Tag: supply chain attack
112 articles
PickleScan Exclusive: Critical Flaws Rock AI Supply Chains
Researchers disclosed three critical PickleScan zero-days that let attackers stealthily swap or tamper with local AI models—injecting misinformation, bias, or even exfiltrating data from Python/PyTorch model runners. Exploitable via drive-by browser-origin attacks against assumed-safe local admin endpoints, these flaws show how our trusted AI tooling can become the weakest link in the supply chain.
Cyber-Attack Exclusive: Severe OnSolve CodeRED Outage
Imagine the sirens going silent: when INC Ransom hit OnSolve’s CodeRED, communities missed vital alerts and scrambled to improvise slow, unreliable backups. The outage — and exposed user data — lays bare how dangerously dependent public safety has become on just a few commercial providers.
Russian-linked Malware: Dangerous, Stunning Blender Threat
Think twice before opening that .blend—Morphisec found Russian-linked StealC V2 hidden inside Blender project files, so importing a shared 3D asset can trigger a stealthy multi-stage stealer. Artists and studios should start treating downloaded .blend files like potential executables until vetting becomes routine.
Gainsight Exclusive: Critical Hack Risks Salesforce Clients
Urgent heads-up: a critical Gainsight hack could expose Salesforce clients’ data—here’s what happened and how to protect your systems.
SEC Stunning Move Drops SolarWinds Case, Costly Fallout
The SEC’s abrupt request to dismiss its high‑profile lawsuit over the 2020 SolarWinds supply‑chain breach has left investors, technologists and policymakers wondering what it signals about enforcement, deterrence and the limits of cyber regulation. After years of litigation that promised to redefine how securities law treats cybersecurity, the surprising reversal raises urgent questions about accountability and how companies should disclose cyber risk.
GlobalLogic Exclusive: Severe Oracle EBS Cl0p Attack
GlobalLogic pulls back the curtain on a severe Cl0p Oracle EBS attack. Learn what went wrong, who’s at risk, and the simple steps you can take now to protect your systems.
Malware-Laden Apps: Stunning Threat in 41M Play Store Installs
Think the Play Store is safe? Researchers found hundreds of malicious Android apps that slipped past vetting and amassed tens of millions of installs—using hijacked SDKs, repackaged binaries and delayed activation to turn everyday apps into stealthy attack platforms.
Invisible npm malware: Exclusive, Dangerous Token Theft
PhantomRaven quietly slipped into the npm registry, turning routine installs into token theft by harvesting credentials during install and letting attackers publish malicious updates without touching your code. One stolen token can cascade through thousands of projects—here’s why supply‑chain hygiene and MFA matter now.
Shaq’s new ride Exclusive: Costly Hijack Exposed
Shaq’s new ride reveals a surprising weak spot: when celebrities rely on niche customization shops for bespoke engineering, those small specialists — holding valuable blueprints and client data — become prime targets for savvy criminals. A breach can mean leaked designs, stolen invoices and lucrative leverage for extortion.
Cyberattack Disrupts European Airports: Exclusive Crisis
A cyberattack disrupts European airports — when screens go dark and check‑in kiosks freeze, travelers face long lines while staff switch to exhausting manual workarounds and cyber and law‑enforcement teams race across borders to restore systems and hunt the attackers.
Lazarus Group Exclusive: Critical Threat to Europe’s Defense
Who’s stealing Europe’s drone blueprints — and why? Investigators now point to North Korea’s Lazarus Group and Operation DreamJob, a stealthy campaign targeting small defense firms to grab design files, accelerate domestic drone programs, and probe weaknesses in Europe’s nascent “drone wall.”
Lazarus Group Exclusive: DreamJob Threatens EU Defenses
“If you build it, they will steal it” — North Korea’s Lazarus Group is quietly targeting EU drone engineers, lifting schematics, firmware, and supplier data to speed or sabotage adversaries’ emulation of Western platforms. The result: stolen designs and corrupted files that can derail production and readiness without a single shot fired.
supply chain attack: Stunning, Risky Threat to Passengers
LNER has confirmed a supply-chain attack on a third-party supplier exposed some customers’ contact and journey details, and the company is notifying those affected and offering support. If trusted partners can become breach points, passengers are rightly asking who’s protecting their privacy.
malicious npm code: Critical Risk, Must-Have Defenses
Think supply chain attacks are theoretical? Wiz found malicious npm code in about 10% of cloud environments — proof a single tainted dependency can ripple across services. Treat dependencies like security controls: use SBOMs, provenance checks, and runtime defenses to keep builds safe without slowing teams down.
supply chain attack: Stunning Near-Miss, Risky Lessons
A fast, coordinated open‑source response helped avert what could have been a massive npm supply‑chain breach, but the near miss raises urgent questions for developers, maintainers and policymakers about dependency hygiene, registry controls and long‑term resilience.
OAuth token theft: Must-Have Fixes After Risky Breach
When OAuth token theft let attackers roam across integrations, Salesloft temporarily pulled Drift offline to stop the bleeding and fully review security. It’s a wake-up call: short-lived tokens, tighter scopes and rapid rotation are essential to keep integrations—and customer data—safe.