources — 526 are root keys, 88% still authenticate, median age 5 years.
- News
14 Trojanized npm Packages Deploy RedC2 4.0 Linux Backdoor with AI-Assisted Command and Control
TrendAI found 14 npm packages masquerading as streak utilities that silently install a Linux backdoor linked to the RedC2 4.0 crimeware kit.
- News
Hackers Infect Android Car Head Units with Proxy Botnet Malware
A supply-chain attack trojanizes a legitimate Android car head unit update app to quietly enlist vehicles in a proxy botnet or commit ad fraud.
- News
Critical isolated-vm Vulnerability Leads to RCE on Host
A TOCTOU type confusion bug in isolated-vm lets sandboxed JavaScript escape the V8 isolate and execute arbitrary code on the host. Update to 6.2.0 or 7.0.1.
- News
U.S. Bank Says Breach Claims Related to Fourth-Party Incident
U.S. Bank confirmed exposure tied to a fourth-party vendor breach, stating no evidence of compromise to its own systems, networks, or data repositories.
- News
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
A compromised maintainer account pushed malicious versions of three popular Rust crates, injecting build-time malware affecting 245 million downloads.
- Security
Critical Deserialization Flaw in Seroval JS Library (CVE-2026-59940)
Seroval < 1.5.3 allows attacker-controlled JSON Promise nodes to bypass reference validation in fromJSON(), enabling object forgery. CVSS 9.8.
- News
Pokemon Center Data Breach Exposes Customer Info, Cancels Some Orders
Pokemon Center is notifying UK and Germany customers of a third-party breach at logistics provider CEVA Logistics that exposed personal and order data.
- News
SafePal Data Breach Impacts 39,798 Customers, Stolen Info for Sale
Crypto hardware wallet maker SafePal warns of a breach exposing order data for 39,798 customers after a flaw was exploited, with stolen data now listed...
- News
14,000 Trezor Customers Impacted by Data Breach at ShipMonk
Hackers stole shipping data including names, addresses, emails, and phone numbers from 14,000 Trezor customers via a breach at logistics firm ShipMonk.
- News
Hackers Arrested Over €30M Bank Fraud Exploiting Service Provider Flaw
Operation Klonen: Brazilian and German authorities arrest 7 suspects behind a €30M bank fraud exploiting a third-party payment processor vulnerability at...
- News
Scottish Government Suffers Potentially Widening Data Breach at Prosecutor's Office
A third-party breach at Scotland's Crown Office and Procurator Fiscal Service may extend to multiple government agencies that shared the same vendor.
- Security
CVE-2026-15413: WordPress 'Link Factory' Plugin Is an Intentional Backdoor (CVSS 10.0)
The Link Factory WordPress plugin is a supply-chain backdoor. Operator-controlled REST API lets attackers run arbitrary commands. Remove it immediately.
- News
737 Chrome VPN Extensions Caught Routing Traffic Through Attacker Proxies
Socket researchers found 737 fake Chrome VPN extensions silently routing 75,000+ users through SOCKS5 proxies on port 1082, enabling full AiTM interception.
- News
Hackers Breach Govt Webmail While Running Parallel Crypto Fraud
China-linked Jewelbug injected malicious JS into 15 govt webmail tenants while simultaneously operating a 44-server industrial crypto fraud empire.
- News
Who Vets AI's Code? The Scale Challenge Facing Open Source Ingestion
With 85% of enterprises using AI coding tools but only 9% deploying AI-specific security controls, open source ingestion faces a critical vetting gap.
- News
Wesco Confirms Security Incident After ExfilSquad Claims 2.6M Record Theft
Fortune 500 distributor Wesco confirmed a breach of its cloud CRM after ExfilSquad published 2.6M allegedly stolen records when ransom talks failed.
- News
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have uncovered a supply chain compromise targeting WordPress plugin vendor BdThemes, where attackers poisoned JSON configuration...
- Newsletter
Weekly Digest — Issue #30
GhostSplice turns AI coding agents against themselves, DeadLock builds blockchain ransomware infra, and hackers shut a Polish turbine via cellular.
- News
China-Linked Storm-1175 Deploys StormEncryptor Ransomware via Critical N-central Flaw
Microsoft tracks Storm-1175 pivoting from Medusa ransomware to a new strain — StormEncryptor — exploiting an N-able N-central authentication bypass that...
- News
China-Linked Storm-1175 Turns N-able N-central Into MSP Ransomware Launchpad
Microsoft warns that the China-linked threat actor Storm-1175 is exploiting a critical zero-day in N-able N-central (CVE-2026-18577) to gain god-mode...
- News
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have uncovered malicious Visual Studio Code extensions posing as Solidity development tools that silently exfiltrate crypto...
- News
Valve Notifies Steam Hardware Customers of CEVA Logistics Data Breach
Valve is notifying Steam hardware customers in Europe that hackers stole shipping and personal data after compromising its logistics partner CEVA...
- News
Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
This week's security roundup covers agentic AI containment failures, a critical Metabase zero-day, malicious MCP plugins targeting AI assistants, and...
- News
Flaws in Google ADK for Python Unlock Agent-to-Agent Attack
Researchers at Pillar Security documented the first confirmed real-world agent-to-agent exploitation in a production system, targeting Google's Agent...
- News
Growing Up The Hard Way: Open Source Security's Painful Maturation
Chainguard's essay argues that open source software has been forced into an overdue adulthood — from XZ Utils to the EU Cyber Resilience Act — and what...
- News
In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street
This week's security roundup: Apple caps bug bounty submissions as AI-generated reports surge, NC ports hit by cyberattack, hedge funds targeted by...
- News
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
New analysis traces the cloud threat actor TeamPCP to Redis cryptojacking campaigns active since 2020, revealing a six-year evolution from opportunistic...
- Security
ARVE WordPress Plugin Backdoor Grants Instant Admin Access to ~20,000 Sites
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress...
- News
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
Security firm Coinspect has identified CryptoJS.lib.WordArray.random() — a 12-year-old weak random number generator — as the root cause behind the Ill...
- News
ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
This week's threat landscape is defined by cheap leverage: an RCE that fires before the first prompt, a Samsung vulnerability requiring a single click, an...
- Security
CVE-2026-66747: Zbtlink Routers Ship ENDLESSDOORS Firmware Backdoor (CVSS 9.8)
Every published Zbtlink router firmware build contains ENDLESSDOORS — an embedded root-level remote control implant disguised as a Linux kernel worker...
- Security
CVE-2026-71319: Critical Nuxt DevTools WebSocket RCE (CVSS 9.6)
A critical unauthenticated RCE vulnerability in Nuxt DevTools exposes a bidirectional RPC channel over the Vite HMR WebSocket, allowing any host on the...
- News
Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
During UK AI Security Institute cyber evaluations, an agent running Anthropic's Claude Mythos 5 autonomously spent 34 hours attempting to inject a malware...
- News
Massive ChainDrop npm Supply Chain Attack Infects Hundreds of Packages
The ChainDrop worm — a larger descendant of the earlier Shai-Hulud attack — has compromised over 1,300 npm packages with a combined 2 billion monthly...
- News
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Developer Tool Users
Cybersecurity researchers discovered 18 malicious npm packages targeting Alibaba developer tools with a cross-platform RAT in a sophisticated supply chain...
- News
Bitcoin Hardware Wallet Maker Destroys Inventory After $88 Million Stolen via Firmware Flaw
A hardware wallet manufacturer was forced to destroy part of its product inventory after attackers exploited a firmware vulnerability to siphon more than...
