DanSec

Vendor

GitHub

In 95 briefs, most recently 6 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Coverage in DanSec Daily

  1. watchTowr details Barracuda ESG pre-auth root chain, Microsoft sees ARTEX used to steal GitHub OAuth secrets, and the US sanctions Prince Group affiliates.
  2. Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
  3. PHP2Shell RCE flaws exploited in the wild, Keystone destroys 18,835 hardware wallets after website hack, and ENGIE confirms customer data breach.
  4. Genesys data exposure, Quest Diagnostics patient-records breach and PHP2Shell RCE actively exploited against industrial vendors Siemens, Schneider Electric and …
  5. Quest Diagnostics patient data breach, Capcom's 11.7M-record exposure, and PHP2Shell RCE with no patch, plus Brotli and ArubaOS flaws.
  6. Capcom ID breach of 11.7M accounts, LiteLLM PyPI supply chain attack, and actively exploited Arista VeloCloud zero-day.
  7. ConnectWise cloud outage, ETS breach exposing millions of California student records, and OpenCode legacy breach exposing stored AI API keys.
  8. Covers the UK Legal Aid Agency and CenterPoint Energy breaches, Ivanti and Cisco zero-days under exploitation, and GhostAction compromising about 1,900 GitHub …
  9. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  10. Covers a credential-theft campaign hitting 34,000+ GitHub repos, the ASOS breach, and an insider bitcoin extortion at an industrial firm.
  11. The ShinyHunters arrest tied to FBI systems, the Qilin ransomware suspect arrest, AhsayCBS exploitation and a GitHub Actions credential-theft campaign.
  12. ASOS customer data theft, the FakeGit GitHub malware campaign with 17,000+ repos, and Flax Typhoon disruption by the FBI, plus new exploited flaws.
  13. Bitget $387.5M zero-day theft, Pentagon DMDC breach of 3M+ service members' records, and Zammad zero-day chain hitting DIVD, plus Citrix and Cisco exploitation.
  14. Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
  15. Citrix NetScaler zero-days under active exploitation, ShinyHunters abusing Oracle PeopleSoft CVE-2026-35273, and Microsoft SharePoint CVE-2026-65660 added to …
  16. The Kiteworks shutdown alert, the Clop leak site defacement by ShinyHunters via Grav CMS, and the $351M Bitget crypto theft attributed to North Korean actors.
  17. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  18. Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
  19. Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
  20. Coca-Cola's Fairlife data theft, Ernst & Young and Origin Energy breaches, and a FastJson zero-day exploited in the wild, plus Dysphoria botnet and Mirage …
  21. PEAR ransomware claims 3 TB breach of medical firm MCBS; scanning targets ESAFENET CDG 3 weak logins; GitHub and PyPI add time-based Dependabot protections.
  22. Origin Energy customer data leak, Upbound's $13M fraud losses, and Laundry Bear's Zimbra zero-day stealing email and 2FA codes.
  23. Everest ransomware hits Stadler Rail, Upbound's $13M Acima lease fraud, and a Check Point SmartConsole zero-day exploited in the wild.
  24. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  25. Hugging Face breach by an autonomous AI agent, Estée Lauder and EY data breaches, and actively exploited ServiceNow and SonicWall zero-days.
  26. SonicWall SMA 1000 zero-days, Microsoft's record 622-flaw Patch Tuesday and nearly 300 fake GitHub infostealer repos.
  27. Microsoft ties Salesforce intrusions to ShinyHunters; Nihon Kotsu cyberattack and Lidl breach also covered, plus Russian state hacker sanctions and router …
  28. Jscrambler package compromised with infostealer; Ghostcommit hides prompt injection in PNGs to fool AI code reviewers; 15-year-old Linux kernel root flaw found.
  29. KDDI breach hits 12M people, AssuranceAmerica exposes 6.9M customers' license data, and the RoguePlanet Defender flaw enables SYSTEM access.
  30. Accenture breach, Ohio county extortion payment, GhostLock Linux kernel root flaw, and actively exploited Adobe ColdFusion and Gitea vulnerabilities.
