Cybersecurity Brief – 2026-05-25

Mon, 25 May 2026 00:00:00 +0000

Major Incidents or Breaches

Over 5,500 GitHub repositories were compromised in the ‘Megalodon’ supply chain attack, where malicious actors used fake automated commits to inject GitHub Actions workflows containing payloads designed to steal credentials, CI secrets, keys, and tokens ^[6].
A large-scale exploitation campaign is targeting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, enabling attackers to inject malicious JavaScript code and initiate ClickFix attack flows ^[2].

A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in the wild ^[2].
Wireshark 4.6.6 was released to address one vulnerability and fix 11 bugs ^[5].

The TrapDoor campaign is conducting a coordinated cross-ecosystem software supply chain attack targeting npm, PyPI, and Crates.io to distribute credential-stealing malware ^[1].

Attackers are increasingly leveraging supply chain vectors across multiple software ecosystems and developer platforms, as evidenced by the TrapDoor campaign affecting npm, PyPI, and Crates.io, as well as the Megalodon attack compromising thousands of GitHub repositories via malicious CI/CD workflows ^[1]^[6].