Major Incidents or Breaches

  • Over 5,500 GitHub repositories were compromised in the ‘Megalodon’ supply chain attack, where malicious actors used fake automated commits to inject GitHub Actions workflows containing payloads designed to steal credentials, CI secrets, keys, and tokens [6].
  • A large-scale exploitation campaign is targeting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, enabling attackers to inject malicious JavaScript code and initiate ClickFix attack flows [2].

Newly Discovered Vulnerabilities

  • A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in the wild [2].
  • Wireshark 4.6.6 was released to address one vulnerability and fix 11 bugs [5].

Notable Threat Actor Activity

  • The TrapDoor campaign is conducting a coordinated cross-ecosystem software supply chain attack targeting npm, PyPI, and Crates.io to distribute credential-stealing malware [1].

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly leveraging supply chain vectors across multiple software ecosystems and developer platforms, as evidenced by the TrapDoor campaign affecting npm, PyPI, and Crates.io, as well as the Megalodon attack compromising thousands of GitHub repositories via malicious CI/CD workflows [1][6].

Sources#

  1. Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack - securityweek.com
  2. Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign - bleepingcomputer.com
  3. Wireshark 4.6.6 Released, (Sun, May 24th) - isc.sans.edu
  4. TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO - thehackernews.com