Attackers successfully compromised 42 third-party GitHub repositories by embedding malicious payloads too large to be detected by standard GitHub search and API paths. The sophisticated campaign targets AI coding assistants and IDEs, activating malware when
A supply chain attack dubbed Gheist is exploiting compromised GitHub tokens to scan developer repositories and harvest sensitive cloud credentials.
LiteLLM has disclosed a security breach after a master key was accidentally published to a public repository, allowing attackers to hijack the release pipeline and distribute malicious code.
Microsoft has attributed a supply chain attack on ConnectWise Cloud Backup to the China-linked actor Storm-0940, who utilised the ARTEX AI agentic framework to accelerate the intrusion.
Rank Math has confirmed a supply-chain attack affecting the PRO version of its popular WordPress SEO plugin, allowing attackers to plant persistent backdoors and steal sensitive credentials from affected websites.
