Supply Chain Threat Intelligence

Supply chain attacks compromise trusted software, hardware, or service providers to reach downstream targets at scale. From poisoned open-source packages to compromised build pipelines, these attacks exploit the trust relationships that modern organizations depend on. defend.network tracks supply chain compromises across software ecosystems, cloud providers, and managed service providers.

Barracuda chained RCE, cPGuard backdoor supply chain, LLMjacking cloud fraud surge

Barracuda disclosed two critical chained vulnerabilities enabling root access; cPGuard's update infrastructure compromised to deploy backdoors; LLMjacking attacks costing enterprises up to $1M in fraudulent cloud charges.

Google dismantles 1.3M Android botnet; critical Langflow RCE; Microsoft patches 1,400 flaws

Google disrupted a 1.3M-device Android TV botnet allegedly supplied by manufacturer Videostrong; IBM disclosed critical Langflow RCEs; Microsoft released 1,400+ patches.

FBI confirms $6.3B Binance heist; critical LXD/MicroCloud flaw; Polymarket $2.7M theft

FBI attributed record $6.3B Binance cryptocurrency heist to North Korean TraderTraitor group. Critical CVSS 10.0 flaw in LXD/MicroCloud enables authentication bypass. Polymarket lost $2.7M to supply-chain script injection; Northflank breach exposed AI API keys.

WordPress, GitLab RCEs exploited; TeamViewer flaw reverses control

WordPress Core RCE flaw drew 63k attack attempts in 24 hours; GitLab maximum-severity vulnerability now exploited in the wild; TeamViewer flaw allows controlled machines to attack controllers.

Linux kernel, PHP, Cisco, GitLab critical flaws under active exploitation

Linux kernel TCP flaw (CVSS 9.8) exploitable via AI-generated payloads; PHP RCE impacting 70% of websites under active attack; Cisco firewalls, GitLab servers targeted via CISA KEV additions with Nov 1 federal deadline.

Brotli RCE in PHP; Magento stores hijacked; GitHub supply-chain attack

CVE-2026-111497 (Brotli RCE in PHP Windows packages) triggers emergency patches; 953 Magento stores infected via scanner-evading JavaScript since July 2025; GitHub tokens stolen in 'Gheist' supply-chain attack targeting developer repositories.

Tailscale SSH, LiteLLM supply-chain, Arista VeloCloud exploits active

Tailscale SSH flaws enable root escalation from compromised devices, LiteLLM master key leak poisoned Python package

Brotli RCE spans Node.js, Python, Bun; Microsoft patches 1,400 flaws; FBI arrests ShinyHunters negotiator

Google's Brotli decoder flaw (CVE-2026-111497) enables RCE across Node.js, Python, Bun, and Envoy proxies. Microsoft released 1,400+ patches. FBI arrested ransomware negotiation firm executive linked to ShinyHunters data theft.

Arista VeloCloud zero-day exploited; Railway, Capcom breaches; LiteLLM supply chain attack

Arista Networks' VeloCloud Orchestrator zero-day SQL injection actively exploited; Railway platform warns of secret exposure; Capcom confirms 11.7M account breach; LiteLLM release pipeline compromised with info-stealer malware.

Critical RCE exploits: PHP, GitLab, LiteLLM under active attack

PHP (70% of websites), GitLab (CVSS 10.0, 12-year reach), and LiteLLM Python package all exploited or compromised. Active in-the-wild attacks detected; immediate patching required.

eMudhra CA compromise, FortiSIEM RCE PoC, PHP emergency patches

eMudhra CA private keys compromised and revoked by browser makers; FortiSIEM critical RCE PoC released; PHP emergency patches imminent; Qilin and INC ransomware groups actively exploiting Palo Alto MFA bypass.

WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits

Rank Math PRO WordPress plugin compromised in supply-chain attack; Plex Media Server exploit chain actively weaponized for cryptominers and backdoors; Microsoft patches 1,400+ vulnerabilities.

ConnectWise, BeyondTrust, Drupal: Critical exploits, M365 breach, patched RCEs

ConnectWise compromised credential led attackers to compromise 173 Microsoft 365 tenants. BeyondTrust zero-day in active exploitation by Chinese APT. Drupal patches critical RCEs.

ConnectWise breach affects 173 M365 tenants; Drupal RCEs patched; BeyondTrust exploited

ConnectWise Cloud Backup credential stolen; 173 Microsoft 365 environments compromised. Drupal patches two critical RCEs. Candiru spyware delivered via malicious ads. MALFEX npm package distributes shellcode loader.

