60
60
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.
55
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More
60
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe
60
Week in review: Several companies affected by the Salesloft Drift breach, Sitecore 0-day vulnerability
60
60
60
60
Week in review: Zero-click flaw in Synology NAS devices, Google fixes exploited Android vulnerability
60
50
60
60
60
Week in review: Attackers use phishing emails to steal NTLM hashes, Patch Tuesday forecast
60
60
Week in review: Microsoft patches zero-day, Apple security updates, HashiCorp Vault vulnerability
60
60
60
60
60
60