The Hacker News

A single-click payload can exfiltrate GitHub OAuth tokens from vulnerable repos via VS Code workflows.

High-severity RCE in Gogs; patch and rotate credentials; monitor exploit attempts and review access controls.

Cross-ecosystem attack distributing credential-stealing malware; impacts developers and supply chains.

Poisoned VS Code extension led to internal repo access; reinforces dev-tool supply-chain risk.

Threat actors hijacked a popular GitHub Actions workflow, redirecting all tags to an imposter commit to harvest CI/CD credentials. Review CI workflows and revoke compromised tokens.

Mass patch Tuesday covering DNS, Netlogon, and privilege-escalation flaws; prioritize critical patches in risk mitigations.

New Mirai-derived botnet targets exposed ADB on IoT devices for large-scale DDoS; isolate exposed endpoints and rotate credentials.

New cPanel vulnerability exploited to target government and MSP networks. Patch immediately and audit exposure.

Progress Software patches a critical MOVEit Automation flaw that could bypass authentication. Immediate action recommended to apply updates.

VECT 2.0 acts more as a data wiper due to encryption nonce flaws; recovery unlikely even for attackers.

Flawed Entra ID role could enable privilege escalation; Microsoft issued patches after discovery by researchers.

State-sponsored actors chain CVEs to backdoor FXOS/ASA devices; FIRESTARTER persists after patches.

New destructive wiper targeting energy utilities; review backups and incident response playbooks.

External tooling compromise allowed unauthorized access; assess third-party risk and tighten vendor controls.

Third-party AI tool context access enabled a breach; emphasize third-party risk, credential hygiene, and cloud access reviews.

Microsoft released patches for SharePoint and 168 additional flaws, with one actively exploited in the wild; prioritize patch deployment and verification.

A cluster of 108 malicious Chrome extensions communicates with a shared C2 to steal data and inject ads/JS on pages. Mitigation includes extension reviews and disabling suspicious add-ons.

A cluster of 108 malicious Chrome extensions communicates with a shared C2 to steal data and inject ads/JS on pages. Mitigation includes extension reviews and disabling suspicious add-ons.

Device-Bound Session Credentials (DBSC) became generally available for Chrome on Windows to prevent session hijacking. Update Chrome.