ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
Stolen credentials, which dominated cyberattacks for 20 years, are losing ground to AI-enabled threats that bypass traditional security controls. Defenders invested heavily in credential protection may now face blindsided organizations as attackers shift toward more sophisticated, harder-to-defend i
Google exposed a critical Chromium flaw allowing silent botnet attacks. Service Workers execute persistent JavaScript even after browsers close, affecting billions of Chrome, Edge, and other Chromium users without any user interaction or notification.
Modern attacks exploit trust rather than vulnerabilities—using compromised credentials, legitimate access, and trusted channels. The real threat has shifted from stopping intruders to defending against abuse of systems we've already authorized.
Lucifer is a Drainer-as-a-Service automating cryptocurrency theft through phishing and fake token approvals instead of technical hacking. It tricks users into voluntarily authorizing their own wallet theft, democratizing attacks for non-technical criminals and representing a major shift in crypto se
Identity has replaced perimeter security as the primary attack vector. A single compromised credential can access critical systems; identity weaknesses factor into 90% of incident investigations.
3,800 GitHub repositories were breached through a compromised Nx Console extension in a TanStack npm supply-chain attack. Attackers gained developer credentials; no customer data was exposed.
GitHub's internal repos were breached via a trojanized Nx Console extension live for just 18 minutes. The malware stole developer credentials by disguising itself as routine MCP setup code, targeting 1Password, Claude API keys, and npm tokens.
Hacking tools are democratizing, enabling amateurs to compromise critical infrastructure. A teen halted trains with £300 of radio equipment, exposing how obscurity-based security fails.
Massachusetts found weak passwords, unpatched systems, and poor processes remain the top breach drivers despite state security laws. Culture and operational discipline matter more than technology or tools.
GitHub's ~4,000 internal repositories were breached via a malicious VS Code extension on an employee device, detected and contained May 19, 2026. Threat actor TeamPCP claims the haul and plans to sell or publicly leak the stolen code.
A missed GitHub token during emergency rotation gave TeamPCP attackers access to Grafana's source code and business data. The breach exposed gaps in crisis response procedures, though no customer production data was compromised.
1Password and OpenAI partner to prevent AI coding agents from leaking secrets via just-in-time credential access. This addresses prompt injection and context contamination risks that expose credentials during normal AI operation.
Attackers compromised 320+ npm packages via the 'atool' account, including timeago.js and echarts-for-react used by millions of developers. The Mini Shai-Hulud campaign published 639+ malicious versions designed to steal cloud credentials, CI/CD secrets, and cryptocurrency wallets during installatio
Attackers now compromise legitimate third-party scripts to steal data at runtime—bypassing all security detection. A trojanized Chrome extension stole $8.5M from Trust Wallet users, highlighting how supply chain threats have evolved beyond the user-error phase.
GitHub suffered a breach when a malicious VS Code extension compromised an employee device, exfiltrating 3,800+ internal repositories. The TeamPCP threat group claimed responsibility and is selling the stolen code on darknet forums for at least $50,000.
GitHub's ~3,800 internal repos were breached after an employee installed a malicious VS Code extension. No customer data was exposed, but the incident reveals IDE extension ecosystem risks.
GitHub's ~4,000 internal repositories were breached via a poisoned VS Code extension, with TeamPCP claiming responsibility and demanding $50K—or threatening free data release if unpaid. No customer data was compromised, limiting external impact.
Grafana Labs' GitHub was breached via the TanStack npm attack, exposing internal code and data. The same campaign targeted OpenAI and Mistral AI, demonstrating the cascading risk of compromised open-source dependencies in developer infrastructure.
GitHub investigates unauthorized access to ~4,000 internal code repositories. Hacker group TeamPCP demands $50K ransom, threatening to leak if rejected, but GitHub reports no customer data compromise.
7-Eleven disclosed a major data breach affecting 600,000+ records stolen by ShinyHunters in April 2026. After refusing extortion demands, the cybercriminals released 9.4GB of corporate documents, marking one of the largest retail sector breaches.
639 npm package versions were weaponized in a one-hour attack by Shai-Hulud, the third wave of a persistent supply chain campaign. The attack demonstrates new sophistication—forging legitimate signatures and targeting dormant projects with millions of downloads.
Despite 20 years of security evolution toward zero-trust architectures, organizations still fail at fundamental hygiene—the critical gap that enables sophisticated attacks.
EvilTokens, a phishing platform, compromised 340+ Microsoft 365 organizations by exploiting OAuth consent during MFA verification. Users unknowingly grant attackers full data access while believing they're authenticating securely, rendering traditional MFA protections ineffective.
B1ack's Stash released 4.6M stolen credit cards for free, punishing vendors who resold data illegally. ~4.3M usable records now flood the entire cybercriminal community, exponentially increasing fraud risk.
Compromised Nx Console infected 2.2M VS Code developers on May 18, stealing credentials from 1Password, GitHub, npm, and AWS. Multi-stage payload delivered a persistent macOS backdoor in an 11-minute exposure window.
Attackers compromised 639 npm packages via exploited maintainer account in the @antv ecosystem. The Mini Shai-Hulud campaign distributed self-replicating malware affecting popular visualization libraries and development tools.
CISA contractor's GitHub repository exposed AWS GovCloud credentials, plaintext passwords, and internal deployment files in what security researchers called the worst government data leak in recent years. The public repo contained administrative access tokens, SSH keys, and internal system passwords
Iranian hackers compromised automatic tank gauge (ATG) systems at US gas stations and altered fuel level displays. However, the attack was limited—no fuel was actually stolen and station operations weren't disrupted.
A stolen GitHub token gave attackers access to Grafana's codebase. The breach reveals how compromised developer credentials pose critical supply chain risks to vendors and downstream customers.
ShinyHunters stole 600,000+ 7-Eleven Salesforce records and threatens double-extortion. The breach highlights vulnerabilities in retail cloud platforms to indiscriminate data theft operations.