Tag: supply-chain
-
Top US senator calls out supply-chain risk with DoD contractors
The Senate Intelligence Committee chairman questioned the security of Microsoft’s “digital escort” arrangement with its Chinese employees. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/microsoft-china-employees-us-military-senate-letter/753465/
-
Firmware Vulnerabilities Continue to Plague Supply Chain
Four flaws in the basic software for Gigabyte motherboards could allow persistent implants, underscoring problems in the ways firmware is developed and updated. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/firmware-vulnerabilities-plague-supply-chain
-
Building scalable secrets management in hybrid cloud environments: Lessons from enterprise adoption
Tags: access, backup, cloud, credentials, data, gitlab, group, iam, identity, infrastructure, jobs, kubernetes, leak, radius, service, supply-chain, toolLessons from integration: Identity, Kubernetes and CI/CD : Choosing a secrets management tool is the easy part. Integrating it across an enterprise is where the work begins. We started with identity. Manual user provisioning was not an option. We integrated Vault with our SSO platform using OIDC and mapped groups to Vault policies based on least privilege.…
-
JFrog bringt frischen Wind in Entwickler-Workflows mit neuem KI-Server
JFrog, bekannt für seine Software Supply Chain Plattform und führend im Bereich ‘Liquid Software”, stellt heute den neuen Model Context Protocol (MCP) Server vor. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-bringt-frischen-wind-in-entwickler-workflows-mit-neuem-ki-server/a41433/
-
Chinese State-Sponsored Hackers Target Semiconductor Industry with Weaponized Cobalt Strike
Proofpoint Threat Research has identified a sophisticated multi-pronged cyberespionage campaign targeting Taiwan’s semiconductor industry between March and June 2025. Three distinct Chinese state-sponsored threat actors, designated as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp, conducted coordinated phishing operations against organizations spanning semiconductor manufacturing, design, testing, supply chain entities, and financial investment analysts specializing in the Taiwanese semiconductor market.…
-
It’s Time to Include Geopolitical Risk in Defense Planning
CyXcel’s Megha Kumar on Aligning Enterprise Strategy With Geopolitical Realities. Geopolitical tensions are no longer limited to headlines or high-level diplomacy. They drive cyber risk, supply chain disruption and regulatory fragmentation. CyXcel’s Megha Kumar makes the case for why companies need to take notice and embed geopolitical risks in ongoing security planning. First seen on…
-
China-linked hackers target Taiwan chip firms in a coordinated espionage campaign
Tags: access, ai, attack, china, compliance, control, credentials, cyber, cybersecurity, detection, email, espionage, exploit, finance, framework, government, group, hacker, intelligence, international, login, monitoring, network, phishing, software, supply-chain, technology, threat, warfareInvestment banks in the crosshairs: A second group, UNK_DropPitch, targeted the financial ecosystem surrounding Taiwan’s semiconductor industry. This group conducted phishing campaigns against investment banks, focusing on individuals specializing in Taiwanese semiconductor analysis. The phishing emails purported to come from fictitious financial firms seeking collaboration opportunities.The third group, UNK_SparkyCarp, focused on credential harvesting through sophisticated…
-
Chinese Hackers Target Taiwan’s Semiconductor Sector with Cobalt Strike, Custom Backdoors
The Taiwanese semiconductor industry has become the target of spear-phishing campaigns undertaken by three Chinese state-sponsored threat actors.”Targets of these campaigns ranged from organizations involved in the manufacturing, design, and testing of semiconductors and integrated circuits, wider equipment and services supply chain entities within this sector, as well as financial investment First seen on thehackernews.com…
-
North Korea Floods npm Registry with Malware
67 Malicious Packages, XORIndex Loader Target JavaScript Code-Sharing Platform. North Korean threat actors escalated their software supply chain attacks by uploading 67 new malicious packages to the npm Registry as part of the ongoing Contagious Interview campaign. The malware targets open-source JavaScript developers with malware loaders. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/north-korea-floods-npm-registry-malware-a-28990
-
North Korean Hackers Exploit 67 Malicious npm Packages to Spread XORIndex Malware