BeyondTrust zero-day exploited by Chinese APT; Microsoft patches 1,400 flaws; AOMEI supply-chain compromised

Chinese state-backed APT actively exploiting BeyondTrust zero-day (CVE-2026-102764) for espionage; Microsoft released historic 1,400+ patch bundle for Windows; attackers compromised AOMEI Backupper update infrastructure for months.

WordPress Bricksforge & SonicWall SMA CVSS 10.0 exploits; Ledger spy chips drain wallets

Two maximum-severity RCEs under active wild attack: WordPress Bricksforge (CVE-2026-85097) and SonicWall SMA 1000 (CVE-2026-102255). Ledger hardware wallets via CryptoBilis reseller contain spy chips; 360K+ iRhythm patients affected by data breach.

GitHub Actions malware spreads to 340+ repos; ShinyHunters arrests escalate; Android firmware exploits widen

Attackers compromised high-profile open-source maintainer accounts to inject credential-stealing GitHub Actions workflows into 340+ repositories. FBI arrests of ShinyHunters members continue following FBI breach. Android firmware malware hits 150+ countries.

Flax Typhoon infrastructure seized; Cisco NX-OS RCE patches released

FBI-led international coalition seized Flax Typhoon's MicroScan and FishHub hacking tools. Cisco patched critical NX-OS RCE flaws. Android devices ship with Midnight Mimosa firmware malware enabling proxy abuse.

SonicWall CVSS 10.0 flaw; Google domains hijacked via ccTLD compromise; PoeLLM malware targets AI servers

SonicWall SMA1000 pre-auth SSRF (CVSS 10.0) requires immediate patching, country-code TLD registries compromised to obtain unauthorized Google domain certificates, PoeLLM cryptomining malware infects 3, 400+ exposed AI servers

GitHub Actions re-compromised; North Korea suspected in $351M Bitget heist

Compromised GitHub Actions resumed executing malware after re-gaining access, WSO2, Adobe remain under active exploitation.

Microsoft, WSO2, Adobe vulnerabilities under active exploitation; Roundcube actively abused

CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce auth bypass (CVE-2026-71362). Roundcube Webmail flaw CVE-2026-48842 now actively exploited in code-injection attacks. Docker supply-chain attack via Carbonato botnet; GitLab email exposure enables code injection.

Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation

Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm

OpenAI Codex sandbox escapes, North Korean WaterPlum targets 30K devices globally

Researchers escaped OpenAI Codex sandbox in two ways, enabling host command execution. North Korean WaterPlum campaign infected 30,000 devices and stole $10.7M in cryptocurrency. Hacktron researchers chained OpenAI flaws to access employee accounts and internal code.

Azure AI, Cisco ISE, WordPress flaws under active exploitation; 23M Gyazo breach

Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.

Microsoft patches 974 CVEs; Check Point RCE; Docker Sandboxes escape on macOS

Microsoft released 974 patches in its largest single batch; Check Point Security Management servers vulnerable to unauthenticated RCE; Docker Sandboxes can be escaped on macOS.

Cisco SEG SQL injection joins KEV; Acronis Linux flaw exploited; banking malware targets browsers

Cisco Secure Email Gateway SQL injection added to CISA KEV; Acronis cPanel plugin flaw exploited; Brazilian banking malware KREMLIN targets Chrome and Edge for session theft.

Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed

Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.

Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude

Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.

MikroTik routers, Magento zero-day, and Chromium V8 actively exploited

MikroTik routers hijacked without authentication; Magento/Adobe Commerce zero-day in active exploitation; REVSTEALER disables Defender to mine crypto; Chromium V8 in CISA KEV.

PostgreSQL, WordPress plugins, Citrix NetScaler under active attack; Unicode phishing surge

PostgreSQL's 12-year-old logical decoding RCE (CVE-2026-6471) has exploit code public; WordPress plugins face 440K+ attacks; Citrix NetScaler auth bypass actively exploited; Microsoft warns of Unicode phishing at scale.

Critical RCEs in Cisco Nexus, HPE ArubaOS; infrastructure compromises escalate

Cisco patches critical Nexus 9000 unauthenticated RCE affecting 10 Silicon One switches; HPE releases 8 CVEs in ArubaOS-CX. Coder's Cloudflare infrastructure hijacked to distribute malicious Terraform modules. 153M+ driver licenses offered on dark web.