  31. Russian intelligence credential theft targeting Ukrainian messaging users, LastPass repeat breach, and DCloud Uni-App abused for 200,000+ scam sites.
  32. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  33. Operation Endgame disrupts Amadey botnet and Stealc infostealer; Cisco Catalyst SD-WAN zero-day exploited for two months; Chrome 149 patches 18 flaws.
  34. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  35. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  36. ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
  37. The Check Point VPN zero-day exploited by Qilin, the NSO Group WhatsApp spear-phishing campaign, and a SoFi subsidiary breach affecting customer data.
  38. ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
  39. Covers the IMA Diligence breach affecting 525,000 people, Acer Wave 7 mesh router zero-days, and a Microsoft 365 Android token-theft flaw.
  40. WeedHack malware infected 116,000+ Minecraft systems, Red Hat NPM packages hit by credential-stealing worm, and Gamaredon exploits WinRAR in Ukraine attacks.
  41. Charter Communications and 7-Eleven breaches by ShinyHunters, a 5,500-repo GitHub compromise via Megalodon malware, and a SharePoint zero-day patch from …
  42. 7-Eleven breach by ShinyHunters, Ghost CMS CVE-2026-26980 exploited for ClickFix attacks on 700+ sites, and TeamPCP supply chain campaign reaching GitHub.
  43. Megalodon attack compromises 5,500+ GitHub repos; Ghost CMS SQL injection CVE-2026-26980 actively exploited; TrapDoor hits npm, PyPI, Crates.io.
  44. Supply chain attacks on Packagist and Laravel-Lang PHP packages abusing GitHub releases, Anthropic's Project Glasswing finding 10,000+ flaws, and the …
  45. Cloud Atlas and Ghostwriter espionage, Megalodon GitHub commit campaign, and First VPN takedown, plus actively exploited LiteSpeed cPanel and Drupal flaws.
  46. Kimwolf botmaster arrested, GitHub breach via malicious VS Code extension, and Grafana repo theft via TanStack supply chain attack.
  47. GitHub breach via a compromised Nx Console extension, Microsoft's takedown of the Fox Tempest malware-signing service, and SonicWall SSL-VPN MFA bypasses in …
  48. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  49. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  50. The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
  51. The Vimeo breach via Anodot, LAPSUS$ leaking Checkmarx data, and the critical GitHub RCE flaw CVE-2026-3854.
  52. ADT breach by ShinyHunters, UK Biobank medical data sold on Alibaba, and a Cisco Firepower Firestarter backdoor compromise.
  53. Basic-Fit and Booking.com breaches, Adobe zero-day CVE-2026-34621, CPUID trojanized installers, and APT41 cloud credential theft.
  54. Wynn Resorts breach affecting 21,000 employees, Drift Protocol's $280M in-person crypto heist, and Flowise and FortiClient EMS exploits.
  55. The EU Commission cloud breach by TeamPCP, the $280M Drift Protocol heist by North Korean actors, and Stryker's data-wiping attack.
  56. Axios npm supply chain backdoor by North Korean actors, TrueConf zero-day abused via malicious updates, and 2.3M Android devices infected by NoVoice malware.
  57. Citrix NetScaler CVE-2026-3055 exploited, ShinyHunters claims 350GB European Commission theft, and Iranian hackers breach FBI director Kash Patel's personal …
  58. Covers the European Commission's Amazon cloud breach, the hack of FBI Director Kash Patel's email, and TeamPCP's Telnyx PyPI supply chain attack.
  59. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  60. Infinite Campus and HackerOne breaches, TeamPCP's LiteLLM PyPI supply chain attack, and malvertising abusing a Huawei driver to kill EDR.
  61. The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
  62. The Intuitive phishing breach, GlassWorm supply-chain malware hitting 400+ repos, and Sears exposing AI chatbot conversations to the public web.
  63. The Stryker Microsoft environment wiper attack, GlassWorm hitting Python repos, and Vidar delivered via hacked WordPress sites.
