Major Incidents or Breaches

  • GitHub confirmed a breach involving the exfiltration of over 3,800 internal repositories. The breach was traced to a compromised employee device, which had installed a malicious version of the Nx Console Visual Studio Code extension. This extension was compromised during the recent TanStack npm supply-chain attack. The threat actor TeamPCP has claimed responsibility. The breach also impacted other organisations, such as Grafana, which failed to rotate a GitHub workflow token after the TanStack incident, leading to further compromise[4][10][13][16][21].
  • Microsoft disrupted a malware-signing-as-a-service operation, known as Fox Tempest, which weaponised Microsoft’s Artifact Signing system to deliver malicious code and facilitate ransomware campaigns. The service enabled threat actors to sign malware with fraudulent Microsoft-issued certificates to evade security controls[7][42].
  • Hackers bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances due to incomplete patching, brute-forcing VPN credentials and deploying tools used in ransomware attacks[15].
  • The Ukrainian cyberpolice, in cooperation with US authorities, identified an infostealer operator responsible for compromising 28,000 accounts via malware targeting an online service[14].
  • Grafana suffered a data breach stemming from a missed token rotation following the TanStack npm supply-chain attack, underscoring the ongoing risks in the software supply chain[16].

Newly Discovered Vulnerabilities

  • A critical vulnerability in Drupal Core affecting PostgreSQL-backed sites may allow remote code execution, privilege escalation, or information disclosure. Security updates have been released, and there is a high risk of rapid exploitation[5][18].
  • A 9-year-old Linux kernel flaw (CVE-2026-46333) was disclosed, enabling root command execution on major Linux distributions[3].
  • A newly patched privilege escalation vulnerability in Arch Linux, dubbed PinTheft, now has a public proof-of-concept exploit, allowing local attackers to gain root privileges[19].
  • A vulnerability in ExifTool (CVE-2026-3102) allows attackers to compromise macOS systems through malicious image files[1].
  • Microsoft Defender is affected by two zero-day vulnerabilities that have been exploited in active attacks, with security patches now rolling out[12].
  • Anthropic silently patched a vulnerability in the Claude code sandbox that could have been chained with prompt injection to exfiltrate data[37].
  • A critical command injection vulnerability in an OT Robot OS allows unauthenticated attackers to gain remote access and control of robotic systems[24].
  • Microsoft rolled out mitigations for the ‘YellowKey’ BitLocker bypass, addressing exploitation via the FsTx Auto Recovery Utility[34].
  • Firefox 151 update includes fixes for high-priority security vulnerabilities[43].

Notable Threat Actor Activity

  • China-aligned threat actor Webworm was observed deploying custom backdoors, EchoCreep and GraphWorm, leveraging Discord and Microsoft Graph API for command-and-control operations[8].
  • Over 320 npm packages in the @antv namespace were compromised in a fresh Mini Shai-Hulud supply-chain attack, using a hijacked maintainer account to publish malicious versions[38].

Trends, Tools, or Tactics of Interest

  • Typosquatting attacks are increasingly targeting the software supply chain, with AI-generated lookalike domains embedded in third-party scripts, making detection more difficult[11].
  • AI-powered app attacks are becoming faster, more frequent, and harder to stop, with attackers able to target new mobile apps within hours of release[35].
  • There is a rising industry focus on securing AI agents during development and production. Microsoft open-sourced RAMPART and Clarity to help developers test AI agent security, while 1Password partnered with OpenAI to implement a just-in-time credential model for AI coding agents, aiming to prevent persistent secret leakage[6][36][39].
  • The supply chain security crisis is intensifying, with an increasing number of vulnerabilities, shorter time-to-exploitation, and limited visibility into supply chain risks[32].
  • Zero Trust strategies are increasingly incorporating continuous device verification, as identity checks alone are insufficient to prevent attacks involving stolen session tokens and compromised devices[17].

Regulatory or Policy Developments Affecting the Security Industry

  • The EU is accelerating efforts to reduce reliance on US-based technology providers, with countries such as France moving to homegrown alternatives over platforms like Zoom and Microsoft Teams[27].
  • A bipartisan US legislative amendment proposes to end nationwide police license plate tracking by tying federal highway funding to the discontinuation of automated plate tracking programmes, except for toll collection[28].
  • A report found that opt-out forms used by data brokers and AI firms are often designed to confuse users and hinder effective data privacy choices[30].

Sources#

  1. GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension - thehackernews.com
  2. GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos - thehackernews.com
  3. GitHub links repo breach to TanStack npm supply-chain attack - bleepingcomputer.com
  4. Grafana breach caused by missed token rotation after TanStack attack - bleepingcomputer.com
  5. GitHub Confirms Breach, 4K Internal Repos Stolen - darkreading.com
  6. Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks - thehackernews.com
  7. Fake malware-signing service Fox Tempest dismantled by Microsoft - malwarebytes.com
  8. Hackers bypass SonicWall VPN MFA due to incomplete patching - bleepingcomputer.com
  9. Ukraine identifies infostealer operator tied to 28,000 stolen accounts - bleepingcomputer.com
  10. Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks - thehackernews.com
  11. Drupal critical update to fix bug with high exploitation risk - bleepingcomputer.com
  12. 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros - thehackernews.com
  13. Exploit released for new PinTheft Arch Linux root escalation flaw - bleepingcomputer.com
  14. How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) - securelist.com
  15. Microsoft warns of new Defender zero-days exploited in attacks - bleepingcomputer.com
  16. Anthropic Silently Patches Claude Code Sandbox Bypass - securityweek.com
  17. Patch Now: Critical Flaw in OT Robot OS Gives Attackers Control - darkreading.com
  18. Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass - securityweek.com
  19. Firefox 151 packs big privacy upgrades into a small update - malwarebytes.com
  20. Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API - thehackernews.com
  21. Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack - securityweek.com
  22. Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem - thehackernews.com
  23. AI-Powered App Attacks Are Faster, More Frequent and Harder to Stop - securityweek.com
  24. Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development - thehackernews.com
  25. 1Password Teams With OpenAI to Stop AI Coding Agents From Leaking Credentials - securityweek.com
  26. Caught Off Guard: Securing AI After It Hits Production - securityweek.com
  27. Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility - securityweek.com
  28. Identity Alone Isn't Enough: Why Device Security Has to Share the Load - bleepingcomputer.com
  29. The EU Is Going Through a Trump-Fueled Breakup With Big Tech - wired.com
  30. A Bipartisan Amendment Would End Police License Plate Tracking Nationwide - wired.com
  31. Data Brokers’ and AI Firms’ Opt-Out Forms Are Built to Fail, Report Finds - wired.com