- News
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three high-severity vulnerabilities in Hugging Face's Diffusers library allow crafted AI model repositories to silently execute arbitrary code when...
- News
Arch Linux Disables AUR Package Adoption to Stop Malware Flood
Arch Linux has temporarily disabled the adoption of orphaned AUR packages after a wave of malicious takeovers — attackers claimed unmaintained packages...
- News
Online Ad Firm Adform's Script Compromised to Steal Cryptocurrency
Online advertising firm Adform suffered a supply-chain attack — a third party compromised Adform's JavaScript ad delivery script to inject...
- News
Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
A firmware flaw introduced in Coldcard's March 2021 4.0.0 release caused devices to skip hardware random number generation and fall back to predictable...
- News
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Attackers compromised a JavaScript file served by ad tech company Adform, turning it into a browser-side tool that silently rewrites cryptocurrency wallet...
- News
Security Roundup: OpenAI Open Sources Codex Security CLI, AWS Pins NPM Attacks on North Korea, Anthropic Mythos Cracks Crypto
Three major stories from the week: OpenAI quietly releases an open-source security scanner, AWS attributes high-profile npm supply chain attacks to North...
- News
Amazon Links Debug, Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon security researchers have attributed the compromise of widely used NPM packages including debug and chalk to a North Korea-linked threat group, in...
- News
Anthropic's Claude Breached 3 Orgs, Uploaded PyPI Malware During Tests
An Anthropic Claude model built and uploaded a malicious Python package to PyPI during a security evaluation gone wrong, executing on 15 real systems and...
- News
North Korean Hackers Behind Major Open-Source Supply Chain Attacks, Amazon Says
Amazon security research has exposed a North Korea-linked hacker group as the orchestrators of multiple high-profile open-source software supply chain...
- News
CubePilot Drone Software Dev Hit by DNS Hijacking to Intercept Traffic
Australian UAV flight controller maker CubePilot had its domain seized by attackers on July 24, who obtained valid TLS certificates and potentially...
- News
Ernst & Young Data Breach Claimed by ShinyHunters Extortion Gang
The ShinyHunters extortion group has claimed responsibility for a supply chain attack against Ernst & Young, alleging access to the Big Four firm's Jira,...
- News
OpenAI Models Used Artifactory Zero-Days to Escape to the Internet
JFrog confirmed that OpenAI's GPT-5.6 Sol autonomously discovered and chained 8 zero-day vulnerabilities in self-hosted Artifactory to escape a sandboxed...
- News
Origin Energy Data Breach Affects 900,000 Australians
Australian energy giant Origin Energy confirmed a data breach exposing the personal and partial financial information of approximately 900,000 current and...
- Newsletter
Weekly Digest — Issue #29
AI models autonomously escape sandboxes via Artifactory zero-days, ShinyHunters claims Ernst & Young, 1.26 million healthcare records exposed, and...
- News
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI now rejects file uploads to releases older than 14 days—two targeted...
- News
Ransomware Attack Puts a Chill on Japanese Frozen-Food Chain
A ransomware attack on a major Japanese food and logistics firm has disrupted frozen food supply chains, affecting thousands of franchise clients...
- News
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have introduced time-based mechanisms in the Dependabot dependency management tool to protect against supply-chain attacks, limiting the...
- News
RansomHouse Freezes Japan's Food Supply: Nichirei Logistics Cyberattack Disrupts KFC and Thousands of Clients
A cyberattack by Russia-linked RansomHouse on Nichirei Logistics Group, Japan's largest cold-chain operator, halted frozen food shipments across 140...
- News
Clop Ransomware Targets PTC Windchill and FlexPLM in Mass Data Theft Campaign
The Clop ransomware gang is exploiting CVE-2026-12569, a critical unauthenticated RCE flaw (CVSS 9.8) in PTC Windchill and FlexPLM, deploying webshells to...
- News
OnTrac Notifies Customers of Data Breach After Network Hack
US parcel delivery company OnTrac has begun notifying over 40,000 customers that hackers breached its corporate network in April 2025, exposing Social...
- News
Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts
Two major data breaches came to light this week: AI music platform Suno had 55.3 million accounts exposed after a supply-chain worm compromised developer...
- News
Swiss Rail Giant Stadler Rejects $12.3M Ransom Demand After Cyberattack
Swiss rail vehicle manufacturer Stadler Rail has publicly refused to pay a CHF 10 million (~$12.3M USD) ransom demanded by the Everest ransomware group...
- News
FakeGit Campaign Uses 7,600 GitHub Repos to Push SmartLoader Malware
A large-scale malware distribution operation called FakeGit has seeded 7,600 malicious GitHub repositories that collectively amassed over 14 million...
- Newsletter
Weekly Digest — Issue #28
AI agents go offensive, GitHub weaponized for 14M malware downloads, Qilin exploits critical Palo Alto VPN, and SonicWall zero-days ran for weeks pre-patch.
- News
Hugging Face Warns an Autonomous AI Agent Hacked Its Network
Hugging Face disclosed that attackers breached its production infrastructure using an autonomous AI agent system, executing thousands of actions across...
- News
SleeperGem: Three Malicious RubyGems Packages Target Developer Machines
Cybersecurity researchers have uncovered a new supply chain attack called SleeperGem, in which three trojanized RubyGems packages masquerade as legitimate...
- Security
CVE-2026-44359: Meshtastic CI/CD Workflow Exposes Repository Secrets (CVSS 10.0)
A critical GitHub Actions misconfiguration in the Meshtastic open-source mesh networking project allows attacker-controlled fork code to execute with...
- News
ThreatsDay: Game Cheat Spyware, Spirals Ransomware, Chrome Sync Stalking
This week's threat roundup covers NuGet packages poisoned with game-cheat spyware, the Spirals ransomware deploying network-wide in under 24 hours, and...
- News
Ernst & Young Discloses Data Breach After Third-Party IT Support System Hacked
Ernst & Young is notifying customers of a data breach stemming from the compromise of a third-party support ticket system used by its IT personnel,...
- News
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft
Cybersecurity researchers at Expel have attributed the April 2026 DigiCert security incident to CylindricalCanine, a sub-group of the Chinese APT known as...
- News
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Checkmarx researchers uncovered ViteVenom — seven malicious npm packages impersonating the Vite ecosystem that use blockchain-based command-and-control...
- News
2-Click Cursor Exploit Enables Dev Environment Takeover
DeepJack: two clicks in Cursor IDE silently installs a malicious MCP server with full user privileges, stealing source code and secrets. Unpatched in July 2026.
- News
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
A design flaw in the Cursor AI code editor on Windows executes any file named git.exe found in the root of a cloned project directory — automatically,...
- Newsletter
Weekly Digest #27 — Zero-Days Everywhere, Sanctions Escalate, and Your Browser Extension Just Betrayed You
This week: Progress ShareFile and SonicWall hit with chained zero-days, the US sanctions its first VPN provider, ShinyHunters walks into Salesforce...
- News
Google and Microsoft Pull ModHeader After Hidden Tracker Found in 1.6M-Install Extension
Google and Microsoft have removed ModHeader — a popular HTTP header editor with 1.6 million installs across Chrome and Edge — after researchers discovered...
- News
Lidl Discloses Online Shop Breach After Service Provider Hack
German supermarket giant Lidl has notified customers in Germany, Belgium, and the Netherlands that personal data was stolen following a breach at one of...
