TL;DR
GitHub suffered a significant breach with thousands of internal repositories stolen by TeamPCP [5]. Microsoft disrupted a malware-signing operation and released new AI security tools [1, 2]. Multiple critical vulnerabilities require urgent patching across SonicWall VPN, Drupal, and operational technology systems [7, 10, 20].
Executive Summary
- GitHub confirmed unauthorized access to internal repositories after threat actor TeamPCP claimed theft of 3,800+ repos; no evidence of customer data impact reported.
- Microsoft disrupted a malware-signing-as-a-service operation that weaponized its Artifact Signing system to deliver ransomware and other attacks.
- SonicWall VPN appliances remain exploitable due to incomplete patching, allowing MFA bypass and credential brute-force attacks.
- Drupal and operational technology platforms face critical vulnerabilities with high exploitation risk requiring same-day updates.
- Webworm, a China-aligned threat actor, deployed custom backdoors using Discord and Microsoft Graph API for command-and-control communications.
Top Threats Today
1. GitHub Breach – 3,800+ Internal Repositories Stolen
Severity: HIGH Affected: Technology
GitHub confirmed unauthorized access to its internal repositories following an employee device compromise [1]. Threat actor TeamPCP claimed responsibility and listed GitHub’s source code and internal organizations for sale on a cybercrime forum [1]. The breach involved theft of over 3,800 internal repositories [2]. GitHub stated it currently has no evidence of impact to customer information [1], though the scope of internal systems accessed warrants heightened monitoring.
Sources:[1] The Hacker News[2] Dark Reading
Recommended Action
- Rotate all GitHub organization tokens, deploy keys, and SSH credentials with creation dates prior to breach discovery
- Audit access logs for all GitHub enterprise accounts for the past 60 days
- Enable hardware security key enforcement for all administrative GitHub accounts
- Monitor for leaked credentials and internal documentation in cybercrime forums and paste sites
2. Microsoft Disrupts Malware-Signing-as-a-Service Operation
Severity: HIGH Affected: Technology, Multiple Sectors
Microsoft dismantled a malware-signing-as-a-service (MSaaS) operation that weaponized the company’s Artifact Signing system to deliver malicious code and conduct ransomware and other attacks [1]. The operation compromised thousands of machines and networks across the world [1]. This represents a supply-chain compromise of Microsoft’s code-signing infrastructure, creating widespread trust-chain vulnerabilities.
Sources:[1] The Hacker News
Recommended Action
- Review code-signing certificate chains and artifact provenance in your build pipelines
- Implement certificate pinning for critical software dependencies
- Audit execution logs for binaries signed during the active period of the MSaaS operation
- Enforce Windows SmartScreen and code-signing validation across enterprise endpoints
3. SonicWall VPN MFA Bypass via Incomplete Patching
Severity: HIGH Affected: Technology, Finance, Government
Threat actors successfully brute-forced VPN credentials and bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances [1]. The attacks enabled deployment of ransomware tools [1], indicating active exploitation in operational environments. Organizations that have not fully patched these appliances remain at critical risk.
Sources:[1] BleepingComputer
Recommended Action
- Verify all SonicWall Gen6 SSL-VPN systems are patched to the latest firmware build
- Enable account lockout policies after 3-5 failed login attempts
- Implement IP-based access restrictions and geographic filtering on VPN gateways
- Monitor VPN logs for unusual authentication patterns and credential reuse
- Consider network segmentation to limit lateral movement from VPN endpoints
4. Drupal Critical Security Release with High Exploitation Risk
Severity: HIGH Affected: Technology, Education, Government
Drupal announced a “core security release” addressing a critical bug with high exploitation risk [1]. The project warned that threat actors might develop working exploits within hours of update disclosure [1], indicating the vulnerability affects core functionality and carries immediate risk.
Sources:[1] BleepingComputer
Recommended Action
- Deploy Drupal core security patch immediately upon availability
- Prioritize patching for internet-facing Drupal instances
- Monitor Drupal logs for suspicious queries, SQL injection attempts, and unusual administrative activity
- Consider temporary IP whitelisting on Drupal admin interfaces during the patch window
5. Webworm APT Deploys Custom Backdoors via Discord and Microsoft Graph API
Severity: HIGH Affected: Government, Technology, Finance
Cybersecurity researchers flagged fresh activity from Webworm, a China-aligned threat actor, in 2025 deploying custom backdoors named EchoCreep and GraphWorm [1]. These backdoors employ Discord and Microsoft Graph API for command-and-control communications [1], leveraging legitimate services to evade traditional network detection. This represents an evolution in APT tradecraft using consumer and enterprise cloud services as C2 channels.
Sources:[1] The Hacker News
Recommended Action
- Block or restrict Discord, Telegram, and Slack API traffic from enterprise endpoints unless explicitly required
- Review Microsoft Graph API permissions assigned to service principals and applications
- Monitor for unusual OAuth token grants to third-party applications
- Implement DNS and proxy filtering for known C2 infrastructure associated with Webworm
- Audit user mailboxes and cloud storage for indicators of data exfiltration
Today’s Action Checklist
- ☐ URGENT: Patch SonicWall Gen6 SSL-VPN appliances to latest firmware and verify MFA enforcement
- ☐ URGENT: Deploy Drupal security release immediately upon availability
- ☐ HIGH: Rotate GitHub organization and deploy tokens; audit admin access logs
- ☐ HIGH: Review code-signing certificate provenance in build pipelines and enable signature validation
- ☐ Monitor for Webworm indicators of compromise; restrict Discord/Graph API from endpoints
- ☐ Scan logs for SonicWall MFA bypass attempts and suspicious VPN authentication patterns