Collaborate Disseminate
Initial assessment says customer data spared while users wonder what else may have slipped out Continue reading GitHub says internal repos exfiltrated after poisoned VS Code extension attack
A Freedom of Information Act request shows the extent of the surveillance Continue reading London’s police asked Big Tech for comms data over 700,000 times last year
‘Thousands’ of US victims, including 12+ machines owned and operated by Redmond Continue reading Microsoft shuts down illegal code-signing operation used by ransomware crims to mask their malware
I wonder what’s in ‘external-secret-repo-creds.yaml’ and ‘AWS-Workspace-Firefox-Passwords.csv’? Continue reading America’s top cyber-defense agency left a GitHub repo open with passwords, keys, tokens – and incredibly obvious filenames
The org’s staying mum on the details, but Wednesday’s fixes reach back to unsupported 8.9 branches Continue reading Clear your calendar, Drupal user: You have a critically urgent patch to install
While also spoofing all the trusted domains – Apple, Microsoft, and Google – in the same attack Continue reading Do fear the Reaper – stealer swipes macOS users’ passwords, wallets, then backdoors them
Plus three other stealers in three other packages, all from the same scumbag Continue reading Shai-Hulud copycat worm infects yet another npm package
Plus ModuleJail, a radical proposal for minimizing the impact of similar bugs Continue reading Linux kernel flaw opens root-only files to unprivileged users
Shai-Hulud worm exploited GitHub Actions misconfiguration to poison shared cache, now project weighing nuclear option on unsolicited contributions Continue reading TanStack weighs invitation-only pull requests after supply chain attack
Researchers say 18-year-old flaw already being probed and exploited just days after disclosure Continue reading NGINX Rift attackers waste no time targeting exposed servers