Category: Cyber Security News

GitHub confirmed that about 3,800 internal repositories were exfiltrated after an employee installed a malicious VS Code extension, and the company removed the trojanized add-on and secured the affected device. TeamPCP claimed responsibility for the access and attempted to sell the stolen GitHub source code and private repositories, but GitHub said there is no evidence customer data outside the affected repos was impacted. #GitHub #VSCode #TeamPCP

A new proof-of-concept exploit for the patched Linux privilege escalation flaw PinTheft can let local attackers gain root on Arch Linux systems under specific conditions. The issue affects the RDS kernel module and comes amid other recently disclosed Linux LPE bugs, including DirtyDecrypt, DirtyCBC, Copy Fail, and Pack2TheRoot. #PinTheft #ArchLinux #RDS #DirtyDecrypt #DirtyCBC #CopyFail #Pack2TheRoot

Drupal has announced an upcoming core security release and warned that exploit development could begin within hours of the update disclosure. Administrators using Drupal 8 or 9 are urged to prepare for the patch window on May 20 and upgrade to supported releases as soon as the fix is available. #Drupal #DrupalSteward

These real-world ICS and OT stories show how hidden connectivity, default credentials, shadow IT, and unsafe scanning practices can expose critical systems far beyond what organizations expect. From Iranian-linked APT activity and DNS-tunneling malware to broken segmentation and outdated equipment, the examples stress that visibility and careful OT-specific controls are essential….

Security teams are often caught off guard when AI applications move from experimentation into production without early involvement from security. The article recommends strategic preparedness through data-driven discussions, agility, mature operational workflows, future-proofed security stacks, proactive scanning, and contextual awareness to defend AI systems effectively. #AIapplications #ApplicationSecurity #APIsecurity…

A fresh Mini Shai-Hulud supply chain attack compromised more than 320 NPM packages, spreading through GitHub Actions and a VS Code extension to affect widely used developer and CI/CD environments. Researchers say the campaign also targeted Microsoft’s Durabletask Python SDK and used stolen credentials, GitHub-hosted payloads, and republished malicious packages to…

Ofcom is set to require tech companies to do more to detect and remove non-consensual intimate images, while also expanding efforts to stop AI-generated deepfakes from spreading online. The move, backed by new UK legislation and hash-matching technology, aims to better protect women and girls and holds platforms accountable for rapid…

GitHub said it is investigating unauthorized access to its internal repositories after TeamPCP listed its source code and internal organizations for sale, while also confirming a compromised employee device tied to a poisoned Visual Studio Code extension. The same threat actor is expanding the Mini Shai-Hulud campaign through the compromised durabletask…

Grafana Labs said its May 19, 2026 investigation found no evidence that customer production systems or Grafana Cloud operations were compromised, with the incident limited to its GitHub environment. The breach was traced to the TanStack npm supply chain attack linked to TeamPCP, and Grafana also reported an extortion demand after…

GitHub is investigating unauthorized access to its internal repositories after TeamPCP claimed to have stolen about 4,000 private code repositories and offered them for sale. The group has a history of supply chain attacks across GitHub, PyPI, NPM, and Docker, including incidents tied to Aqua Security, Trivy, LiteLLM, and the “TeamPCP Cloud Stealer” malware. #GitHub #TeamPCP #AquaSecurity #Trivy #LiteLLM #TeamPCPCloudStealer #MistralAI

Verizon’s 2026 DBIR reports that vulnerability exploitation became the leading access vector for breaches in 2025, with unpatched flaws behind 31% of cases and ransomware present in 48% of confirmed breaches. The report also highlights slower remediation, increased third-party exposure, and growing use of AI in attack development and targeting. #Verizon…

Exploited vulnerabilities became the leading initial access vector in Verizon’s latest Data Breach Investigations Report, accounting for 31% of breaches as organizations struggled to patch CISA KEV flaws quickly enough. The report also found ransomware remained highly disruptive, representing 48% of breaches even as ransom payments declined and many victims refused to pay. #CISA #KEV #VerizonDBIR #Ransomware

Congressional Democrats are demanding answers after a public GitHub repository reportedly exposed sensitive CISA credentials tied to privileged AWS GovCloud accounts and internal systems. CISA says it is investigating the incident and has found no indication yet that sensitive data was compromised, while researchers warned the leak could enable state actor abuse. #CISA #GitHub #AWSGovCloud #Nightwing #BennieThompson #DeliaRamirez #MaggieHassan

Discord has announced that all voice and video calls on its platform are now protected by default with end-to-end encryption, after completing the rollout in March. The new protection uses the DAVE protocol across supported platforms, while stage channels remain unencrypted and Discord has no plans to extend encryption to text chats. #Discord #DAVE #TrailofBits #Mozilla