Tag: supply-chain
-
âš¡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools. Many hid inside trusted apps, browser alerts, and software updates.Big firms like Microsoft, Salesforce, and Google had to react fast, stopping DDoS attacks, blocking bad links, and fixing…
-
Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft
Multiple security vendors are sounding the alarm about a second wave of attacks targeting the npm registry in a manner that’s reminiscent of the Shai-Hulud attack.The new supply chain campaign, dubbed Sha1-Hulud, has compromised hundreds of npm packages, according to reports from Aikido, HelixGuard, Koi Security, Socket, and Wiz.”The campaign introduces a new variant that…
-
Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft
Multiple security vendors are sounding the alarm about a second wave of attacks targeting the npm registry in a manner that’s reminiscent of the Shai-Hulud attack.The new supply chain campaign, dubbed Sha1-Hulud, has compromised hundreds of npm packages, according to reports from Aikido, HelixGuard, Koi Security, Socket, and Wiz.”The campaign introduces a new variant that…
-
âš¡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools. Many hid inside trusted apps, browser alerts, and software updates.Big firms like Microsoft, Salesforce, and Google had to react fast, stopping DDoS attacks, blocking bad links, and fixing…
-
âš¡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools. Many hid inside trusted apps, browser alerts, and software updates.Big firms like Microsoft, Salesforce, and Google had to react fast, stopping DDoS attacks, blocking bad links, and fixing…
-
Zapier’s NPM Account Hacked, Multiple Packages Infected with Malware
Zapier’s NPM account has been successfully compromised, leading to the injection of the Shai Hulud malware into 425 packages currently distributed across the npm ecosystem. The attack represents a significant supply chain threat, with the affected packages collectively generating approximately 132 million monthly downloads across critical infrastructure and development tools. The malware-laden packages span multiple…
-
Zapier’s NPM Account Hacked, Multiple Packages Infected with Malware
Zapier’s NPM account has been successfully compromised, leading to the injection of the Shai Hulud malware into 425 packages currently distributed across the npm ecosystem. The attack represents a significant supply chain threat, with the affected packages collectively generating approximately 132 million monthly downloads across critical infrastructure and development tools. The malware-laden packages span multiple…
-
Malicious PyPI Package Used by Hackers to Steal Users’ Crypto Information
Tags: access, attack, backdoor, control, crypto, cyber, cybersecurity, hacker, infrastructure, malicious, pypi, supply-chainCybersecurity researchers have uncovered a sophisticated supply-chain attack targeting Python developers through a malicious package distributed via the Python Package Index (PyPI). The malicious package, named >>spellcheckers,
-
Malicious PyPI Package Used by Hackers to Steal Users’ Crypto Information
Tags: access, attack, backdoor, control, crypto, cyber, cybersecurity, hacker, infrastructure, malicious, pypi, supply-chainCybersecurity researchers have uncovered a sophisticated supply-chain attack targeting Python developers through a malicious package distributed via the Python Package Index (PyPI). The malicious package, named >>spellcheckers,
-
Malicious PyPI Package Used by Hackers to Steal Users’ Crypto Information
Tags: access, attack, backdoor, control, crypto, cyber, cybersecurity, hacker, infrastructure, malicious, pypi, supply-chainCybersecurity researchers have uncovered a sophisticated supply-chain attack targeting Python developers through a malicious package distributed via the Python Package Index (PyPI). The malicious package, named >>spellcheckers,
-
Iberia Airlines Notifies Customers of Supply Chain Data Breach
Spanish airline Iberia has begun emailing its customers about a supplier data breach First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iberia-airlines-supply-chain-data/
-
China’s APT24 Launches Stealth BADAUDIO Malware, Hitting 1,000+ Domains via Taiwanese Supply Chain Hack
The post China’s APT24 Launches Stealth BADAUDIO Malware, Hitting 1,000+ Domains via Taiwanese Supply Chain Hack appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/chinas-apt24-launches-stealth-badaudio-malware-hitting-1000-domains-via-taiwanese-supply-chain-hack/
-
Security Affairs newsletter Round 551 by Pierluigi Paganini INTERNATIONAL EDITION
Tags: attack, cisa, cyberespionage, email, international, malware, oracle, supply-chain, WeeklyReviewA new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. BadAudio malware: how APT24 scaled its cyberespionage through supply chain attacks U.S. CISA adds an Oracle…
-
Week in review: Stealth-patched FortiWeb vulnerability under active exploitation, Logitech data breach
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The tech that turns supply chains from brittle to unbreakable In this Help … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/23/week-in-review-stealth-patched-fortiweb-vulnerability-under-active-exploitation-logitech-data-breach/
-
Making A Cyber Crisis Plan! Key Components Not To Be Missed