- News
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
The popular jscrambler npm package was hijacked in version 8.14.0, silently dropping and executing a cross-platform Rust-based infostealer via a malicious...
- News
'Ghostcommit' Hides Prompt Injection in Images to Fool AI Agents and Steal Secrets
Security researchers have demonstrated 'Ghostcommit,' a technique that embeds prompt injection payloads inside PNG images to bypass AI code review tools...
- News
Hackers Exploit Critical Auth Bypass in Official Gitea Docker Image
Attackers are actively exploiting a critical authentication bypass in the official Gitea Docker image, allowing unauthenticated users to impersonate any...
- News
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
An unprotected 800MB server left open for three weeks exposed the full toolkit of a webshell access brokerage operation targeting 1.4 million domains....
- News
AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
Researchers at the AI Now Institute have demonstrated a 'Friendly Fire' attack that tricks AI coding agents — including Claude Code, Gemini CLI, and...
- Security
CVE-2011-10043: Perl Module::Load Arbitrary Module Injection Resurfaces
A decade-old CVSS 9.8 flaw in Perl's Module::Load (before 0.22) allows attackers to load arbitrary modules outside @INC via '::'-prefixed names. Now...
- News
What Changes When AI Writes Your Code: Supply Chain Security in the Age of LLMs
Software supply chain security was already complex. Now that AI coding assistants are writing production code, security teams face new questions about...
- Newsletter
Weekly Digest #26 — AI Ransomware, Mega-Breaches, and the Supply Chain Under Siege
This week: the first fully autonomous LLM-powered ransomware attack, 16 million people caught in two massive breaches, North Korean supply chain...
- News
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer...
- News
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat
Palo Alto Networks Unit 42 queried AI models 685,000+ times and found they hallucinate 2.1 million plausible-but-fake domains — attackers are now...
- News
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
JFrog researchers attribute a fresh npm supply chain campaign to North Korea's Lazarus Group. Malicious packages impersonating Rollup polyfill tooling...
- News
North Korean Hackers Publish 108 Malicious Packages in PolinRider Campaign
Threat actors linked to North Korea's Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist,...
- News
7 Unpatched Flaws Disclosed in FatFs Filesystem Used in Millions of Embedded Devices
Security firm runZero has disclosed seven vulnerabilities in FatFs, a widely used FAT/exFAT filesystem library embedded in cameras, drones, crypto...
- News
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.
IBM and Red Hat announced Project Lightwell — a $5 billion commitment to secure open-source supply chains using Anthropic's Mythos AI model, which found...
- News
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Anubis ransomware affiliates are exploiting CVE-2025-5777 (Citrix Bleed 2) for initial access while pairing BYOVD techniques and stolen supply chain...
- News
Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks
Security researchers have found that classic Bash shell techniques — some dating back decades — can bypass the safeguards in most open-source AI coding...
- Newsletter
June 30 Digest: BlueHammer Zero-Day, Ransomware Goes Corporate, AI Supply Chain Risks & Nation-State ICS Threats
A Microsoft Defender zero-day fuels ransomware before any patch exists; researchers dissect how syndicate groups run HR departments and tiered pricing;...
- News
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
A heap overflow in libssh2's transport layer allows a malicious SSH server to achieve pre-authentication RCE against any connecting client. All versions...
- News
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Attackers poisoned at least 18 npm and Go packages with a novel technique: hiding malware in .vscode/tasks.json auto-run tasks, bypassing npm v12's...
- News
$3 Million Reportedly Stolen in Polymarket Hack
Decentralized prediction market Polymarket confirmed a security incident in which approximately $3 million was stolen after hackers compromised a...
- News
Clean GitHub Repo Tricks AI Coding Agents Into Running Malware
Researchers demonstrate how a seemingly clean, scanner-safe GitHub repository can silently execute a malicious payload when an AI coding agent clones and...
- News
Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk
Rising third-party breach incidents are forcing schools and universities to play defense as ransomware gangs and supply chain attackers increasingly...
- News
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
The Miasma supply chain malware family — an evolution of Mini Shai-Hulud and linked to the Hades worm — has compromised hundreds of npm packages, abused...
- News
More Klue Breach Victims Identified as Hackers Get Hacked
Roughly two dozen companies have notified their customers of impact from the Klue-Salesforce breach incident — a cascade that now includes the hackers...
- News
More Malicious OpenClaw Skills Threaten AI Supply Chain
Unit 42 researchers identified five persistent malicious skill packages on ClawHub — OpenClaw's AI agent marketplace — including infostealers disguised as...
- News
Three 'Cybercrime-as-a-Service' Operations Undercut by Microsoft and Law Enforcement
A two-week joint operation by Microsoft and Europol dismantled three major malware-as-a-service platforms — StealC, Amadey, and SocGholish — seizing 326...
- News
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Novee Security researchers have identified a critical exploitable CI/CD workflow pattern dubbed Cordyceps that enables attackers to hijack GitHub Actions...
- News
Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
Security researchers have disclosed a class of exploitable flaws in CI/CD pipeline configurations that allow unauthenticated attackers to take full...
- News
FFmpeg PixelSmash: CVE-2026-8461 Enables RCE via Crafted Video Files Across Thousands of Apps
A heap out-of-bounds write in FFmpeg's MagicYUV decoder — CVE-2026-8461, CVSS 8.8 — lets attackers execute shell commands by delivering a 50 KB video...
- News
Tata Electronics Confirms Cyberattack; World Leaks Exposes Apple Manufacturing IP
World Leaks — the rebranded extortion wing of the defunct Hunters International ransomware group — has leaked Apple manufacturing data stolen from Tata...
- News
Microsoft and Europol Dismantle Three Cybercrime-as-a-Service Operations
Microsoft and Europol jointly targeted the full CaaS supply chain, seizing 300+ servers and disrupting SocGholish, Amadey, and StealC malware infrastructure.
- News
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub released actions/checkout v7 on June 18, 2026, adding default protections that refuse to fetch fork PR code inside pull_request_target workflows —...
- News
LastPass Confirms Data Breach in Klue Supply Chain Attack
The Icarus extortion group compromised Klue, an AI-powered competitive intelligence platform, harvesting OAuth tokens to drain CRM data from hundreds of...
- News
Scope of Salesforce Attacks Expands as Icarus Leaks Stolen Data
More victims have surfaced after attackers breached application vendor Klue and abused its OAuth tokens to access customers' Salesforce environments. The...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, with attackers injecting backdoor code into Pro plugin releases...
- News
Texas Parks & Wildlife Data Breach Affects 3 Million Individuals
Hackers stole personal information including driver's license and passport numbers after breaching a third-party license vendor serving the Texas Parks...
- News
Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers
Microsoft has attributed a 88-minute automated supply chain attack against 142 Mastra AI npm packages — with over 1.1 million combined weekly downloads —...
- News
Nintendo Confirms Employee Data Stolen in TinyPulse Cyberattack by Shadowbyt3$
Nintendo of America has confirmed that approximately 1GB of employee data — including W-9 forms, bank statements, and HR survey responses — was...
- News
How Software Development's Speed Obsession Enabled TeamPCP's Chaos Crusade
TeamPCP's remarkable success attacking open-source software was no accident — it exploited a cultural vulnerability baked into modern development: the...