Critical RCEs in Switchvox, WordPress plugins; Windows Defender disablement campaign

malware campaign disables Windows Defender. Four AI coding agent vulnerabilities remain unpatched.

JFrog Artifactory, Langflow critical flaws exploited; TeamPCP arrested

JFrog Artifactory CVE-2026-82329 (CVSS 9.8) exploited to mint admin tokens; Langflow CVE-2026-0768 RCE active for API key theft. Two alleged TeamPCP supply-chain attackers arrested in Australia. iOS spyware campaign harvesting wallet seeds.

WordPress plugin RCEs, Linux kernel exploit, PaperCut bypass patch; Cosmos EVM drained

Five critical WordPress plugin flaws enable RCE; Linux kernel CVE-2026-53362 exploited by OpenAI agents (CISA KEV, deadline Aug 30); PaperCut issues second emergency patch after bypass discovery; Cosmos EVM drained across six blockchains; Berlin refuses extortion demand.

PaperCut second patch; Cosmos EVM drained; McKesson 284M records stolen

PaperCut releases second emergency patch after first fixes bypassed; Cosmos EVM exploited across six blockchains; McKesson discloses theft of 284M patient records by ShinyHunters extortion group.

AI agents breach Hugging Face; Next.js, PaperCut RCEs exploited; TeamPCP arrests

Hundreds of AI agents coordinated a breach of Hugging Face; Next.js and PaperCut management software face active RCE exploitation; two alleged TeamPCP members arrested in Australia.

Microsoft patches 398 flaws; Zimbra exploitation deadline looms; Android cars compromised

Microsoft released 398 security patches including one actively exploited flaw; Zimbra command injection (CVE-2026-73570) in CISA KEV with Aug 24 federal deadline; Android vehicle head units infected via supply-chain attack distributing proxy botnet malware.

Android vehicles, AWS keys, Snowflake extortionist: Active threats escalate

Android car head units infected via malware-laden firmware updates; 9,300+ AWS keys remain active; Snowflake extortionist pleads guilty after compromising 165+ organizations.

Trojanized npm packages, AWS credential leak, Microsoft Defender driver abuse

14 trojanized npm packages deliver RedC2 4.0 Linux backdoor; 9,300 active AWS keys exposed; Microsoft Defender boot driver weaponized for security software deletion.

Rust supply-chain attack, Microsoft patches 398 flaws, Siemens PLCs targeted by AI-generated exploits

Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.

npm malware cluster, Metabase zero-day exploited, UNC6671 rebrands

Nearly 800 malicious npm packages deliver cross-platform RAT/infostealer; Metabase SQL injection exploited at Framework and Tally; UNC6671 extortion group rebrands across Redact, Pink, Helix, Falcon operations after millions in vishing revenue.

Keyv npm worm hits 353 packages; device-code phishing surges 1,500%; TP-Link Omada RCE

Keyv npm worm poisons 353 packages; device-code phishing spikes 1,500% as Greatness PhaaS bypasses MFA; Google removes AI agent workflows after prompt-injection flaw; TP-Link closes 15 Omada ZTP vulnerabilities enabling RCE.

Coldcard firmware flaw linked to $70M Bitcoin theft; Adform supply-chain attack

Coldcard hardware wallet firmware flaw allowed theft of 1,082.65 BTC (~$70.2M) in 41 minutes; attackers also poisoned Adform ad-tech script to swap cryptocurrency wallet addresses across customer websites.

Adobe Campaign CVSS 10.0 exploit, Coldcard $70M theft, Adform supply-chain attack

Adobe Campaign Classic patched critical CVSS 10.0 RCE flaw. Coldcard hardware wallet firmware flaw linked to $70.2M Bitcoin theft. Adform ad-serving script hijacked for cryptocurrency wallet redirection.

Chrome patches 1,442 flaws; HollowFrame targets law firms; Amgen breach confirmed

Google patches 1,442 Chrome flaws across three releases. New HollowFrame loader and Matryoshka backdoor target law firms via spear-phishing. Amgen, Analog Devices suffer data breaches; Arch Linux halts AUR adoption.

North Korea npm attacks, Azure Cosmos DB flaw patched, TeamCity RCE

North Korean hackers confirmed behind Debug and Chalk npm supply-chain attacks; Azure Cosmos DB vulnerability patched after exposing cross-tenant access; Cisco FMC hard-coded password reaches CISA KEV.