Tags: attack, cyber, exploit, hacker, malicious, malware, north-korea, software, supply-chain, threatThe Socket Threat Research Team has discovered a new software supply chain attack that uses a malware loader called XORIndex that had not been previously reported, marking a major uptick in North Korean cyber operations. This activity builds on the Contagious Interview campaign previously detailed in June 2025, which involved the HexEval Loader. The adversaries,…
-
North Korea-linked actors spread XORIndex malware via 67 malicious npm packages
North Korea-linked hackers uploaded 67 malicious npm packages with XORIndex malware, hitting 17K+ downloads in ongoing supply chain attacks. North Korea-linked threat actors behind the Contagious Interview campaign have uploaded 67 malicious npm packages with XORIndex malware loader, hitting over 17,000 downloads in ongoing supply chain attacks. XORIndex was built to evade detection and deploy…
-
North Korean Hackers Flood npm Registry with XORIndex Malware in Ongoing Attack Campaign
The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing another set of 67 malicious packages to the npm registry, underscoring ongoing attempts to poison the open-source ecosystem via software supply chain attacks.The packages, per Socket, have attracted more than 17,000 downloads, and incorporate a previously undocumented version of a…
-
GerriScary: Supply-Chain-Schwachstelle in Google OSS-Review-System
Sicherheitsforscher von Tenable haben eine GerriScary genannte Schwachstelle im Open-Source-Code-Review-System Gerrit von Google entdeckt. Die Schwachstelle ermöglichte das Einschleusen von Schadcode in mindestens 18 zentrale Google Projekte, darunter ChromiumOS (CVE-2025-1568), Chromium, Dart und Bazel. Über GerriScary hätten Angreifer bestehende Change … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/07/13/gerriscary-supply-chain-schwachstelle-in-google-oss-review-system/
-
UK’s CHERI Alliance Expands to Global Hardware Supply Chain
Program Director Mike Eftimakis on How to Fix 70% of Memory Safety Issues. A U.K. government-backed, hardware-based security initiative is tackling one of the biggest cybersecurity challenges – memory safety – and hopes to address about 70% of existing vulnerabilities, said Mike Eftimakis, founding director of Capability Hardware Enhanced RISC Instructions Alliance. First seen on…
-
MoD supply chain cyber scheme gets up and running
The Ministry of Defence and IASME have launched a certification scheme for organisations working in the UK defence supply chain, with construction firm Morgan Sindall the first business to achieve compliance. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366627637/MoD-supply-chain-cyber-scheme-gets-up-and-running
-
WordPress Gravity Forms developer hacked to push backdoored plugins
The popular WordPress plugin Gravity Forms has been compromised in what seems a supply-chain attack where manual installers from the official website were infected with a backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/wordpress-gravity-forms-developer-hacked-to-push-backdoored-plugins/
-
The zero-day that could’ve compromised every Cursor and Windsurf user
Learn how one overlooked flaw in OpenVSX discovered by Koi Secureity could’ve let attackers hijack millions of dev machines via an extension supply chain attack. The zero-day threat’s been patched”, but the wake-up call is clear: extensions are a new, massive supply chain risk. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-zero-day-that-couldve-compromised-every-cursor-and-windsurf-user/
-
Gefährliche Verbindungen – Wenn die Lieferkette zur Cyberfalle wird
Tags: supply-chainFirst seen on security-insider.de Jump to article: www.security-insider.de/cybersicherheit-risiko-durch-zulieferer-wirtschaftlich-schwierige-zeiten-a-2aa233c6cccdc399e2f9787cb4a95731/
-
AMD discloses new CPU flaws that can enable data leaks via timing attacks
Tags: access, attack, crowdstrike, cve, cvss, data, exploit, firmware, flaw, guide, leak, malware, microsoft, mitigation, risk, side-channel, strategy, supply-chain, threat, update, vulnerability, windowsCrowdStrike elevates threat classification despite CVSS scores: While AMD rates the vulnerabilities as medium and low severity based on attack complexity requirements, CrowdStrike has independently classified them as critical enterprise threats. The security firm specifically flagged CVE-2025-36350 and CVE-2025-36357 as “Critical information disclosure vulnerabilities in AMD processors,” despite both carrying CVSS scores of just 5.6.According…
-
MCP is fueling agentic AI, and introducing new security risks
