Git patches six flaws, including code execution on recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
Stories per day · 30 days
25 RSS
Relatedgithub38credential-theft27litellm26backdoor25pypi25npm23infostealer19claude-code18connectwise17cursor17microsoft-36516cryptocurrency15github-actions14docker13ssh-backdoor12artex11storm-094010aomei9
552 stories, newest first · one card per story
Stories tagged #supply-chain
Unpinned MCP server launches can expose API keys, Corelight finds
Of 35 servers reviewed, 23 recommended installs pulled fresh registry dependencies; pinning the main package did not lock the rest.
French banking group hit by supply chain cyberattack
Crédit Mutuel Arkéa lost up to €118 million after attackers accessed internal accounts via a third-party provider and transferred funds, possibly to cryptocurrency.
1
Microsoft shows weight edits can hide backdoors in AI agents
Changing fewer than 10 dormant neurons can make a triggered agent run attacker code; Microsoft has not seen this used.
Finite State raises $27 million for device security platform
The Series C, led by The O.H.I.O. Fund, will fund international expansion and more autonomous firmware analysis.
1
Recorded Future says AI mostly accelerates familiar cyberattacks
Of 103 incidents, 32 used AI in malware or operations, including one Taiwan campaign with up to eight agents.
1
US officials push quantum manufacturing to hold lead over China
A quantum-primacy commission says China's factories and supply chains could erode US research and investment strengths.
Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
From October 14 to October 26, stolen Qubole AWS credentials let an attacker assume roles in dozens of customer accounts.
CISO Forum Virtual Summit 2026 runs November 10-11
The two-day virtual event for senior security leaders covers AI governance, identity, agents and supply chain.
Lazarus and DeceptiveDevelopment target drones and software supply chains
ESET says April–September 2026 activity used fake job offers, then spread malware through stolen developer accounts and public packages.
Datadog says high and critical cloud flaws quadrupled since May
Among monitored workloads, the median count rose from four in May to 16 in November, Datadog claims.
1
Hugging Face exec warns attacks may force open AI platforms to tighten access
Solaiman cited OpenCode API-key theft, an agent swarm on Hugging Face, and a Fireworks customer-data incident.
1
Ukraine's fiber-optic drones get squeezed by AI data center demand
BlueBird Tech says fiber prices rose about six to ten times as battlefield drones compete with data centers.
TeamPCP stole about 3,800 GitHub repos via poisoned developer tools
GitHub says customer-owned repositories were not accessed, but some stolen internal repos held customer support excerpts.
Malicious Ruby gem steals credentials and backdoors AI coding tools
strutil-core 1.0.1 was live about five hours; revoking a stolen GitHub token can wipe the home folder.
Freezer-control hacks disrupt about 700 French supermarkets
An October 11 attack forced long defrost cycles on Danfoss, Dixell and Copeland systems, causing millions of euros in damage.
1
LoRA subspace projection suppresses backdoors but does not erase them
Few-shot reactivation restored 91.7% to 100% attack success in one epoch for every weight-editing defense tested.
Malicious bee-js and Swarm Desktop releases steal node wallet keys
Stolen CI credentials published bee-js 13.3.0 and Swarm Desktop 0.56.2; both were withdrawn, and 0.56.3 is a clean rebuild.
GhostAction Targets GitHub Repositories for Credentials
Malicious workflows in 30,000+ GitHub repositories steal AWS, AI, and other keys by scanning commit history.
2
Threat bulletin covers library ransomware and exploited SonicWall, OpenSSH flaws
SonicOS SAML VPN bypass and OpenSSH before 10.6p2 are described as actively exploited; Android 14–17 RCE is also patched.
4
Attackers adopt ARTEX pentest framework within three months
WorkOS confirmed a test agent escaped isolation and retrieved customer data; named groups have used ARTEX in breaches.
1
Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
PolinRider loaders use a fixed Ethereum wallet to dynamically fetch payloads via dead drop, bypassing install hooks.
Fake GitHub security tools infect over 2,000 computers with malware
Doctor Web says Visual Studio and script repos drop AsyncRAT, a clipocurrency clipper, and a browser stealer.