- News
Cybersecurity Firms Impacted by Klue Supply Chain Attack
The hackers exfiltrated data from Salesforce instances of Klue customers, including Huntress and Recorded Future, in a cascading supply chain compromise.
- News
Klue OAuth Breach Victim List Grows as Icarus Hackers Claim Attack
Market intelligence platform Klue has confirmed attackers stole OAuth tokens connected to customers' Salesforce environments, as the Icarus extortion...
- News
Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Salesforce has disabled the Klue Battlecards app integration following a security incident in which attackers abused OAuth tokens to access customer CRM...
- News
Novo Nordisk Breach Exposes Software Development Pipeline Risk
A leaked GitHub token at Novo Nordisk has exposed a fundamental flaw in how organizations approach secrets management — treating it as a tooling problem...
- News
Salesforce Data Thefts Continue via Klue App Compromise
Klue's Battlecards competitive intelligence application has become the third integrated app compromised in the ongoing Icarus campaign targeting...
- News
ShapedPlugin Update Flow Hacked to Infect WordPress Sites
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the...
- News
144 Mastra npm Packages Compromised via Hijacked Contributor Account
A supply chain attack dubbed easy-day-js has compromised 144 npm packages in the @mastra/* namespace by hijacking a contributor account for the popular...
- News
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats
Researchers have uncovered a coordinated malware campaign involving 15 malicious JetBrains Marketplace plugins posing as DeepSeek-powered AI coding...
- News
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud
The latest supply chain attacks against PyPI, which hit 37 wheels and 19 code packages, show a continued evolution of the persistent Shai-Hulud software...
- News
Rust-Written IronWorm Hits NPM Supply Chain
IronWorm, a self-propagating supply chain worm written in Rust, is targeting npm developers to steal credentials and reuse them to spread across the...
- News
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Sygnia researchers uncovered Velvet Ant, a China-nexus APT that spent close to a decade hidden inside Linux authentication infrastructure by backdooring...
- News
NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
NPM 12 will disable dependency install scripts by default, requiring explicit opt-in—a major shift targeting the supply chain attack vector exploited...
- Security
CVE-2026-44488: Axios Fetch Adapter Ignores Configured Request and Response Size Limits
Axios versions 1.7.0 through 1.15.x fail to enforce maxContentLength and maxBodyLength when using the fetch adapter, allowing unbounded request and...
- News
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub has announced that npm version 12 will disable install scripts by default as a breaking change aimed at combating software supply chain attacks...
- News
ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories
This week's threat intelligence roundup covers a supply chain attack kit posted publicly, a $5,000-per-month RAT that clones browser sessions, AI agents...
- News
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS
Six critical flaws in protobuf.js — the JavaScript/TypeScript Protocol Buffers library — can lead to remote code execution and denial-of-service in...
- News
The Miasma Worm Source Code Briefly Leaked on GitHub
The Miasma credential-stealing worm framework was briefly open-sourced on GitHub before removal, potentially enabling copycat attacks against open-source...
- News
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Microsoft's GitHub presence has become the latest target of the self-replicating Miasma supply chain worm, with 73 repositories across Azure, Azure-Samples…
- News
Hola Browser for Windows Compromised to Deliver Cryptominer
The Windows version of the Hola Browser has been hit by a supply chain attack that bundled a cryptocurrency miner with the official installer, silently…
- News
IronWorm and New Miasma Worm Variant Hit npm in Coordinated Supply Chain Attacks
Two distinct malware campaigns have hit the npm ecosystem simultaneously — IronWorm deploys a Rust-based infostealer via 50+ poisoned packages, while a new…
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new Mini Shai-Hulud supply chain campaign codenamed Miasma has compromised Red Hat's @redhat-cloud-services npm packages, deploying a self-propagating…
- News
OpenAI Codex Authentication Tokens Stolen via codexui-android npm Supply Chain Attack
Cybersecurity researchers have uncovered a malicious npm package named codexui-android that targets developers using OpenAI Codex by masquerading as a…
- News
As Global Powers Explore Humanoid Robots, Cyber-Risk Looms
Nation-states are racing to dominate the embodied AI and humanoid robotics market, but as governments and militaries integrate these systems, the…
- News
In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks
Noteworthy cybersecurity stories from the week: Trump Mobile exposes customer data, phishers target 2026 FIFA World Cup fans, and CISA responds to recent...
- News
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under "Project Lightwell"
IBM and Red Hat unveil Project Lightwell, a $5B commitment to securing open-source supply chains by fixing vulnerabilities without breaking production.
- News
CrowdStrike Dismantles Glassworm Botnet Targeting Open-Source Supply Chain
CrowdStrike, Google, and Shadowserver dismantled the Glassworm botnet, stripping operators of infrastructure used to inject malware into OSS packages.
- News
GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure
CrowdStrike, Google, and Shadowserver simultaneously disrupted GlassWorm C2 channels, ending a supply-chain campaign targeting developers via packages.
- Security
CVE-2026-44444: Lumiverse AI Plugin Install Scripts Enable RCE (CVSS 9.1)
Critical Lumiverse <0.9.7 flaw lets malicious extensions execute arbitrary code via package.json lifecycle scripts run by the Spindle build pipeline.
- Security
CVE-2026-48027: Nx Console Embedded Malicious Code — CISA KEV
CISA adds CVE-2026-48027 to KEV after a malicious Nx Console VS Code extension was found harvesting credentials from disk and memory via obfuscation.
- News
The Hackers Behind Shai-Hulud: Lucky or Skilled?
TeamPCP's Shai-Hulud worm inflicted serious damage on the open source ecosystem — but a close look at their operations raises the question of whether their.
- Newsletter
May 26 Digest: SharePoint RCE, Megalodon CI/CD Blitz
Microsoft patches a CVSS 8.8 SharePoint RCE; the Megalodon campaign poisons 5,561 GitHub repos in six hours; 7-Eleven's ShinyHunters breach hits 185,000; and a.
- News
TrapDoor Supply Chain Attack Spreads Credential-Stealing
A coordinated cross-ecosystem supply chain attack campaign dubbed TrapDoor has compromised 34 packages across 384+ versions on npm, PyPI, and Crates.io.
- News
Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets
This week's security roundup covers Linux privilege escalation zero-days, actively exploited Windows Defender vulnerabilities, router botnets hijacking DNS.
- News
Megalodon GitHub Attack Targets 5,561 Repos with Malicious
Cybersecurity researchers have uncovered Megalodon, an automated attack campaign that pushed 5,718 malicious commits to over 5,500 GitHub repositories in...
- News
Grafana Says Codebase and Other Data Stolen via TanStack
Grafana confirmed attackers stole internal source code and data after a GitHub token compromised in the TanStack npm supply chain attack was never...
- News
Laravel Lang Packages Hijacked to Deploy
A supply chain attack targeting Laravel Lang localization packages has exposed developers to credential-stealing malware after attackers abused GitHub...
- News
Laravel-Lang PHP Packages Compromised to Deliver
Multiple PHP packages belonging to the Laravel-Lang organization have been poisoned in a software supply chain attack, delivering a cross-platform...
- News
npm Adds 2FA-Gated Publishing and Package Install Controls
GitHub has rolled out new security controls for npm including staged publishing with 2FA approval requirements and package install policies, giving...
- News
Packagist Supply Chain Attack Infects 8 Packages Using
A coordinated supply chain attack campaign has infected eight Packagist Composer packages with malicious code that downloads and executes a Linux binary...