Tags: access, ai, api, attack, authentication, best-practice, ceo, cloud, corporate, cybersecurity, gartner, injection, LLM, malicious, monitoring, network, office, open-source, penetration-testing, RedTeam, risk, service, supply-chain, technology, threat, tool, vulnerabilityMitigating MCP server risks: When it comes to using MCP servers there’s a big difference between developers using it for personal productivity and enterprises putting them into production use cases.Derek Ashmore, application transformation principal at Asperitas Consulting, suggests that corporate customers don’t rush on MCP adoption until the technology is safer and more of the…
-
Global software supply chain visibility remains critically low
Only 23% of organizations are confident that they have very high visibility of their software supply chain, according to LevelBlue’s Data Accelerator. The limited visibility … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/10/low-global-software-supply-chain-visibility/
-
Supply Chain Attack Unleashed via Compromised VS Code Extension
Tags: attack, blockchain, crypto, cyber, github, malicious, open-source, software, supply-chain, threat, toolA sophisticated supply chain attack targeting cryptocurrency developers through the compromise of ETHcode, a legitimate Visual Studio Code extension with nearly 6,000 installations. The attack, executed through a malicious GitHub pull request, demonstrates how threat actors can weaponize trusted development tools using minimal code changes, raising serious concerns about open-source software security in the blockchain…
-
Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension
Cybersecurity researchers have flagged a supply chain attack targeting a Microsoft Visual Studio Code (VS Code) extension called Ethcode that has been installed a little over 6,000 times.The compromise, per ReversingLabs, occurred via a GitHub pull request that was opened by a user named Airez299 on June 17, 2025.First released by 7finney in 2022, Ethcode…
-
Ingram Micro Confirms Ransomware Incident Impacting Internal Infrastructure
Ingram Micro Holding Corporation (NYSE: INGM), a global leader in technology distribution and supply chain solutions, has confirmed that it recently experienced a ransomware attack targeting certain internal systems. The company issued a statement today addressing the ongoing system outage and the steps being taken to mitigate the impact. Incident Overview According to Ingram Micro,…
-
Ingram Micro confirms ransomware attack after days of downtime
Tags: attack, breach, control, incident response, monitoring, msp, programming, ransomware, resilience, risk, software, supply-chain, threatWeak links: tech supply chain targeted: This attack on Ingram Micro reflects a broader shift in threat actors focusing on increasingly targeting beyond software development firms to broader tech supply chain nodes to maximize disruption.Jain added that entities like distributors, MSPs, and logistics providers offer high leverage with relatively lower security maturity compared to large…
-
Cybersecurity in the supply chain: strategies for managing fourth-party risks
Tags: access, breach, business, ciso, compliance, control, cyber, cybersecurity, data, exploit, framework, governance, intelligence, ISO-27001, law, mitigation, monitoring, nist, risk, risk-management, saas, service, soc, software, strategy, supply-chain, threat, tool, vulnerabilitySet clear data boundaries: The reality is that any organization consuming third-party software-as-a-service offerings and services has extremely limited control over the partners that their third parties are working with, says Curtis Simpson, CISO at Armis.”This is why it’s critically important to understand the sub-processors involved in the delivery of contracted SaaS offerings and services,…
-
Dark Web Vendors Shift to Third Parties, Supply Chains
As attacks on software supply chains and third parties increase, more data on critical software and infrastructure services is being advertised and sold on the Dark Web. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/dark-web-vendors-third-parties-supply-chains
-
AI Tackles Binary Code Challenges to Fortify Supply Chain Security
Analyzing binary code helps vendors and organizations detect security threats and zero-day vulnerabilities in the software supply chain, but it doesn’t come without challenges. It looks like AI has come to the rescue. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/ai-tackles-binary-code-challenges-fortify-supply-chain-security
-
IDE Extensions Pose Hidden Risks to Software Supply Chain
Malicious extensions can be engineered to bypass verification checks for popular integrated development environments, according to research from OX Security. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/ide-extensions-risks-software-supply-chain