Tag: supply-chain
-
AI Agents Create Critical Supply Chain Risk in GitHub Actions
PromptPwnd shows how simple prompt injections can let attackers compromise GitHub Actions and leak sensitive data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/ai-agents-create-critical-supply-chain-risk-in-github-actions/
-
Breach Roundup: React Flaw Incites Supply Chain Risk
Also, Microsoft Badly Patches LNK Flaw, Australian Sentenced for ‘Evil Twin’ Hack. This week, the React flaw, a belated Windows fix, Defense Secretary Pete Hegseth’s Signal group posed operational risk, more North Korean npm packages. An Australian jailed for Wi-Fi evil twin crimes. The US FTC will send $15.3 million to Avast users. A London…
-
From feeds to flows: Using a unified linkage model to operationalize threat intelligence
Tags: access, api, attack, authentication, automation, business, ciso, cloud, compliance, container, control, corporate, credentials, cyber, cybersecurity, data, defense, exploit, finance, firewall, framework, github, government, iam, identity, infrastructure, intelligence, ISO-27001, malicious, metric, mitre, monitoring, network, nist, open-source, phishing, risk, risk-assessment, risk-management, saas, service, siem, soc, software, supply-chain, tactics, threat, tool, update, vulnerability, zero-trustwhat to watch for, but not why it matters or how it moves through your environment.The result is a paradox of abundance: CISOs have more data than ever before, but less operational clarity. Analysts are overwhelmed by indicators disconnected from context or mission relevance.Each feed represents a snapshot of a potential threat, but it does…
-
PickleScan Uncovers 0-Day Vulnerabilities Allowing Arbitrary Code Execution via Malicious PyTorch Models
JFrog Security Research has uncovered three critical zero-day vulnerabilities in PickleScan, a widely-adopted industry-standard tool for scanning machine learning models and detecting malicious content. These vulnerabilities would enable attackers to completely bypass PickleScan’s malware detection mechanisms, potentially facilitating large-scale supply chain attacks by distributing malicious ML models containing undetectable code. The discoveries underscore a fundamental…
-
5 Threats That Reshaped Web Security This Year [2025]
As 2025 draws to a close, security professionals face a sobering realization: the traditional playbook for web security has become dangerously obsolete. AI-powered attacks, evolving injection techniques, and supply chain compromises affecting hundreds of thousands of websites forced a fundamental rethink of defensive strategies.Here are the five threats that reshaped web security this year, and…
-
5 Threats That Reshaped Web Security This Year [2025]
As 2025 draws to a close, security professionals face a sobering realization: the traditional playbook for web security has become dangerously obsolete. AI-powered attacks, evolving injection techniques, and supply chain compromises affecting hundreds of thousands of websites forced a fundamental rethink of defensive strategies.Here are the five threats that reshaped web security this year, and…
-
Sleepless in Security: What’s Actually Keeping CISOs Up at Night
Security headlines distract, but the threats keeping CISOs awake are fundamental gaps and software supply chain risks. Learn why basics and visibility matter most. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/sleepless-in-security-whats-actually-keeping-cisos-up-at-night/
-
Malicious VSCode Extension Deploys Anivia Loader and OctoRAT
In late November 2025, a sophisticated supply-chain attack leveraging the Visual Studio Code extension ecosystem came to light, demonstrating how threat actors are increasingly targeting developer tools to gain persistent access to high-value systems. On November 21, a malicious extension masquerading as the popular Prettier code formatter appeared briefly on the official VSCode Marketplace before…
-
Critical PickleScan Vulnerabilities Expose AI Model Supply Chains
3 critical zero-day flaws in PickleScan, affecting Python and PyTorch, allowed undetected attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/picklescan-flaws-expose-ai-supply/
-
GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools
The supply chain campaign known as GlassWorm has once again reared its head, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks like Flutter, React, Tailwind, Vim, and Vue.GlassWorm was first documented in October 2025, detailing its use of the Solana blockchain for command-and-control (C2) and…
-
GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools
The supply chain campaign known as GlassWorm has once again reared its head, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks like Flutter, React, Tailwind, Vim, and Vue.GlassWorm was first documented in October 2025, detailing its use of the Solana blockchain for command-and-control (C2) and…
-
Vaillant-CISO: “Starten statt Warten”
Tags: business, ciso, compliance, cyber, cyberattack, cyersecurity, dora, germany, group, international, mail, malware, nis-2, phishing, ransomware, resilience, risk, supply-chainRaphael Reiß, CISO bei Vaillant Group: “Ein moderner CISO muss nicht nur technologische Risiken managen.” Vaillant GroupDer Energiesektor gerät zunehmend in den Fokus von Cyberkriminellen. Aus Sicht von Experten und des Bundesamtes für Sicherheit in der Informationstechnik (BSI) muss der Schutz in diesem Bereich massiv erhöht werden. Wie beurteilen Sie die aktuelle Lage in Deutschland?Reiß:…
-
Vaillant-CISO: “Starten statt Warten”
Tags: business, ciso, compliance, cyber, cyberattack, cyersecurity, dora, germany, group, international, mail, malware, nis-2, phishing, ransomware, resilience, risk, supply-chainRaphael Reiß, CISO bei Vaillant Group: “Ein moderner CISO muss nicht nur technologische Risiken managen.” Vaillant GroupDer Energiesektor gerät zunehmend in den Fokus von Cyberkriminellen. Aus Sicht von Experten und des Bundesamtes für Sicherheit in der Informationstechnik (BSI) muss der Schutz in diesem Bereich massiv erhöht werden. Wie beurteilen Sie die aktuelle Lage in Deutschland?Reiß:…