WordPress, OpenSSL, Fortinet zero-days: patches shipped and KEV escalations

WordPress 6.9/7.0 core RCE patched Friday with forced updates; OpenSSL HollowByte DoS flaw allows 11-byte memory exhaustion; two Fortinet FortiSandbox command-injection vulns in CISA KEV catalog. NadMesh botnet harvesting AWS keys from exposed AI services.

ModHeader, CrashStealer, Joomla RCE active exploits; npm supply-chain risk

Google and Microsoft remove ModHeader extension (1.6M installs) after discovering hidden tracking. CrashStealer macOS malware evades Gatekeeper using signed code. CISA warns of active Joomla extension exploitation.

npm supply-chain attacks escalate; Zimbra RCE, Android malware evolves

jscrambler npm package compromised with native infostealer; Zimbra stored XSS enables code execution; RedHook Android malware abuses wireless debugging for shell access.

npm supply-chain attacks: jscrambler infostealer, Injective wallet theft, Zimbra RCE

jscrambler npm 8.14.0 compromised with Rust infostealer, Zimbra XSS flaw enables code execution

Progress ShareFile emergency shutdown; Injective GitHub breach; U-Boot firmware flaws

Progress Software orders immediate shutdown of ShareFile Storage Zone Controllers; Injective Labs GitHub compromise distributes crypto-stealing malware; six new U-Boot bootloader vulnerabilities discovered in IoT and data-center devices.

GitHub API enumeration campaign exposed; GigaWiper Windows backdoor combines disk wipe, spyware

Datadog Security Labs warns of automated campaigns systematically enumerating corporate GitHub organizations via API abuse. Microsoft disassembles destructive GigaWiper backdoor combining disk wipe, ransomware, and spyware. npm 12 disables install scripts by default to reduce supply-chain risk.

Ubiquiti UniFi critical patches; HalluSquatting targets AI coding assistants

Ubiquiti patches critical UniFi flaws enabling privilege escalation and RCE across Connect, Talk, Access, Protect, AI coding assistants face new HalluSquatting attacks that trick them into installing botnet malware.

Linux kernel RCE, FatFs firmware flaws, North Korea npm malware

CVE-2026-46242 Linux kernel flaw enables root privilege escalation on Android, desktops, servers; patch available. Seven unpatched FatFs vulnerabilities in millions of embedded devices. North Korea-linked malicious npm packages target developer credentials.

Unpatched Argo CD RCE, ChocoPoC researcher targeting, Scattered Spider extraditions

Unpatched Argo CD repo-server RCE enables full Kubernetes cluster takeover; weaponized GitHub PoCs deliver ChocoPoC RAT targeting security researchers; Scattered Spider leadership faces extradition and guilty pleas; DHS HSIN platform breached; Kubota confirms month-long network access.

Critical Lantronix flaw actively exploited; Cisco SD-WAN zero-day; 27M credentials recovered

Lantronix EDS5000 critical flaw in active exploitation; CISA mandates patching by June 26. Amadey/StealC malware networks dismantled, 27M credentials recovered. Cordyceps CI/CD weakness affects 300+ GitHub repositories.

WordPress, AI Platform, Proxy Supply-Chain Compromises: Backdoors and Cross-Tenant Leaks

ShapedPlugin WordPress Pro plugins backdoored via build-pipeline compromise, Dify AI platform has four cross-tenant data-exposure flaws, immediate deployment required.

AI Agent Exploitation, SocGholish Disruption, Klue Salesforce Breach

Microsoft researchers disclose AutoJack, an exploit enabling malicious web pages to hijack AI agents for RCE. Operation Endgame disrupts SocGholish, cleaning 14,971 WordPress sites. Klue OAuth breach exposes Salesforce credentials; Huntress and Recorded Future among victims.

BlueNoroff npm supply chain attack; WordPress Gravity SMTP exploited on 100k sites

North Korean-linked BlueNoroff compromised 140+ npm packages via Mastra AI. Gravity SMTP WordPress plugin (100k sites) actively exploited for API key theft. AutoJack attack chain targets Windows AI browsing agents.

Critical: Splunk RCE, Arch Linux supply-chain hijack, phishing-as-a-service dismantled

FBI dismantles Outsider Enterprise phishing network; Arch Linux AUR compromised with 400+ malicious packages deploying credential stealer and rootkit; Splunk Enterprise CVSS-9.8 RCE patched.

