GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Court rules Trump can blacklist Anthropic for refusing to enable Claude features
2 min
Tesla workers balk at training Optimus humanoid robots as replacements
2 min
Pentagon was right to slap Anthropic with a security supply chain risk label, federal court says
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
in the wild 6 min
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
6 sources 4 min
Kothamine malware uses Tailscale’s tailcat to evade network detection
in the wild 11 min1
Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
4 sources in the wild
Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges
2 sources 4 min
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
in the wild 15 min
Malicious npm packages evade install-script defenses at runtime
OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators
2 sources 2 min
Europe’s technology backbone is becoming a cyber target
5 min
Canva hacked via vendor’s Salesforce instance; Other customers affected as well
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
CVE-2026-82331: Apache BuildStream: tar source extraction escape
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
GitHub App keys can still enable takeovers long after they are forgotten
2 sources 4 min
Latest BGP hijack targets hosting software vendor
in the wild 8 min
Prismor: Open-source runtime control plane for AI agents
2 min
GitHub Actions leaking secrets when Miri output is cached
4 min
Fifty Years of Open Source Software Supply Chain Security
BigCommerce Data Stolen via Ribon Apps Hack
