TL;DR
GitHub repositories weaponized at scale: nearly 7,600 malicious repos delivering SmartLoader malware via fake AI/MCP server facades. WordPress sites targeted by chained zero-day exploits (CVE-2026-60137, CVE-2026-63030) within 72 hours of disclosure. Oracle E-Business flaw breached Estée Lauder; SonicWall SMA1000 zero-days exploited for weeks before patch.
Executive Summary
- FakeGit campaign compromises nearly 7,600 GitHub repositories, with 800+ masquerading as legitimate AI tools to distribute SmartLoader malware.
- WordPress sites actively targeted by coordinated exploitation of CVE-2026-60137 and CVE-2026-63030 within 72 hours of public disclosure, affecting millions of installations.
- SonicWall SMA1000 zero-days (CVE-2026-15409, CVE-2026-15410) exploited for weeks in the wild by threat actor UTA0533 before patches became available.
- Estée Lauder data breach attributed to Oracle E-Business Suite vulnerability exploitation, highlighting supply-chain risk in HR/financial systems.
- Newly documented HollowGraph malware leverages Microsoft 365 calendar infrastructure for command & control and data exfiltration.
Top Threats Today
1. FakeGit Campaign: 7,600 Malicious GitHub Repositories Distributing SmartLoader
Severity: HIGH Affected: Technology
Cybersecurity researchers have identified nearly 7,600 malicious GitHub repositories as part of an ongoing campaign codenamed FakeGit [1]. More than 800 of these repositories pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver SmartLoader malware [1]. The campaign exploits GitHub's trust model and developer search behavior to distribute malware at scale.
Sources:[1] The Hacker News
Recommended Action
- Audit GitHub repository dependencies and pinned versions in your build pipelines; verify all AI/MCP server packages against official sources.
- Implement branch protection rules requiring code review for all external package additions.
- Enable GitHub's secret scanning and push protection to detect leaked credentials before repository compromise.
2. WordPress Zero-Day Chain: CVE-2026-60137 & CVE-2026-63030 Under Active Exploitation
Severity: HIGH Affected: Technology
Within three days of disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to launch exploit attempts against WordPress installations ⚠ [1]. The coordinated campaign targets one of the largest attack surfaces on the internet, affecting millions of WordPress-powered sites [1].
Sources:[1] Dark Reading
Recommended Action
- Prioritize patching for CVE-2026-60137 and CVE-2026-63030 on all WordPress installations immediately.
- Review WordPress admin logs and file modification timestamps for evidence of prior compromise.
- Enable WordPress security plugins with rate-limiting and WAF rules to block exploit payloads pending patch deployment.
3. SonicWall SMA1000 Zero-Days Exploited for Weeks; Custom Malware Deployed
Severity: HIGH Affected: Technology
Two recently disclosed SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, were exploited in zero-day attacks for weeks before patches became available, allowing threat actors to install custom malware on vulnerable VPN appliances [1]. The threat actor tracked as UTA0533 conducted targeted exploitation ⚠[2].
Sources:[1] BleepingComputer[2] SecurityWeek
Recommended Action
- Apply SonicWall security updates immediately to all SMA1000 appliances; verify patch status in device management console.
- Isolate any SMA1000 appliance with uncertain patch status and inspect logs for suspicious administrative access or process execution.
- Rotate all VPN authentication credentials and monitor VPN session logs for anomalies.
4. HollowGraph Malware: Microsoft 365 Calendar Hijacked for C2 and Data Exfiltration
Severity: HIGH Affected: Technology
A newly discovered espionage implant codenamed HollowGraph uses a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling stolen files as calendar event attachments dated to the year 2050 [1]. The approach exploits legitimate Microsoft 365 infrastructure to evade detection.
Sources:[1] The Hacker News
Recommended Action
- Review Microsoft 365 audit logs for unusual calendar creation, modification, or sharing events; focus on events with future dates (2050+).
- Enforce conditional access policies restricting calendar API access to approved applications only.
- Monitor for mail forwarding rules and calendar sharing changes to external or suspicious accounts.
5. Estée Lauder Breach via Oracle E-Business Suite Vulnerability
Severity: HIGH Affected: Finance
Cosmetics giant Estée Lauder disclosed a data breach after threat actors exploited a flaw in Oracle E-Business Suite that the company used for human resources operations [1]. The incident underscores supply-chain risk in enterprise resource planning (ERP) systems handling sensitive employee data.
Sources:[1] BleepingComputer
Recommended Action
- Audit Oracle E-Business Suite instances for patches; consult Oracle Security Advisories for affected versions.
- Review access controls on HR modules in ERP systems; implement role-based access controls and multi-factor authentication.
- Monitor Oracle database logs for unusual data extraction queries or privilege escalation attempts.
Today’s Action Checklist
- ☐ URGENT: Patch all WordPress instances for CVE-2026-60137 and CVE-2026-63030; verify completion via plugin vulnerability scanners.
- ☐ URGENT: Update all SonicWall SMA1000 appliances (CVE-2026-15409, CVE-2026-15410); rotate VPN credentials.
- ☐ Audit GitHub repository dependencies and lock file integrity; remove any package not from official registries.
- ☐ Review Oracle E-Business Suite patch status; prioritize HR module security if used in your organization.
- ☐ Search Microsoft 365 audit logs for anomalous calendar events with future dates or unusual sharing permissions.