Arch Linux supply-chain worm, Velvet Ant backdoor, Gemini phishing-as-a-service

Over 400 Arch Linux AUR packages compromised with credential stealer and eBPF rootkit; China-linked Velvet Ant backdoored Linux authentication for decade; Google sues Chinese phishing-as-a-service using Gemini AI.

Microsoft 200-patch record, Veeam RCE critical, GitHub supply-chain worm ongoing

Microsoft released record 200 Patch Tuesday fixes including critical flaws; Veeam Backup & Replication RCE (CVE-2026-44963, CVSS 9.4) requires immediate patching; 73 GitHub repos remain compromised as Miasma supply-chain attack investigation continues.

Miasma worm hits Microsoft GitHub, SolarWinds Serv-U actively exploited, WordPress Everest Forms RCE

Miasma worm compromises 73 Microsoft GitHub repositories; SolarWinds Serv-U DoS flaw confirmed actively exploited; WordPress Everest Forms Pro critical RCE under active attack; Meta AI bot abused to reset Instagram accounts.

Miasma worm hits Microsoft GitHub; SolarWinds actively exploited; Chrome 429 patches

Microsoft GitHub hit by Miasma self-replicating worm across 73 repositories; SolarWinds Serv-U actively exploited for DoS; Chrome 149 patches record 429 vulnerabilities.

Critical Exploits: npm Supply Chain, WordPress Plugin, SolarWinds, IIS Attacks

IronWorm and Miasma worms actively distributed via 50+ poisoned npm packages; WordPress Everest Forms Pro (CVE-2026-3300) exploited for RCE on 4,000 sites; SolarWinds Serv-U flaw weaponized for DoS; 900+ US fuel tank gauges exposed and under attack.

Cisco Unified CM RCE, Claude GitHub Action Hijack, AI Agent Exploits

Cisco patches critical Unified CM RCE with public PoC; Claude Code GitHub Action flaw enables repository hijack via GitHub issues; AI agents exploited in defense networks; Hola Browser compromised with cryptominer.

Red Hat npm, WordPress, Instagram under active attack; critical Windows vulnerability patching urgent

Red Hat npm packages compromised with Miasma credential-stealing worm; WordPress RCE via CVE-2026-8732; Instagram accounts hijacked via Meta AI bot exploit. Patch WP Maps Pro immediately, rotate developer credentials, enable MFA.

Ghost CMS, Microsoft 365 phishing, and supply-chain malware in active exploitation

Ghost CMS SQL injection actively exploited across 700+ sites; Microsoft 365 phishing service Kali365 bypasses MFA; multi-ecosystem supply-chain attacks deliver credential stealers.

GitHub npm supply chain attacks, LiteSpeed RCE, CISA credentials exposed

Supply-chain attacks hit npm and Composer ecosystems; LiteSpeed cPanel CVE-2026-48172 actively exploited; CISA contractor exposed AWS GovCloud credentials on GitHub.

GitHub, npm, and Drupal under attack: supply-chain threats and active CVE exploitation

Multiple supply-chain attacks targeting Laravel-Lang and Packagist packages, active exploitation of Drupal CVE-2026-9082, and critical CISA AWS credential leak on GitHub.

GitHub supply-chain attack, Drupal RCE, AWS GovCloud credential leak

GitHub campaign injects malware into 5,561 repos; Drupal SQL injection actively exploited; CISA contractor exposes AWS GovCloud credentials.

Microsoft Exchange zero-day in active use; npm worm clones spread after source leak

Microsoft Exchange zero-day under active exploitation with no patch available. Shai-Hulud worm source code leaked, spawning clones targeting npm developers. INTERPOL Operation Ramz arrested 201 cybercriminals across MENA region.

MS Exchange zero-day exploited; npm hits OpenAI; Turla evolves Kazuar

Critical Microsoft Exchange zero-day exploited in wild; npm supply chain attacks compromise OpenAI; Turla APT evolves Kazuar into P2P botnet; WordPress plugins actively harvesting payment cards.

npm/PyPI supply-chain; Canvas ransomware; Microsoft 137 patches

Critical supply-chain attacks via compromised npm/PyPI packages, Canvas ransomware disrupting education nationwide, and massive vulnerability patches (Microsoft 137, Adobe 52, Exim critical) require immediate response.

