6 casos · pág. 1/1
Rank Math disclosed that copies of Rank Math PRO, the paid WordPress SEO plugin, downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 contained malware. Any site that installed and activated an affected copy should be treated as compromised. The malware can recreate its hid…
On 19 October 2026 an attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases (v0.11.0 to v0.15.0) of OVHcloud CLI. The swapped files were a build designed to steal secrets stored on the disk of any machine that ran it. They were live from 12:47 to 14:21 UTC (up to 94 minutes) for m…
The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, …
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