-
Glassworm Malware Targets OpenVSX and Microsoft Visual Studio with 24 New Malicious Packages
Security threats rarely adhere to holiday schedules, and while developers may take time off, malicious actors are working overtime. A significant new wave of software supply chain attacks has been identified targeting the Microsoft Visual Studio Marketplace and OpenVSX platforms. Researchers at Secure Annex have uncovered and tracked 24 new malicious packages linked to the…
-
Glassworm Malware Targets OpenVSX and Microsoft Visual Studio with 24 New Malicious Packages
Security threats rarely adhere to holiday schedules, and while developers may take time off, malicious actors are working overtime. A significant new wave of software supply chain attacks has been identified targeting the Microsoft Visual Studio Marketplace and OpenVSX platforms. Researchers at Secure Annex have uncovered and tracked 24 new malicious packages linked to the…
-
Shai-hulud 2.0 Turns npm Installs Into a Full Cloud Compromise Path
A new Shai-hulud variant turns trusted npm installs into a stealthy path for cloud-credential theft and supply chain compromise. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/shai-hulud-2-0-turns-npm-installs-into-a-full-cloud-compromise-path/
-
Shai-Hulud 2.0: Wie sich ein Supply-Chain-Wurm weiterentwickelt
Tags: supply-chainDie Shai-Hulud Kampagne zählt inzwischen zu den gravierendsten Angriffen, die das JavaScript Umfeld je erlebt hat. Als die erste Welle Anfang 2025 öffentlich wurde, zeigten Analysen des Sicherheitsunternehmens JFrog, dass sich ein selbstreplizierender Wurm über Hunderte npm Pakete verbreitet hatte. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/shai-hulud-2-0-supply-chain-wurm
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 73
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287) Shai-Hulud 2.0 Supply Chain Attack: 25K+ npm Repos Exposed Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications Morphisec Thwarts Russian-Linked…
-
Ransomware Moves: Supply Chain Hits, Credential Harvesting
Innovation Continues, Although Sloppy Coding Can Still Leave Data Unrecoverable. Ransomware groups continue to display more innovation, persistence and planning in their quest to amass ransom-paying victims and maximize profits. This has included repeat supply-chain attacks, harvesting credentials to use in later campaigns, as well as launching their own affiliate programs. First seen on govinfosecurity.com…
-
Ransomware Moves: Supply Chain Hits, Credential Harvesting
Innovation Continues, Although Sloppy Coding Can Still Leave Data Unrecoverable. Ransomware groups continue to display more innovation, persistence and planning in their quest to amass ransom-paying victims and maximize profits. This has included repeat supply-chain attacks, harvesting credentials to use in later campaigns, as well as launching their own affiliate programs. First seen on govinfosecurity.com…
-
Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages
Cybersecurity researchers have discovered vulnerable code in legacy Python packages that could potentially pave the way for a supply chain compromise on the Python Package Index (PyPI) via a domain takeover attack.Software supply chain security company ReversingLabs said it found the “vulnerability” in bootstrap files provided by a build and deployment automation tool named “zc.buildout.””The…
-
Scattered Lapsus$ Hunters target Zendesk users with fake domains
Tags: access, attack, breach, credentials, data, data-breach, email, government, group, infrastructure, law, service, supply-chainDiscord breach may be connected: The Zendesk campaign may not be an isolated incident. Discord said on October 9 that attackers breached its customer service provider, 5CA, exposing data from about 70,000 users who had submitted government IDs for age verification. The breach also exposed support ticket data for users who had contacted Discord’s customer…
-
Wie Angreifer das Npm-Ökosystem infiltrierten
Shai-Hulud 2.0 breitet sich rasant aus und legt sensible Entwicklerzugänge offen. Check Point Software Technologies warnt vor einer der schwerwiegendsten Supply-Chain-Kompromittierungen seit Log4j. Dazu haben die Sicherheitsforscher von Check Point eine Analyse zur technischen Vorgehensweise von Shai-Hulud 2 veröffentlicht. Die Shai-Hulud-2.0-Kampagne ist einer der umfangreichsten und schnellsten Npm-Supply-Chain-Angriffe, die in den letzten Jahren beobachtet wurden.…
-
“Dead Man’s Switch” Triggers Massive npm Supply Chain Malware Attack
GitLab’s security team has discovered a severe, ongoing attack spreading dangerous malware through npm, the world’s most extensive code library. The malware uses an alarming >>dead man’s switch,
-
Shai Hulud v2 Exploits GitHub Actions to Steal Secrets
A sophisticated supply chain attack has compromised hundreds of npm packages and exposed secrets from tens of thousands of GitHub repositories, with cybersecurity researchers now documenting how attackers weaponized GitHub Actions workflows to bootstrap one of the most aggressive worm campaigns in recent memory. On November 24, 2025, at 4:11 AM UTC, malicious versions of…
-
Shai-Hulud 2.0: Wie sich ein Supply-Chain-Wurm weiterentwickelt
Die zweite Welle der Shai-Hulud-Kampagne zeigt, wie sich Angriffe auf die Software-Supply-Chain zu automatisierten, hartnäckigen und hochentwickelten Operationen entwickeln. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/shai-hulud-2-0-wie-sich-ein-supply-chain-wurm-weiterentwickelt/a42977/
-
Wie Angreifer das npm-Ökosystem infiltrierten
Die Sicherheitsforscher von Check Point Software Technologies haben seine Analyse zur technischen Vorgehensweise von Shai-Hulud 2 veröffentlicht. Die Shai-Hulud 2.0-Kampagne ist einer der umfangreichsten und schnellsten npm-Supply-Chain-Angriffe, die in den letzten Jahren beobachtet wurden. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/angreifer-npm-oekosystem