90 casos · pág. 2/5
Rank Math reported a security incident in which its premium Rank Math PRO WordPress plugin, version 3.0.123, was distributed with malware. Sites are at risk if administrators activated the compromised version. The affected download window ran from October 15, 2023 20:02 UTC to October 16, 2023 07:12 UTC (dates as stated in the article), a…
OVHcloud disclosed a supply-chain attack on its command-line interface (CLI) repository on GitHub. An attacker used a compromised developer's GitHub account to insert a malicious binary designed to retrieve secrets from users' disks. CEO Octave Klaba confirmed the incident on 19 October 2026 after a customer report. The compromised releas…
OVHcloud disclosed that attackers hijacked a developer's GitHub account and used it to modify the open-source OVHcloud CLI repository, publishing trojanized releases 0.11.0 through 0.15.0 that carry information-stealing malware. According to CEO Octave Klaba, the malicious release appeared at 14:47 on October 19 and was detected and block…
An attacker pushed forged commits to the default branches of two unrelated GitHub projects, hugo-paper and mevn-cli. The commits add a preinstall hook (scripts/preinstall.js) that downloads and silently runs a second-stage script from buildwithknexus.xyz during npm install or bun install. The commits copy the author, date and message of t…
On 19 October 2026 an attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases (v0.11.0 to v0.15.0) of OVHcloud CLI. The swapped files were a build designed to steal secrets stored on the disk of any machine that ran it. They were live from 12:47 to 14:21 UTC (up to 94 minutes) for m…
GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on comprom…
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
A Hacktron researcher argues that AI-assisted vulnerability research is rapidly widening the enterprise attack surface. He cites recent breaches at Vercel and GitHub and a wave of critical CVEs in F5, Fortinet, Cisco, Palo Alto and ImageMagick. According to the author, the Vercel compromise began with a breach of the AI platform Context.a…
The Hakai Yokai Research Team disclosed CVE-2026-12191, an insecure deserialization flaw (CWE-502) in openpilot, the open-source Level 2 driver assistance system from comma.ai that supports over 275 vehicle models. The modeld process calls Python pickle.load() / pickle.loads() on model and metadata files with no validation, signature or h…
On 4 August 2026, an npm worm published 2,234 poisoned versions across 444 package names, using credentials from twelve organisations. Affected scopes include @ornikar, @deliveroo, @onereach, @or-sdk, @servicetitan, @qlik, @picsart, and the keyv and cacheable families. The keyv, flat-cache, file-entry-cache and cacheable-request packages …
Two beta versions in the @joyfill npm scope, published on July 28, 2026, carried the same blockchain C2 loader seen in the earlier astro.config.mjs attack, which the article ties to the PolinRider campaign. The attacker published through the legitimate scope (a form-builder SDK with three maintainers) under the beta dist-tag. The maliciou…
On August 12, 2026, an npm user (rootdaddy-msrc, author field r00tdaddy) published 21 packages that squatted the unscoped CLI binary names declared in the bin field of Google-affiliated scoped packages, such as ngsw-config (from @angular/service-worker) and bazelisk (from @bazel/bazelisk). Scoped publishing, registry allowlists and lockfi…
SafeDep reports a growing npm campaign in which forks of Baileys, the WhatsApp Web library for Node.js, abuse the installer's authenticated WhatsApp session to silently follow attacker-controlled channels. Confirmed malicious packages total 82 Baileys-based package names (375 versions) and 15 libsignal-node impersonators (38 versions), ou…
On August 28, 2026, an attacker published 10 malicious versions of the npm package @7nohe/openapi-react-query-codegen (about 671K downloads/month) without stealing any credentials. They abused the repository's GitHub Actions release.yml workflow, which had an issuecomment trigger with no author-association gate. Commenting npm publish on …
SafeDep found a remote access implant in mathmain, an npm package that copies mathjs, and in two sibling packages, mathsbase and math-universe. The malicious code ships AES-256-GCM encrypted and activates only when lusolve() is called with matrix data whose LU lower factor serializes to a specific password. Once decrypted, the implant tak…
Unit 42 (Palo Alto Networks) released OperTraitor, an open-source, LLM-powered tool that ingests RBAC configurations from installed Kubernetes operators and the OperatorHub catalog. It compares an operator's documented function with its granted privileges and assigns a 1-10 risk score. The research found abandoned, overly permissive opera…
In a PWNED column, SolarWinds CISO Justin Henkel, a former US Air Force IT security specialist, recounts that in the early 2000s pilots and mission planners moved mission data between unclassified and classified systems using CDs and later USB thumb drives. Personnel often bought the drives from local vendors, for example in Kabul, rather…
ConnectWise disclosed on October 16 that on October 15 it detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment. It suspended Cloud Backup, plus the integrated SaaS Security and Cloud Management services, as a precaution. As of 16:00 UTC on October 18 the services were still down, so end…
ConnectWise suspended its Cloud Backup (formerly SkyKick) service and took SaaS Security and Cloud Management offline after unknown attackers obtained unauthorized access to seven of its application identities. The company detected the incident on October 14, disabled the compromised identities on October 17, and is still investigating ho…
Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, …