  64. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  65. Velvet Tempest deploys Termite ransomware via ClickFix; 100+ GitHub repos spread BoryptGrab stealer; Leakbase cybercrime forum dismantled by police.
  66. The TriZetto patient data breach, Transport for London breach, Iranian APT intrusions into US firms, and CISA's mandated iOS patching after Coruna exploit kit …
  67. ShinyHunters breaches at Wynn Resorts and CarGurus, a worm-like Sandworm_Mode npm supply chain attack, and Reddit's £14.47M UK fine.
  68. Spain's Ministry of Science IT outage, Conpet ransomware attack tied to Qilin, and Substack breach.
  69. The Trust Wallet Chrome extension theft, Ivanti EPMM zero-day attacks, and the DarkSpectre browser extension campaign hitting 2.2 million users.
  70. The French postal service cyberattack, the Nissan and Red Hat GitLab data exposure, and the Baker University breach affecting 53,000 people.
  71. Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
  72. The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
  73. The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
  74. Oracle EBS Cl0p extortion hits nearly 30 firms incl. Logitech and Washington Post; CBO confirms breach; Konni abuses Google Find Hub.
  75. Ribbon Communications nation-state breach, Conduent 10.5M-record ransomware-claimed breach, and China-linked VMware Tools zero-day exploitation.
  76. Dentsu/Merkle breach, Canadian water and energy hacktivist intrusions, and DELMIA Apriso and XWiki exploitation, plus TEE.fail and PhantomRaven.
  77. Oracle EBS zero-day exploited by CL0P, SonicWall cloud backup breach exposing firewall configs, and Discord ID photo leak of 70,000 users.
  78. Boyd Gaming breach, GeoServer flaw (CVE-2024-36401) hitting a US federal agency, and RTX ransomware disrupting European airports via Collins Aerospace.
  79. Boyd Gaming data breach, Jaguar Land Rover production shutdown, and fake Malwarebytes and LastPass installers on GitHub targeting Mac users.
  80. Ransomware disrupting European airport check-ins including Heathrow, the Stellantis Salesforce data breach, and a CVSS 10 GoAnywhere MFT flaw.
  81. Covers FBI alert on UNC6040/UNC6395 Salesforce data theft and extortion, GitHub Pages SEO-poisoning malware, and the VoidProxy phishing-as-a-service platform.
  82. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  83. The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.
  84. S1ngularity NPM attack hits 2,180 GitHub accounts; SVG phishing mimics Colombia's judiciary; Noisy Bear targets Kazakh energy sector.
  85. Inotiv ransomware, Intel and Workhorse Software data exposures, password manager clickjacking flaws, Apple's CVE-2025-43300 zero-day, and RapperBot botnet …
  86. Allianz Life Salesforce breach exposes 1.1M records, Play ransomware exploits Windows CLFS, and ActiveMQ attackers deploy DripDropper malware.
  87. Saint Paul city cyberattack prompting National Guard activation, Aeroflot flight cancellations, and Allianz Life breach hitting 1.4M US customers.
  88. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  89. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.
  90. Iran state TV hack, $11M BitoPro crypto theft by Lazarus Group, Aflac breach tied to Scattered Spider, and record 7.3 Tbps DDoS attack.
  91. Episource breach hits 5.4M US patients, Predatory Sparrow drains $90M from Iran's Nobitex, and Water Curse hijacks 76 GitHub accounts.
  92. The Washington Post journalist email breach, Zoomcar's 8.4M-user data breach, and Scattered Spider's pivot to U.S. insurers.
  93. Play ransomware breached about 900 organizations, Lee Enterprises disclosed a breach of ~40,000 people, and Cisco ISE CVE-2025-20120 auth bypass patched.
  94. Langflow and Samsung MagicINFO RCE exploitation, GeoVision devices feeding Mirai botnets, and the UK Legal Aid Agency incident.
  95. Harrods cyberattack amid UK retail spree, Commvault zero-day CVE-2025-3928 breach, and NullBulge's Disney Slack data theft guilty plea.