TL;DR
GitHub targeted by automated malware campaign injecting 5,718 commits into 5,561 repositories; Drupal SQL injection flaw under active attack; CISA contractor exposed AWS GovCloud credentials on public GitHub repository.
Executive Summary
- A coordinated GitHub attack campaign called Megalodon pushed malicious CI/CD workflows across thousands of repositories in a six-hour window, targeting developer supply chains [3].
- Drupal users face active exploitation of a critical SQL injection vulnerability (CVE-2026-9082) disclosed this week, with attackers targeting thousands of sites [9, 26].
- CISA contractor exposure of AWS GovCloud keys and internal agency secrets on a public GitHub repository has prompted Congressional demands for investigation [11, 13].
- Law enforcement arrested a Canadian botnet operator running the Kimwolf DDoS-for-hire service that infected over a million devices worldwide [5, 12, 25].
- First VPN, a criminal infrastructure service used by 25 ransomware groups, was dismantled in a coordinated law enforcement operation [1].
Top Threats Today
1. Megalodon GitHub Campaign – Supply Chain Malware Injection
Severity: HIGH Affected: Technology
Cybersecurity researchers have disclosed a large-scale automated campaign called Megalodon that pushed 5,718 malicious commits to 5,561 GitHub repositories within a six-hour window [1]. The attackers used throwaway accounts and forged author identities including build-bot, auto-ci, ci-bot, and pipeline-bot to inject malicious CI/CD workflows [1]. This campaign represents a direct threat to software supply chain integrity, as compromised repositories could distribute malware to organizations depending on affected code.
Sources:[1] The Hacker News
Recommended Action
- Audit repository commit history for suspicious build-bot or automated account activity in the past week
- Review CI/CD pipeline configurations for unexpected workflow changes or suspicious automation rules
- Enable branch protection rules requiring human review before CI/CD pipeline execution
- Implement webhook and repository access logging to detect unauthorized commits
2. Drupal CVE-2026-9082 – Critical SQL Injection Under Active Attack
Severity: HIGH Affected: Technology
Drupal is warning that hackers are actively attempting to exploit a critical SQL injection vulnerability announced earlier this week [1]. Security firms are observing attacks against thousands of websites, indicating widespread exploitation efforts in the wild [2]. The vulnerability (CVE-2026-9082) poses immediate risk to any unpatched Drupal installation due to its exploitability and the attacker activity already detected [2].
Sources:[1] BleepingComputer[2] SecurityWeek
Recommended Action
- Apply Drupal security update immediately to all affected instances
- Review database access logs for suspicious SQL query patterns or unauthorized data access
- Monitor for indicators of data exfiltration or unauthorized administrative account creation
- Implement Web Application Firewall (WAF) rules to block SQLi payloads as interim protection
3. CISA Contractor GitHub Credential Exposure – AWS GovCloud Compromise
Severity: HIGH Affected: Government
A CISA contractor maintained a public GitHub repository exposing credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems [2]. The repository remained publicly accessible until this past weekend, creating an extended window for unauthorized access to federal infrastructure credentials [2]. Lawmakers in both houses of Congress are demanding answers from CISA regarding the scope and impact of the exposure [1].
Sources:[1] Krebs on Security[2] Krebs on Security
Recommended Action
- Immediately rotate all exposed AWS GovCloud credentials and review access logs for unauthorized usage
- Audit all systems whose credentials were stored in the public repository for signs of compromise
- Implement secrets scanning in all GitHub repositories to prevent future credential commits
- Establish mandatory pre-commit scanning for sensitive data in all government contractor development workflows
4. Kimwolf DDoS Botnet – Operator Arrested After Infecting Millions
Severity: HIGH Affected: Multiple
Jacob Butler, 23, of Ottawa, Canada, has been arrested on suspicion of operating Kimwolf, a fast-spreading Internet-of-Things botnet [2]. The botnet enslaved over a million devices worldwide for use in a series of massive distributed denial-of-service attacks over the past six months [2][3]. The U.S. Department of Justice charged Butler in connection with the development and operation of the DDoS-for-hire service [1].
Sources:[1] The Hacker News[2] Krebs on Security[3] The Record
Recommended Action
- Scan IoT and edge devices on your network for Kimwolf indicators of compromise (IOCs provided by law enforcement)
- Update firmware on all IoT devices to the latest patched versions
- Implement network segmentation to isolate IoT devices from critical infrastructure
- Monitor for suspicious outbound traffic from IoT devices indicative of botnet command-and-control communication
5. First VPN Dismantled – Ransomware Infrastructure Disruption
Severity: MEDIUM Affected: Multiple
Authorities in Europe and North America have announced the dismantling of First VPN Service, a criminal virtual private network used by criminal actors to obscure the origins of ransomware attacks, data theft, scanning, and denial-of-service attacks [1]. The disruption was led by France and targeted an infrastructure service reportedly used by 25 ransomware groups [1]. While this represents a significant law enforcement success, it reflects the ongoing threat posed by criminal infrastructure services enabling ransomware operations.
Sources:[1] The Hacker News
Recommended Action
- Review threat intelligence reports on compromised credentials or data leaked during First VPN disruption
- Monitor for ransomware group activity shifts as operators migrate to alternative infrastructure providers
- Enhance detection for VPN-obfuscated intrusion traffic using behavioral analytics and anomaly detection
Today’s Action Checklist
- ☐ URGENT: Patch all Drupal instances to address CVE-2026-9082 SQL injection under active attack
- ☐ URGENT: Rotate AWS GovCloud credentials exposed in CISA contractor GitHub repository; audit access logs
- ☐ HIGH: Audit GitHub repositories for Megalodon-style malicious commits using forged automation account names
- ☐ HIGH: Scan IoT/edge devices for Kimwolf botnet indicators and update firmware
- ☐ Enable secrets scanning in all GitHub repositories to prevent credential commits