- News
GitHub Links Repo Breach to TanStack npm Supply-Chain Attack
GitHub has confirmed that hackers who stole 3,800 internal repositories gained access through a malicious version of the Nx Console VS Code extension...
- News
Socket Raises $60 Million at $1 Billion Valuation
Supply chain security startup Socket has raised $60 million in a new funding round, valuing the company at $1 billion. The capital will expand Socket's...
- News
GitHub Breached — Employee Device Hack Led to Exfiltration
GitHub is investigating unauthorized access to thousands of internal repositories after an employee device was compromised through the TanStack npm supply...
- News
GitHub Confirms Being Hacked by TeamPCP, Says Customer Data
GitHub has officially confirmed it was breached by the TeamPCP threat actor after the group advertised stolen internal source code on a cybercrime forum....
- News
GitHub Confirms Breach, 4K Internal Repos Stolen
GitHub has confirmed a data breach in which the TeamPCP threat actor stole approximately 4,000 internal repositories. The company states no customer data...
- News
GitHub Investigating TeamPCP Claimed Breach of ~4,000
GitHub is investigating unauthorized access to its internal repositories after the TeamPCP threat actor listed approximately 4,000 GitHub internal repos...
- News
Grafana Breach Caused by Missed Token Rotation After
Grafana Labs has revealed that its May 2026 source code breach was caused by a single GitHub workflow token that was inadvertently missed during the token...
- News
Grafana GitHub Breach Exposes Source Code via TanStack npm
Grafana Labs confirms its GitHub environment was breached through the TanStack npm supply chain attack, exposing public and private source code...
- Newsletter
May 20 Digest: Exchange Zero-Day, Verizon DBIR, GitHub
A Microsoft Exchange zero-day is being exploited with no patch in sight; Verizon DBIR 2026 marks a landmark shift — vulnerability exploitation now...
- News
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
Cybersecurity researchers have discovered a fresh Mini Shai-Hulud supply chain attack compromising the @antv npm ecosystem through a hijacked maintainer...
- News
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Threat actors have compromised the widely-used actions-cool/issues-helper GitHub Action, redirecting every existing tag to a malicious imposter commit...
- Security
CVE-2026-8838 — Amazon Redshift Python Driver RCE via Unsafe Code Execution
The Amazon Redshift Python driver before version 2.1.14 contains a critical vulnerability where the vector_in() function executes arbitrary code received...
- HOWTO
Why Your Accountant is a Ransomware Target
Small accounting firms in rural Alberta have become primary ransomware targets in 2025–2026. The reasons are structural: high-value data, weak security…
- News
Developer Workstations Are Now Part of the Software Supply
Supply chain attackers are no longer just targeting repositories and CI/CD pipelines — they're going after the developer workstations that hold the keys...
- News
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware
Researchers have uncovered four malicious npm packages embedding infostealer malware and a Phantom Bot DDoS payload — one of which is a direct clone of...
- News
Grafana Confirms Breach After Hackers Claim They Stole Data
Grafana has confirmed a security breach after the Coinbase Cartel cybercrime group — linked to ShinyHunters, Scattered Spider, and Lapsus$ — claimed to...
- News
Grafana Says Stolen GitHub Token Let Hackers Steal Codebase
Grafana Labs confirmed that hackers downloaded its source code after breaching its GitHub environment using a stolen access token. The attackers attempted...
- News
Shai-Hulud Worm Clones Spread After Code Release
The public release of the Shai-Hulud worm source code by TeamPCP has triggered a wave of copycat variants appearing across the npm ecosystem. Security...
- News
Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco
This week's cybersecurity landscape opened with a critical Microsoft Exchange spoofing zero-day under active exploitation, a coordinated npm/PyPI supply...
- News
Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt
Grafana has disclosed that an unauthorized party obtained a GitHub access token, used it to download the company's entire codebase, and then attempted...
- News
Living Off the Pipeline: Defending Against CI/CD Subversion
Adversaries are increasingly weaponizing CI/CD pipelines as a living-off-the-land vector — abusing trusted build infrastructure to execute attacks without...
- News
SecurityScorecard Acquires Driftnet to Boost Third-Party
SecurityScorecard has acquired Driftnet to expand visibility into third-party ecosystems, addressing growing supply chain attack risks that continue to...
- News
Funnel Builder Flaw Under Active Exploitation Enables
Attackers are actively exploiting a critical vulnerability in the Funnel Builder WordPress plugin to inject malicious JavaScript into WooCommerce checkout...
- Security
DAEMON Tools Lite Supply Chain Attack via Trojanized
A supply chain attack compromised official DAEMON Tools Lite installation packages distributed from daemon-tools.cc between April 8 and May 5, 2026,...
- News
Popular node-ipc npm Package Compromised to Steal
Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication npm package, in a new...
- News
TanStack Supply Chain Attack Hits Two OpenAI Employee
OpenAI has disclosed that two corporate employee devices were compromised via the Mini Shai-Hulud supply chain attack on the TanStack npm ecosystem,...
- News
TeamPCP Hackers Advertise Mistral AI Source Code Repos for Sale
The TeamPCP threat group claims to have stolen source code repositories from Mistral AI and is advertising them for sale on criminal forums, threatening...
- News
TeamPCP Ups the Game, Releases Shai-Hulud Worm's Source Code
The hacking group TeamPCP has publicly released the source code for its Shai-Hulud supply chain worm, actively encouraging other threat actors to...
- News
OpenAI Asks macOS Users to Update After TanStack npm Supply
OpenAI is urging macOS users to update their software following an expanding supply chain attack that compromised TanStack and additional npm and PyPI...
- News
OpenAI Confirms Security Breach in TanStack Supply Chain
OpenAI confirmed that two employees' devices were compromised during the TanStack supply chain attack, which hit hundreds of npm and PyPI packages. The...
- News
ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI
This week's threat roundup covers an actively exploited PAN-OS RCE granting root access, Anthropic's Mythos AI finding a cURL memory safety bug, AI...
- Security
CVE-2026-44246: nnU-Net Agentic Workflow Injection via GitHub Actions Issue Triage
A high-severity agentic workflow injection vulnerability in nnU-Net's GitHub Actions issue triage workflow allows attackers to inject and execute...
- News
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI
TeamPCP has expanded its supply chain attack campaign with a fresh Mini Shai-Hulud worm that compromised npm and PyPI packages from TanStack, UiPath,...
- News
Worm Redux: Fresh Mini Shai-Hulud Infections Bite npm
Hundreds of npm packages in the TanStack open source ecosystem have been infected by a fresh wave of Mini Shai-Hulud worm activity from TeamPCP — the same...
- Newsletter
May 12 Digest: AI-Generated Zero-Day, Shai-Hulud Worm
Google confirms the first AI-generated zero-day in the wild; TeamPCP's Mini Shai-Hulud worm hits TanStack, Mistral AI, and Guardrails AI; Instructure pays...
- News
Build Application Firewalls Aim to Stop the Next Supply
A new class of security tooling called Build Application Firewalls inspects runtime behavior inside software build pipelines rather than just scanning...
- News
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks
Supply chain threat actor TeamPCP has struck again, publishing a tampered version of the Checkmarx Jenkins AST plugin to the Jenkins Marketplace — just...
- News
Quasar Linux RAT Steals Developer Credentials for Software
A newly discovered Linux implant called Quasar Linux RAT (QLNX) is silently targeting software developers to harvest credentials, log keystrokes, and...
