Cybersecurity Brief – 2026-05-24

Major Incidents or Breaches

A coordinated supply chain attack has compromised eight packages on Packagist, infecting them with malicious code that executes a Linux binary retrieved from a GitHub Releases URL. This campaign targets developers using these packages and leverages GitHub as a distribution channel for the malware payload ^[2].
Multiple PHP packages belonging to the Laravel-Lang project were compromised to deliver a cross-platform credential-stealing malware. Attackers abused GitHub version tags to distribute the malicious payload, exposing developers to credential theft ^[4]^[5].

Newly Discovered Vulnerabilities

Anthropic’s Project Glasswing, using the Claude Mythos AI, has identified over 10,000 high- or critical-severity vulnerabilities in widely used and systemically important software projects ^[3].
A new vulnerability dubbed ‘Underminr’ affects approximately 88 million domains, allowing attackers to bypass DNS filtering and conceal malicious command-and-control connections behind trusted domains ^[10].

Notable Threat Actor Activity

The supply chain attacks on Packagist and Laravel-Lang PHP packages demonstrate ongoing threat actor focus on compromising open-source software repositories to deliver malware to unsuspecting developers ^[2]^[4]^[5].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting software supply chains by leveraging trusted platforms such as GitHub and Packagist to distribute malware, often using version tags and release automation to evade detection ^[2]^[4]^[5].
The use of AI-driven vulnerability discovery, exemplified by Anthropic’s Project Glasswing, is accelerating the identification of critical flaws in major software ecosystems ^[3].

Regulatory or Policy Developments Affecting the Security Industry

npm, operated by GitHub, has introduced new security controls including 2FA-gated publishing and explicit package install approvals to strengthen protections against supply chain attacks ^[1].