Cyber CrimeNewMalicious GitHub Repos Target Security Pros
Dr. Web says a two-year campaign now hides backdoors and infostealers in fake security tooling on GitHub, compromising over 2,000 Windows systems.
> Search
26 results for “supply-chain”
Cyber CrimeNew
SecurityAPT Retry Path Opens Root-Level Package Swap
A flaw in Debian and Ubuntu's package manager lets anyone who can tamper with downloads swap a verified package for one that runs as root.
Cyber CrimeKremlin-Linked Hackers Hit Phones via Watering Holes
Researchers say a suspected Russian group used fake mirror sites and an analytics supply-chain compromise to serve n-day iOS and Android exploits.
SecuritycPGuard update channel breached
OpsShield says attackers used stolen credentials to push a backdoor through cPGuard's autoupdate, affecting nearly 3,000 servers.
Cyber CrimePolymarket breach exposes supply-chain risk
A hijacked third-party script let attackers drain 726 Polymarket wallets, prompting about $3.9 million in refunds and a review of script trust.
Cyber CrimeGoogle's mole inside a hacking crew
Google's threat intelligence team says an undercover analyst spent months inside TeamPCP, watching a supply-chain spree from behind the scenes.
SecurityTrezor Breach Widens to 81K Customers
Trezor says a breach at shipping partner ShipMonk now affects 81,000 customers, a 479% jump from initial estimates.
SecurityUK food chain cyber risks on the rise
National Audit Office warns cyber-attacks threaten food supply, adding to costs and price inflation.
SecurityBGP hijack pushes malware via a 256-IP range
Attackers exploited routing and TLS flaws to abuse a hijacked /24 block in a 22-hour window.
SecurityArtifactory Flaw Exploited Within Days of Patch
Attackers are exploiting CVE-2026-82329, a critical Artifactory authentication bypass, to mint admin tokens.
SecurityTrojanized PHP Themes Target Unpatched iPhones
Researchers uncover 13 malicious Packagist packages that inject spyware into streaming sites, stealing crypto wallet seeds.
SecurityBGP hijack exposes Softaculous' missing update checks
A 33-hour BGP hijack hit Softaculous, serving malware via Virtualizor updates and prompting credential resets.
Cyber CrimeTeamPCP arrests expose supply chain risk
Alleged masterminds of TeamPCP, tied to Shai-Hulud worm, arrested in Perth with FBI help.
Cyber Crimenpm Mirrors Turned into Phishing Hosts
Attackers abuse npm mirrors to host HTML phishing pages, bypassing security filters by serving from legitimate domains.
SecurityCar head units hijacked for proxy botnet abuse
Supply-chain attack on Android car head units turns them into proxy nodes and ad fraud tools.
SecurityRubyGems Poisoned: Supply Chain Risk Beyond Typos
OpenSourceMalware finds 16 typosquatted RubyGems, but the real risk is package name reuse and unvalidated author fields.
SecurityWhy 2,500-Org Breach Wasn't What It Seemed
SOCRadar says most orgs hit in LiteLLM attack were earlier Trivy victims, not LiteLLM.
TrendingAI Watermark 'Removers' Multiply Despite Unverifiable Claims
A wave of tools claim to strip AI watermarks, but verification is impossible as Anthropic hasn't released details.
SecurityLiteLLM Attack's True Reach Exposed
CloudSEK details how a Trivy compromise cascaded into LiteLLM, affecting 2,500+ orgs and 434,000 pipelines.
SecurityMozilla Rotates GPG Signing Key After GitHub Exposure
Mozilla replaced the GPG key for Firefox and Thunderbird after an unencrypted copy leaked to a private GitHub repo.
TrendingAI Code Growth Threatens Security Controls
Chainguard webinar examines how security teams can manage risk when AI speeds up code production by 10-50x.
Cyber CrimeFake Solidity Extensions Steal Crypto Wallets
A malicious VS Code extension pack targets developers, exfiltrating wallets, credentials, and API keys via Telegram.
SecuritySupply chain compromise uses poisoned API, no files changed
Attackers planted rogue admins and webshells on WordPress sites via a poisoned data feed, not file changes.
Cyber CrimeChainDrop Worm Exploits npm Ecosystem
A self-propagating malware campaign has compromised over 1,300 npm packages, leveraging legitimate GitHub workflows to spread.
SecurityGhostApproval Exposes the Illusion of AI-Guided Human Oversight
A systemic vulnerability across major AI coding assistants highlights the dangerous failure of human-in-the-loop security protocols.
SecuritySupply Chain Breach Targets Jscrambler Dependency Pipeline
A malicious npm package injection forced a swift cleanup, highlighting the persistent dangers of compromised build environments.