Engineering
PHP 8.5.12 fixes two critical pre-auth RCEs: update now
Two PHP flaws rated 9.2, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated RCE before your code runs. Fixed in PHP 8.5.12 and 8.4.27.
Threat intel
Ongoing campaigns, exploited tactics, and attacker behavior that changes defensive priorities this week.
Cyber security
npm supply chain attack evades install defenses at runtime
An npm supply chain attack hides malware in runtime methods, bypassing npm v12 install-script blocks. Ten packages and 7 million downloads are affected.
Cyber security
DPRK WaterPlum fake job campaign hit 30,000 devices
North Korea's WaterPlum hacking group compromised at least 30,000 devices in over 100 countries via fake job interviews, stealing $10.7 million in cryptocurrency. The campaign weaponizes npm packages and VS Code projects against software developers.
Cyber security
Passkey phishing hijacks Microsoft 365 for data theft
Vishing calls themed around passkeys are hijacking Microsoft 365 accounts; attackers steal session tokens and exfiltrate data over days.
Cyber security
Shai-Hulud worm now scans 469 credential paths: what to rotate
The Shai-Hulud npm infostealer worm expanded from 189 to 469 credential-scanning paths across dev machines, CI/CD, cloud, and AI tool configs after the [email protected] compromise. Rotate everything.
Cyber security
Fire Ant turns Cisco routers into credential theft platforms
Fire Ant, a China-nexus espionage group, expanded from VMware hypervisors to Cisco IOS XR routers and TACACS servers, hijacking the network trust layer to steal credentials and blind security logging across connected environments.
Cyber security
AmnesiaStealer turns Mac browsers into live attacker drones
A new macOS infostealer, AmnesiaStealer clones Chromium profiles and gives attackers live control of logged-in browser sessions over CDP.
Cyber security
ChainDrop npm worm hits 1,300 packages, steals cloud secrets
A self-propagating npm worm, ChainDrop hit 1,300 packages with 2 billion monthly downloads and stole cloud credentials from CI/CD runners.
Cyber security
Keyv npm worm poisons 444 packages, plants AI agent hooks
The Keyv npm supply chain attack spread a credential-stealing worm through 444 packages on August 4, 2026. The worm planted execution hooks in Claude Code and VS Code, harvesting CI secrets via Ethereum blockchain C2.
Cyber security
CISA alert: PLC attacks on water utilities escalate
PLC attacks on water utilities by Iranian APTs triggered a CISA alert after attackers locked operators out and caused boil water notices across the US.
Cyber security
Citrix Bleed 2 turns ransomware into identity theft
Anubis ransomware now uses Citrix Bleed 2 as an access path. Patch NetScaler, kill sessions, and hunt RMM and credential abuse.
Cyber security
Langflow RCE turns AI app endpoints into miner bait
Attackers use a Langflow RCE to mine Monero on exposed AI app endpoints. Patch, isolate, and treat public workflows as attack surface.
Cyber security
VS Code Tasks supply chain attack needs new checks
The VS Code Tasks supply chain attack runs outside npm lifecycle scripts, so the package hijack slips past install-time controls. Scan editor configs now.
Cyber security
Signal backup recovery keys become the weak link for ops
Signal backup recovery keys can expose historical chats after one phishing win. Treat messenger backups like identity infrastructure now.
Cyber security
Mastra npm supply chain attack hits AI build rooms
Mastra npm supply chain attack exposed AI build pipelines through more than 140 packages, so treat installs as secret exposure events.