Do you think cyberattacks are headlines anymore? Given the frequent occurrences, it has turned headlines into a day-to-day reality, and that’s scarier! Organizations that are big names to small organizations that are still growing, every one of them is being hit one way or the other. From supply chain attacks to data breaches, the impact……
-
Making A Cyber Crisis Plan! Key Components Not To Be Missed
Do you think cyberattacks are headlines anymore? Given the frequent occurrences, it has turned headlines into a day-to-day reality, and that’s scarier! Organizations that are big names to small organizations that are still growing, every one of them is being hit one way or the other. From supply chain attacks to data breaches, the impact……
-
BadAudio malware: how APT24 scaled its cyberespionage through supply chain attacks
APT24 used supply chain attacks and varied techniques to deploy the BadAudio malware in a long-running cyberespionage campaign. China-linked group APT24 used supply-chain attacks and multiple techniques over three years to deploy the BadAudio downloader and additional malware payloads, Google Threat Intelligence Group (GTIG) warns. According to the researchers, the group shifted from broad web…
-
SEC Dismisses Remains of Lawsuit Against SolarWinds and Its CISO
The SEC dismissed the remain charges in the lawsuit filed in 2023 against software maker SolarWinds and CISO Timothy Brown in the wake of the massive Sunburst supply chain attack, in which a Russian nation-state group installed a malicious update into SolarWInds software that then compromised the systems of some customers. First seen on securityboulevard.com…
-
SEC Dismisses Remains of Lawsuit Against SolarWinds and Its CISO
The SEC dismissed the remain charges in the lawsuit filed in 2023 against software maker SolarWinds and CISO Timothy Brown in the wake of the massive Sunburst supply chain attack, in which a Russian nation-state group installed a malicious update into SolarWInds software that then compromised the systems of some customers. First seen on securityboulevard.com…
-
From code to boardroom: A GenAI GRC approach to supply chain risk
Tags: ai, blockchain, business, ciso, compliance, dark-web, data, defense, finance, framework, gartner, grc, intelligence, LLM, metric, open-source, regulation, resilience, risk, strategy, supply-chain, threat, vulnerabilityThe GenAI GRC mandate: From reporting to prediction: To counter a threat that moves at the speed of computation, our GRC must also become generative and predictive. The GenAI GRC mandate is to shift the focus from documenting compliance to predicting systemic failure.Current GRC methods are designed for documentation. They verify that a policy exists.…
-
From code to boardroom: A GenAI GRC approach to supply chain risk
Tags: ai, blockchain, business, ciso, compliance, dark-web, data, defense, finance, framework, gartner, grc, intelligence, LLM, metric, open-source, regulation, resilience, risk, strategy, supply-chain, threat, vulnerabilityThe GenAI GRC mandate: From reporting to prediction: To counter a threat that moves at the speed of computation, our GRC must also become generative and predictive. The GenAI GRC mandate is to shift the focus from documenting compliance to predicting systemic failure.Current GRC methods are designed for documentation. They verify that a policy exists.…
-
Ransomware gangs seize a new hostage: your AWS S3 buckets
Tags: access, backup, breach, business, cloud, control, credentials, cryptography, data, encryption, exploit, least-privilege, monitoring, network, ransomware, supply-chainWeaponizing cloud encryption and key management: Trend Micro has identified five S3 ransomware variants that increasingly exploit AWS’s built-in encryption paths. One abuses default AWS-managed KMS keys (SSE-KMS) by encrypting data with an attacker-created key and scheduling that key for deletion. Another uses customer-provided keys (SSE-C), where AWS has no copy, making recovery impossible. The…
-
SEC Drops SolarWinds Case After Years of High-Stakes Cybersecurity Scrutiny
The U.S. Securities and Exchange Commission (SEC) has abandoned its lawsuit against SolarWinds and its chief information security officer, alleging that the company had misled investors about the security practices that led to the 2020 supply chain attack.In a joint motion filed November 20, 2025, the SEC, along with SolarWinds and its CISO Timothy G.…
-
SEC Drops SolarWinds Case After Years of High-Stakes Cybersecurity Scrutiny
The U.S. Securities and Exchange Commission (SEC) has abandoned its lawsuit against SolarWinds and its chief information security officer, alleging that the company had misled investors about the security practices that led to the 2020 supply chain attack.In a joint motion filed November 20, 2025, the SEC, along with SolarWinds and its CISO Timothy G.…
-
Supply-Chain-Sicherheit – 3 von 10 Cyberattacken zielen auf Zulieferer
First seen on security-insider.de Jump to article: www.security-insider.de/cyberangriffe-industriezulieferer-auswirkungen-praevention-a-6d97e9b2c3a63f6c4ef703b91a9e2744/
-
Analyse zu OAuth, CORS und Supply-Chain-Risiken in DevOps – Fehlkonfiguriertes MCP SDK von Anthropic gefährdet die Lieferkette
First seen on security-insider.de Jump to article: www.security-insider.de/anthropic-mcp-sdk-lieferkettenrisiken-a-2be9d588556ef97523161761ea849900/
-
Analyse zu OAuth, CORS und Supply-Chain-Risiken in DevOps – Fehlkonfiguriertes MCP SDK von Anthropic gefährdet die Lieferkette
First seen on security-insider.de Jump to article: www.security-insider.de/anthropic-mcp-sdk-lieferkettenrisiken-a-2be9d588556ef97523161761ea849900/