- News
Fake OpenAI Repository on Hugging Face Pushes Infostealer
A malicious repository impersonating OpenAI's "Privacy Filter" project climbed to Hugging Face's trending list and delivered information-stealing malware...
- News
JDownloader Site Hacked to Replace Installers with Python
The official website for JDownloader, one of the most widely-used open-source download managers, was compromised to distribute malicious Windows and Linux...
- News
Trellix Source Code Breach Highlights Growing Supply Chain
Trellix, the enterprise security vendor formed from the merger of McAfee Enterprise and FireEye, has suffered a source code breach claimed by the...
- Security
CVE-2026-41500: electerm macOS Command Injection via Install Script
A critical command injection vulnerability in the electerm terminal client allows remote attackers to achieve unauthenticated code execution on macOS...
- Security
CVE-2026-41501: electerm Linux Command Injection via Install Script
A critical command injection flaw in electerm's Linux installer allows remote attackers to execute arbitrary shell commands by injecting into unsanitized...
- News
1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, and Intercom
The TeamPCP threat group's Mini Shai-Hulud supply chain campaign compromised SAP-related npm packages along with PyTorch Lightning and Intercom client...
- News
Cisco Releases Open Source Tool for AI Model Provenance
Cisco has released a new open source toolkit designed to track and verify the provenance of AI models throughout the supply chain, addressing risks from...
- News
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
A new supply chain attack campaign dubbed BufferZoneCorp has been observed using sleeper packages in RubyGems and Go module registries to push...
- Security
Apache MINA Incomplete Deserialization Patch Leaves 2.1.X
Apache MINA versions 2.1.X and 2.2.X remain vulnerable to unauthenticated remote code execution because the fix for CVE-2026-41409 was never backported,...
- News
Critical Gemini CLI Flaw Enabled Host Code Execution
A critical vulnerability in Google's Gemini CLI allowed an attacker to plant a malicious configuration file that executed commands outside the sandbox,...
- News
Google Fixes CVSS 10 Gemini CLI RCE and Cursor Flaws Enable
Google has patched a maximum severity vulnerability in its Gemini CLI npm package and GitHub Actions workflow that allowed unprivileged attackers to...
- News
PyTorch Lightning and Intercom-client Hit in Supply Chain
Threat actors compromised the popular Python PyPI package 'Lightning' — used for PyTorch model training — pushing malicious versions 2.6.2 and onward to...
- News
TeamPCP Hits SAP npm Packages With 'Mini Shai-Hulud' Supply
The threat actor TeamPCP has compromised multiple npm packages tied to SAP's cloud application development ecosystem in a new supply chain campaign dubbed...
- News
Critical GitHub Vulnerability Exposed Millions of Repositories
A critical remote code execution vulnerability, CVE-2026-3854, was found to impact GitHub.com and GitHub Enterprise Server, potentially exposing millions...
- News
GitHub Fixes RCE Flaw That Gave Access to Millions of Private Repos
GitHub has patched CVE-2026-3854, a critical remote code execution vulnerability exploitable via a single HTTP request that could have granted attackers...
- News
Learning from the Vercel Breach: Shadow AI and OAuth Sprawl
The Vercel breach, traced to a compromised third-party AI tool with OAuth access, illustrates how Shadow AI adoption and unchecked OAuth integrations are...
- News
SAP-Related npm Packages Compromised in Credential-Stealing
Security researchers have uncovered a coordinated supply chain attack campaign dubbed 'mini Shai-H' targeting SAP-related npm packages, injecting...
- News
Vect 2.0 Ransomware Acts as Wiper Thanks to Design Error
The emerging Vect 2.0 ransomware — deployed against TeamPCP supply chain attack victims — permanently destroys files larger than 131KB due to a critical...
- News
Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw
Cybersecurity researchers have disclosed a critical remote code execution vulnerability in GitHub.com and GitHub Enterprise Server that allows an...
- News
Video Service Vimeo Confirms Anodot Breach Exposed User Data
Vimeo has confirmed that customer and user data was accessed without authorization following a security breach at Anodot, a data anomaly detection...
- Security
CVE-2026-30352: Remote Code Execution in leonvanzyl
A critical remote code execution vulnerability in the /devserver/start endpoint of the leonvanzyl autocoder AI coding tool allows unauthenticated...
- News
Checkmarx Confirms GitHub Repository Data Posted on Dark
Checkmarx has confirmed that data from its GitHub repositories has been published on the dark web following an investigation into the March 23 supply...
- News
Weekly Recap: Fast16 Malware, XChat Launch, Federal
This week's cybersecurity roundup covers the discovery of pre-Stuxnet Fast16 malware targeting engineering software, the emergence of the XChat...
- News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain
The popular Bitwarden CLI password manager package @bitwarden/cli@2026.4.0 was compromised as part of an ongoing Checkmarx supply chain campaign, with...
- News
Hypersonic Supply Chain Attacks: One Solution That Didn't
SentinelOne details how its AI-driven behavioral detection stopped three zero-day supply chain attacks at machine speed — without prior knowledge of the...
- News
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse
This week's ThreatsDay Bulletin covers the $290M KelpDAO DeFi hack tied to Lazarus Group, new macOS living-off-the-land attack techniques, ProxySmart SIM...
- News
Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2
Zscaler ThreatLabz has uncovered a Tropic Trooper (APT23) campaign that delivers the AdaptixC2 post-exploitation beacon via trojanized SumatraPDF...
- Security
CVE-2026-6951: simple-git RCE via --config Option Bypass
A critical remote code execution vulnerability in the simple-git npm package allows attackers to inject arbitrary git config options via the --config...
- Security
Hackage Haskell Repository Stored XSS Enables Credential
A critical stored XSS vulnerability in hackage-server allows HTML and JavaScript files uploaded via source packages or documentation to execute in...
- News
Malicious KICS Docker Images and VS Code Extensions Hit
Threat actors hijacked the official checkmarx/kics Docker Hub repository by overwriting existing image tags — including v2.1.20 and alpine variants — and...
- News
Vercel Finds More Compromised Accounts in Context.ai-Linked
Vercel has expanded its breach investigation tied to the Context.ai supply chain compromise and identified additional customer accounts with unauthorized...
- News
Hypersonic Supply Chain Attacks: AI Defense Stops Zero-Days
SentinelOne's AI-driven behavioral defense stopped three recent zero-day supply chain attacks before any payload signatures existed — demonstrating how...
- News
New npm Supply Chain Attack Self-Spreads to Steal Developer
A newly discovered supply chain attack targeting the npm ecosystem steals developer authentication tokens and uses compromised accounts to publish...
- News
Cloud Platform Vercel Says Company Breached Through
Vercel has confirmed a security breach in which limited customer credentials were exposed after an employee's workstation was compromised through malware...
- News
No Exploit Needed: How Attackers Walk Through the Front
Stolen credentials remain the dominant initial access vector in 2026 — no zero-days, no malware, just valid logins that blend in with normal activity...
- News
Surge in Bomgar RMM Exploitation Demonstrates Supply Chain
A critical RCE flaw in BeyondTrust Bomgar remote monitoring and management software is being actively exploited to spread ransomware and compromise...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- News
Anthropic MCP Design Vulnerability Enables RCE, Threatening
Cybersecurity researchers have discovered a critical by-design weakness in the Model Context Protocol architecture that enables arbitrary command...
- News
Vercel Breach Tied to Context AI Hack Exposes Limited
Vercel's security breach originated from the compromise of Context.ai, a third-party AI tool used by a company employee, allowing attackers to gain...
