Information security
Information security
[ follow ]
#supply-chain-attacks
Information security
fromTNW | Data-Security
2 days agoGitHub breached via poisoned VS Code extension, 3,800 repos stolen
A poisoned VS Code extension enabled TeamPCP to exfiltrate about 3,800 internal GitHub repositories after compromising an employee device.
Information security
fromSecurityWeek
11 hours agoGrafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack
Unauthorized access to Grafana Labs GitHub repositories resulted from a TanStack supply chain attack, leading to token compromise, code theft, and mitigations without customer production impact.
Information security
fromSecurityWeek
5 hours agoIn Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking
Iranian hackers allegedly breached gas station tank gauge systems by exploiting unprotected internet-connected devices, altering display readings without changing fuel volumes.
#software-supply-chain-attacks
Information security
fromArs Technica
9 hours agoA hacker group is poisoning open source code at an unprecedented scale
TeamPCP has carried out frequent software supply chain attacks by corrupting legitimate tools, including a GitHub breach via a poisoned VSCode extension, compromising thousands of repositories.
Information security
fromThe Hacker News
3 days agoMini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
A compromised npm maintainer account pushed trojanized @antv and related packages, embedding credential-stealing code and creating significant downstream exposure for auto-updating dependencies.
Information security
fromThe Hacker News
2 hours agoGhostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware
Ghostwriter targets Ukrainian government organizations using Prometheus-themed phishing lures, delivering JavaScript that writes encrypted payloads, collects system data, and runs Cobalt Strike.
fromThe Hacker News
12 hours agoCISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
The impact is severe: successful exploitation not only compromises the Langflow instance but also exposes all sensitive access tokens and API keys stored within the workspace. This can trigger a cascading compromise across all integrated downstream services in cloud and SaaS environments.
Information security
Information security
fromThe Hacker News
1 day agoThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories
Attacks increasingly use trusted systems and normal workflows, with AI enabling faster, harder-to-detect intrusion tooling and tunneling into internal networks.
#cybersecurity
Information security
fromSecuritymagazine
2 days agoFinancial Services, Cybersecurity and the Evolving Threat Landscape
Financial institutions can manage accelerating cyber threats by integrating resilience into daily operations, strengthening governance and risk management, and leveraging collaboration.
#microsoft-defender
Information security
fromThe Hacker News
1 day agoMicrosoft Warns of Two Actively Exploited Defender Vulnerabilities
Microsoft Defender privilege escalation and denial-of-service vulnerabilities are actively exploited, and fixes are available via updated Defender Antimalware Platform versions and definition updates.
fromComputerworld
1 day agoMicrosoft is working on a patch for 'YellowKey' attack on Bitlocker, offers temporary fix
“Organizations should start by auditing their environment for the conditions that exist that leave them vulnerable to YellowKey,” said Eric Grenier, senior director analyst at Gartner. “They should also have a clear understanding of their risk acceptance in the case of a lost/stolen device and, based on that acceptance (or non-acceptance), follow the steps such as customizing Secure Boot and ensuring firmware and Boot integrity.”.
Information security
fromtheregister
1 day agoZombie user account let hackers control the city's water
Unfortunately, even though Greg was no longer around, his account was, and it retained extensive privileges, including domain admin rights, SCADA (Supervisory Control and Data Acquisition) operator access, and even the ability to perform help desk functions. It's unclear if someone from auditing ever needed this level of access, but a former employee definitely did not.
Information security
Information security
fromThe Hacker News
1 day agoHighly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks
Drupal released security updates for a highly critical PostgreSQL-only Drupal Core vulnerability that can enable remote code execution, privilege escalation, or information disclosure.
fromThe Cipher Brief
1 day agoIran's Digital War Machine Targeting U.S. Infrastructure
Israel wiped out a major military hub in southeastern Tehran, a site that Western intel says was the nerve center for the IRGC. The facility didn't just house the Quds Force and Basij; it served as the literal "brain" for Iran's global hacking campaigns and internal security operations.
Information security
Information security
fromThe Hacker News
2 days agoWebworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API
Webworm uses Discord and Microsoft Graph API for command-and-control, deploying new backdoors in 2025 and blending malware via a WordPress-impersonating GitHub repository.
#data-breaches
Information security
fromTechzine Global
2 days agoVulnerabilities are the number one cause of data breaches for the first time
Exploiting vulnerabilities is now the leading entry point for data breaches, while AI accelerates exploitation and expands risks from shadow AI, supply chains, and mobile attacks.
Information security
fromComputerWeekly.com
2 days agoVulnerability exploitation now primary origin of data breaches | Computer Weekly
About 31% of breaches start with exploitation of unpatched software vulnerabilities, driven by AI-enabled faster weaponization, requiring stronger risk management and patch readiness.
#macos-malware
Information security
fromtheregister
3 days agoDo fear the Reaper - stealer swipes macOS users' passwords, wallets, then backdoors them
Reaper macOS infostealer spoofs major trusted brands, uses Script Editor to bypass Terminal defenses, then steals password-manager credentials and crypto-wallet access.
Information security
fromTNW | Data-Security
2 days agoQIZ Security and Google Cloud partner on quantum-safe encryption
QIZ Security and Google Cloud collaborate to accelerate enterprise migration to quantum-resistant cryptography by providing unified visibility into cryptographic risk across hybrid environments.
Information security
fromtheregister
2 days agoMicrosoft shuts down illegal code-signing operation used by ransomware crims to mask their malware
Microsoft seized websites and took down a code-signing certificate service used to make ransomware and malware appear legitimate, infecting thousands of US machines including Microsoft-owned systems.
fromtheregister
2 days agoGitHub says internal repos exfiltrated after poisoned VS Code extension attack
GitHub, the world's biggest code repository and DevOps platform, fell victim to a malicious Visual Studio Code (VS Code) extension. The company's initial assessment is that only internal repositories were exfiltrated. The incident was reported by GitHub on X, with follow-up posts revealing a "poisoned VS Code extension" as the cause. The Microsoft-owned code shack continues to "analyze logs, validate secret rotation, and monitor for any follow-on activity."
Information security
fromInfoWorld
2 days agoGitHub admits major source code leak after 3,800 internal repositories breached
“Yesterday we detected and contained a compromise of an employee device involving a poisoned VS [Visual Studio] Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately,” GitHub said.
Information security
fromSecurityWeek
2 days agoQuantum Bridge Raises $8 Million for Quantum-Safe Key Distribution Solution
Quantum Bridge announced on Wednesday that it has raised $8 million in Series A funding for its quantum-safe key distribution solution. The new funding, which brings the total raised by the company to $16 million, was supported by Wayra (Telefónica), Cadenza VC, Club degli Investitori angels, HPE, and Bacchus Venture Capital.
Information security
Information security
fromComputerWeekly.com
3 days agoAssume autonomy: Why security teams need to rethink defence at machine speed | Computer Weekly
Cybersecurity must shift from human-speed assumptions to an Assume Autonomy mindset, because AI enables autonomous discovery, exploitation, and lateral movement faster than current defenses.
[ Load more ]