-
Grafana Labs has confirmed a security incident involving unauthorized access to its internal GitHub environment, after a threat actor obtained a compromised access token and downloaded portions of the company’s codebase. The disclosure, made via an off…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Grafana says hackers stole its source code after accessing a GitHub token, but no customer data or systems were affected.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Shai-Hulud is a major cybersecurity threat targeting the open-source software supply chain. Security researchers are raising alarms over “Shai-Hulud,” a self-propagating npm worm designed to steal sensitive developer credentials from GitHub, AWS, Kuber…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Hackers have launched a large-scale supply chain attack by compromising more than 170 npm packages and two PyPI libraries, collectively downloaded over 200 million times weekly, to steal sensitive developer and cloud credentials. The malicious npm pack…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sudden change in GitHub’s token format has triggered an unexpected security vulnerability in Composer, exposing sensitive authentication tokens in CI/CD logs and forcing Packagist to issue an urgent warning to PHP developers worldwide. The issue stem…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Google researchers say hackers used AI to develop zero-day exploits, Android backdoors, and automated supply chain attacks targeting GitHub and PyPI.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A stealthy Python-based infostealer campaign that abuses GitHub Releases to host payloads and maintain long-term, low‑visibility access to victim systems. The operation, dubbed “Operation HumanitarianBait” in some reporting, appears designed for cybere…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new cyberespionage campaign that abuses GitHub Releases and a PE-less Python implant to steal data from targeted Windows systems quietly. The operation combines social engineering, trusted cloud infrastructure, and multi-stage obfuscation to maintain…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Google patches a CVSS 10 Gemini CLI vulnerability that allowed hackers to use prompt injection and privilege escalation for a full supply chain compromise.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly uncovered cyber campaign dubbed “EtherRAT” is raising concerns across enterprise environments, as attackers combine SEO poisoning, GitHub abuse, and blockchain-based infrastructure to target high-privilege IT professionals. Instead of broadly t…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