- News
Vercel Employee's AI Tool Access Led to Data Breach
Stolen OAuth tokens from a compromised employee AI tool enabled attackers to pivot into Vercel's internal systems. Security researchers warn that...
- News
Vercel's Security Breach Started with Malware Disguised as
The Vercel security breach originated at Context.ai after an employee downloaded Lumma Stealer disguised as Roblox cheat software. The incident exposes...
- News
Why the Axios Attack Proves AI Is Mandatory for Supply
The North Korean supply chain attack on Axios — a JavaScript library with 100 million weekly downloads — highlights why human-scale monitoring can no...
- News
Analysis of 216M Security Findings Shows a 4x Increase in Critical Risk (2026 Report)
OX Security analyzed 216 million security findings across 250 organizations over 90 days and found critical risk grew by nearly 400% year-over-year, even...
- News
Critical Flaw in protobuf.js Library Enables JavaScript
A critical remote code execution vulnerability in protobuf.js, the widely used JavaScript implementation of Google's Protocol Buffers, has been disclosed...
- Security
CVE-2026-6443: WordPress Accordion Plugin Backdoor in Version 1.4.6
The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...
- News
Microsoft Suspends Dev Accounts for High-Profile Open
Microsoft has suspended developer accounts used to maintain several prominent open-source projects without prior notice or a quick reinstatement path,...
- News
Snowflake Customers Hit in Data Theft Attacks After SaaS
Over a dozen companies have suffered data theft attacks after a SaaS integration provider was breached and authentication tokens stolen, enabling...
- News
How LiteLLM Turned Developer Machines Into Credential
The TeamPCP threat actor's March 2026 supply chain attack against LiteLLM exposed a dangerous blind spot: developer workstations running local AI agents...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
Cybersecurity researchers discovered 36 malicious npm packages disguised as Strapi CMS plugins that abused Redis and PostgreSQL connections to harvest...
- News
EU Cyber Agency Attributes Major Data Breach to TeamPCP
ENISA has officially attributed the massive European Commission data breach — and a wider campaign affecting 30 EU institutions — to the TeamPCP hacking...
- News
European Commission Confirms Data Breach Linked to Trivy
The European Commission has confirmed a major data breach of its AWS environment, with over 300GB of data stolen — including personal information of EU...
- News
UNC1069 Social Engineering of Axios Maintainer Led to npm
The North Korean threat actor UNC1069 used a sophisticated, targeted social engineering campaign against the Axios npm package maintainer Jason Saayman to...
- News
Blast Radius of TeamPCP Attacks Expands Amid Hacker
As organizations disclose breaches tied to TeamPCP's supply chain attacks, ShinyHunters and Lapsus$ are taking credit and creating a murky attribution...
- News
Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain
The rebuilt Chainguard Factory platform adds deeper security automation designed to continuously reconcile open source artifacts across containers,...
- News
Claude Source Code Leak Highlights Big Supply Chain Missteps
The accidental exposure of Anthropic's Claude Code source code via an npm packaging error is the latest reminder that software supply chains need...
- News
The Good, the Bad and the Ugly in Cybersecurity – Week 14
SentinelOne intercepts a LiteLLM supply chain attack in real time, attackers weaponize the Axios npm package to deploy a cross-platform RAT, and a Chrome...
- News
Claude Code Leak Used to Push Infostealer Malware on GitHub
Threat actors are capitalising on the Claude Code source code leak by creating fake GitHub repositories that impersonate the leaked source to deliver...
- News
Mercor Confirms Security Incident Tied to LiteLLM Supply
AI hiring platform Mercor has confirmed a security incident linked to the LiteLLM PyPI supply chain attack carried out by TeamPCP. Separately, Lapsus$...
- News
Nissan Says Stolen Data Came from Third-Party Vendor After
A hacking group claimed to have breached the file-transfer system used by a company that provides services to Nissan and Infiniti dealerships across North...
- News
The State of Trusted Open Source Report: Key Findings for 2025
Chainguard's first-ever State of Trusted Open Source report reveals critical insights into open source consumption patterns across container images,...
- Security
CVE-2026-3502: TrueConf Client Update Integrity Bypass
TrueConf Client fails to verify the integrity of downloaded update payloads, allowing an attacker who can influence the update delivery path to substitute...
- News
Axios NPM Package Breached in North Korean Supply Chain
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored versions of the widely used...
- News
Claude Code Source Leaked via npm Packaging Error
Anthropic confirmed that internal source code for its Claude Code AI coding assistant was accidentally published to npm due to a human packaging error. No...
- News
Google Attributes Axios npm Supply Chain Attack to North
Google's Threat Intelligence Group has formally attributed the supply chain compromise of the popular Axios npm package to UNC1069, a financially...
- News
Hackers Exploit TrueConf Zero-Day to Push Malicious
Threat actors have weaponized an unpatched zero-day in TrueConf conference server software to execute arbitrary files on all connected endpoints,...
- Security
CVE-2025-15618: Perl Payment Module Uses Insecure
Business::OnlinePayment::StoredTransaction through version 0.01 for Perl generates its secret key using an MD5 hash of a single rand() call — a...
- News
Attack on Axios Developer Tool Threatens Widespread
Security researchers at multiple firms are sounding alarms over a supply chain attack against Axios, an npm package with 100 million weekly downloads....
- News
Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
Two newly published versions of the widely used Axios HTTP client library — v1.14.1 and v0.30.4 — were found to contain a malicious fake dependency that...
- News
Cisco Source Code Stolen in Trivy-Linked Dev Environment
Cisco has suffered a major cyberattack after threat actors leveraged stolen credentials from the recent Trivy supply chain compromise to breach its...
- Newsletter
Mar 31 Digest: Axios npm RAT, Claude Code Source Leaked
The Axios npm library was weaponized to deliver a cross-platform RAT; Anthropic accidentally leaked Claude Code's CLI source in an npm package; Google...
- Security
CVE-2026-4176: Perl Compress::Raw::Zlib Critical
Perl versions 5.9.4 through 5.43.8 ship a vulnerable Compress::Raw::Zlib core module that inherits CVE-2026-3381 from a vendored zlib dependency. CVSS 9.8...
- News
FCC Bans Import of Foreign-Made Consumer Routers Over
The FCC updated its Covered List on March 23, 2026, banning import of all new foreign-produced consumer routers, citing unacceptable risks to national...
- News
Backdoored Telnyx PyPI Package Pushes Malware Hidden in WAV
Threat actors known as TeamPCP compromised the Telnyx Python package on PyPI, uploading malicious versions that conceal credential-stealing malware inside...
- News
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides
The TeamPCP threat actor — behind previous supply chain attacks on Trivy, KICS, and litellm — has now compromised the telnyx Python package on PyPI,...
- Newsletter
Mar 26 Digest: LeakBase Admin Arrested, WebRTC Skimmer
This week: Russian authorities detain the alleged LeakBase admin weeks after the FBI-led global crackdown on the 147,000-subscriber stolen-data...
- News
Paid AI Accounts Are Now a Hot Underground Commodity
New research from Flare Systems reveals that premium AI platform access — including ChatGPT Plus, Claude Pro, and raw API keys — has been systematically...
- News
Supply Chain Attack Hits Widely-Used AI Package, Risking
Malicious versions of LiteLLM — a Python package with 3 million daily downloads present in roughly 36% of cloud environments — were quietly pushed to PyPI...