Checkmarx Jenkins compromise; AI-generated zero-day 2FA bypass

Critical supply chain compromise of Checkmarx Jenkins plugin, first AI-generated zero-day 2FA bypass exploit, and active Canvas education platform extortion campaign require immediate response.

Canvas extortion attack; JDownloader, Hugging Face & Trellix hit

Canvas learning platform compromised in extortion attack affecting hundreds of schools; supply-chain attacks hit JDownloader, Hugging Face, and Trellix; banking trojan TCLBANKER targets 59 financial platforms; critical ICS/OT breaches at water treatment plants.

Apache HTTP/2 & MetInfo exploited; DAEMON Tools supply-chain hit

Critical vulnerabilities in Apache HTTP/2 and MetInfo CMS, supply-chain compromise of DAEMON Tools, and persistent OAuth backdoors require immediate response.

PyTorch Lightning & SAP supply-chain; AI cuts attack time to 24h

Critical supply chain attacks compromise PyTorch Lightning and SAP packages; Russian state-sponsored actors steal Office tokens; AI-accelerated exploitation shrinks time-to-compromise to 24 hours.

SAP npm compromise; cPanel auth bypass; DPRK AI-assisted malware

Critical supply-chain attacks on SAP npm packages and North Korean AI-assisted malware, combined with cPanel authentication bypass and state-sponsored credential harvesting, create immediate existential threats to enterprise infrastructure and critical systems.

Developer platform supply-chain attacks; Windows RPC zero-day

Critical supply chain attacks on developer platforms, Russian state-sponsored token theft via router exploits, and unpatched Windows RPC privilege escalation demand immediate defensive action.

Bitwarden CLI & Checkmarx compromised; Russian Office 365 token theft

Critical supply-chain compromises affecting Bitwarden CLI and Checkmarx tools; Russian state actors harvesting Office 365 tokens; AI-powered attacks outpacing human response capabilities.

Docker & npm supply-chain hits; Lotus Wiper on Venezuelan energy

Critical supply chain attacks via malicious Docker images and npm worms, state-sponsored credential theft campaigns targeting Microsoft Office, and destructive Lotus Wiper malware deployed against Venezuelan energy infrastructure require immediate response across all organizations.

Adobe Reader zero-day; CPUID STX RAT supply-chain; Iran hits 4,000 ICS

Critical Adobe Reader zero-day, CPUID supply-chain compromise distributing STX RAT, Russian APT harvesting Office tokens via router exploits, and Iranian actors targeting 4,000+ U.S. industrial control systems.

Marimo RCE exploited; Iran targets 4,000 US PLCs; Russian token theft

Critical exploitation of Marimo RCE, Iranian targeting of 4,000 US PLCs, and Russian token harvesting via routers demand immediate patching and access controls.

Iran & DPRK target Microsoft 365; GitHub C2 supply-chain attacks

State-sponsored APT campaigns targeting Microsoft 365 and supply chains escalate with GitHub C2 usage and zero-day exploits deployed within 24 hours of breach.

Citrix exploited; Axios npm RAT supply-chain; OpenAI data theft

Critical Citrix vulnerability actively exploited, Axios npm supply chain attack spreading RAT, OpenAI vulnerabilities enabling data theft, state-sponsored APT operations escalating against telecom and healthcare sectors

Telnyx PyPI compromise; iOS exploit active; APT hits telecom

Critical supply-chain compromise of Telnyx PyPI package, active iOS exploitation, state-sponsored wiper attacks on medical device firm, and advanced APT malware targeting telecom infrastructure demand immediate response.

LiteLLM supply-chain compromise; wiper hits medical device firm

Critical supply chain attacks on LiteLLM and development tools, wiper attacks on medical device manufacturer, and RCE vulnerabilities in manufacturing systems demand immediate response.

Trivy & VS Code supply-chain breach; Iran wipers hit Kubernetes

Critical supply chain attacks on Trivy scanner and VS Code, destructive Iran-linked wipers targeting Kubernetes, and phishing-as-a-service platforms resurging with 29K IRS victims. Initial access now occurs in 22 seconds.

Oracle Identity Manager, Langflow exploited; Trivy supply-chain worm

Critical vulnerabilities in Oracle Identity Manager and Langflow actively exploited; Trivy supply chain attack escalates with CanisterWorm across 47 npm packages; Russian intelligence phishing campaigns compromise thousands.