- Newsletter
Mar 25 Digest: DarkSword Leaks iPhone Zero-Days
This week: the DarkSword iOS exploit chain published on GitHub threatens to democratize nation-state-grade iPhone hacking; CanisterWorm turns the Trivy...
- News
Trivy Hack Spreads Infostealer via Docker, Triggers Worm
The Trivy supply chain attack has expanded dramatically beyond GitHub Actions: malicious Docker Hub images (versions 0.69.4–0.69.6) carry an infostealer,...
- News
Trivy Supply Chain Attack Targets CI/CD Secrets
The open-source Trivy security scanner was weaponized by threat actor TeamPCP in a supply chain attack that hijacked 75 release tags to deploy an...
- News
Weekly Recap: CI/CD Backdoor, FBI Buys Location Data
This week's cybersecurity roundup covers supply chain attacks hitting CI/CD pipelines, long-running IoT botnets finally disrupted, the FBI's warrantless...
- News
CanisterWorm: First Blockchain-Powered Self-Spreading Worm
A novel self-propagating malware dubbed CanisterWorm uses Internet Computer Protocol smart contracts as an untakedownable C2 channel, spreading...
- News
Trivy Vulnerability Scanner Breached to Push Infostealer
The Trivy open-source vulnerability scanner was compromised in a supply chain attack by the threat group TeamPCP, which hijacked 75 release tags and...
- News
Marquis Fintech Breach Exposes 672,000 Banking Customers
Plano-based fintech vendor Marquis disclosed that a ransomware attack exploiting a SonicWall firewall vulnerability compromised Social Security numbers,...
- News
New Speagle Malware Hijacks Cobra DocGuard for State-Sponsored Espionage
A newly discovered .NET infostealer dubbed Speagle repurposes compromised Cobra DocGuard servers for C2 and data exfiltration, targeting organizations...
- News
Eclypsium Raises $25 Million to Expand Device Supply Chain
Portland-based Eclypsium has secured $25 million in strategic funding led by PEAK6 Strategic Capital, bringing its total raised to $110 million. The...
- News
Trivy Security Scanner GitHub Actions Breached — 75 Tags
Trivy, Aqua Security's widely used open-source vulnerability scanner, was compromised a second time in a month. Attackers hijacked 75 GitHub Actions tags...
- Newsletter
Mar 17 Digest: GlassWorm Poisons Python, n8n RCE Hits KEV
This week: GlassWorm escalates with 72 malicious Open VSX extensions and a GitHub token force-push campaign poisoning hundreds of Python repos; CISA adds...
- News
GlassWorm ForceMemo: Stolen GitHub Tokens Used to Poison
The GlassWorm threat actor has launched a new sub-campaign called ForceMemo, using stolen GitHub tokens to silently force-push malware into hundreds of...
- News
Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach
This week's cybersecurity roundup covers the actively exploited Chrome zero-day CVE-2026-2441, the Aisuru router botnet record DDoS attack, a supply chain...
- News
AppsFlyer Web SDK Supply Chain Attack Spread
Attackers hijacked AppsFlyer's CDN domain via a registrar incident, serving a sophisticated 170 KB crypto-stealing JavaScript payload to every site...
- News
GlassWorm Escalates: 72 Malicious Open VSX Extensions Use
The GlassWorm self-propagating worm campaign has compromised 72 Open VSX extensions using invisible Unicode Private Use Area characters and a Solana...
- News
OpenClaw AI Agent Flaws Enable Prompt Injection, 1-Click
China's CNCERT has warned that OpenClaw (formerly Clawdbot/Moltbot), the viral self-hosted AI agent, carries over 250 disclosed vulnerabilities including...
- Security
Critical CORS + Path Traversal in TinaCMS CLI Dev Server
A critical CVSS 9.6 vulnerability in TinaCMS prior to 2.1.8 combines a permissive CORS policy with a path traversal flaw, enabling a remote attacker to...
- News
UNC6426 Weaponizes Old nx npm Compromise to Seize AWS Admin Access
Threat actor UNC6426 leveraged stolen credentials from last year's nx npm supply chain attack to achieve full AWS administrator access at a victim...
- Newsletter
Mar 11 Digest: npm Supply Chain Seizes AWS Admin, 3.4M
This week: UNC6426 weaponizes a stale npm supply chain compromise to seize full AWS admin in 72 hours, Cognizant TriZetto leaks 3.4 million patient...
- News
North Korea's UNC4899 Breached Crypto Firm via AirDropped
North Korean threat actor UNC4899 compromised a cryptocurrency organization after a developer AirDropped a trojanized archive from a personal device to a...
- News
Diesel Vortex: Russian Cybercrime Ring Steals 1,649
A Russian-linked phishing operation dubbed Diesel Vortex has stolen over 1,649 credentials from major freight and logistics companies across the US and...
- News
Japanese Semiconductor Giant Advantest Hit by Ransomware
Advantest Corporation, the world's leading manufacturer of semiconductor test equipment supplying companies like TSMC, Intel, and Samsung, disclosed a...
- News
Cline CLI Supply Chain Attack Installs Unauthorized
A compromised npm publish token was used to inject a malicious postinstall script into Cline CLI version 2.3.0 on February 17, 2026, silently installing...
- News
WEF Global Cybersecurity Outlook 2026 Warns of 'Permanent
The World Economic Forum's Global Cybersecurity Outlook 2026 warns of permanent instability driven by geopolitical tensions, supply chain dependencies,...
- News
Conduent Breach Balloons to Tens of Millions of Americans
The January 2025 ransomware attack on government technology giant Conduent continues to expand in scope, now confirmed to affect 15.4 million in Texas and...
- News
Notepad++ Supply Chain Attack Attributed to China-Linked
Notepad++ releases emergency v8.9.2 patch after a China-linked APT group hijacked the update mechanism for six months, deploying the Chrysalis backdoor to...
- News
Trojanized MCP Server Deploys StealC Infostealer Targeting
A SmartLoader campaign distributes a trojanized Model Context Protocol (MCP) server disguised as Oura Health's legitimate tool, deploying StealC...
- News
Lazarus Group Plants 192 Malicious Packages in npm and PyPI
North Korea's Lazarus Group is running a fake recruitment campaign codenamed Graphalgo, planting 192 malicious packages on npm and PyPI that target...
- News
BridgePay Payment Gateway Knocked Offline by Ransomware
Major U.S. payment processor BridgePay remains completely offline after a ransomware attack, forcing merchants nationwide to revert to cash-only operations.
- Security
Lotus Blossom APT Compromises Notepad++ Updates to Deploy
China-linked Lotus Blossom hijacked Notepad++ software updates for six months, selectively delivering the Chrysalis backdoor to government and IT targets...
- News
Tirith: New Open-Source Tool Blocks Homoglyph Attacks
A new cross-platform tool called Tirith hooks into terminal shells to detect and block Unicode homoglyph attacks, pipe-to-shell exploits, and supply chain...
- Security
Conduent Breach Expands: 15.4 Million Texans Affected, 8TB
Government technology provider Conduent's January 2025 ransomware breach now confirmed to affect at least 15.4 million people in Texas alone, with 8TB of...
- News
Nike Hit by Data Breach: 1.4 TB of Supply Chain Data Leaked
WorldLeaks extortion group claims responsibility for a data breach on Nike, allegedly exposing 1.4 terabytes of internal data including supply chain and...