Tag: supply chain
1740 articles
JADEPUFFER Exploits Azure Compromise for Destructive Attacks
JADEPUFFER hackers exploited a compromised Azure account to unleash a wave of destructive attacks, wreaking havoc on sensitive data and services by targeting key areas like Storage Accounts, SQL databases, and Virtual Machines. They pulled off this chaos by cleverly using compromised service principals to gain control.
AI Deployments Expose Governance Gaps via MCP Servers
A recent analysis of 5,095 unique MCP hostnames revealed a staggering 16% were accessible outside the US, including in high-risk countries like Russia and China, highlighting a glaring governance gap in AI deployments. This oversight allows AI integrations to bypass enterprise controls, creating a silent security risk.
China Blurs Lines Between Civilian, Military Logistics at Sea
China is blurring the lines between civilian and military logistics at sea, using commercially owned ships to perform support tasks traditionally reserved for naval vessels. Sinotrans, a leading logistics company, is at the forefront of this approach, leveraging its fleet to provide at-sea replenishment services alongside PLAN warships.
Citrix NetScaler Zero-Days Exploited in Wild Ahead of Patches
Citrix administrators were abruptly warned to shut down their NetScaler appliances amid reports of zero-day exploits being used in the wild, with private alerts circulating before patches were available. The sudden shutdowns followed discreet notifications from IT suppliers, security teams, and law enforcement, leaving many scrambling for answers.
Google Warns of Mass Exploitation of Oracle PeopleSoft Flaw
Google warns of a massive global campaign exploiting a critical Oracle PeopleSoft flaw, CVE-2026-35273, that allows hackers to remotely execute code without authentication, now targeting industries from healthcare to government. The attack, linked to ShinyHunters, has already compromised dozens of machines worldwide.
GitHub Actions Re-Exposure Leaves Developers Vulnerable
GitHub Actions were recently re-exposed, leaving developers vulnerable to attacks after two compromised third-party actions were re-enabled with malicious code still linked to their release tags. This security lapse put users at risk, as workflows referencing the actions could have executed the malicious payload.
Pentagon Targets Resilient Logistics Networks for Contested Environments
In a future fight, the backbone of logistics isn't just about moving supplies, but also about maintaining a resilient digital network that keeps commanders informed and one step ahead. The Pentagon is zeroing in on building logistics networks that can withstand pressure and keep critical operations running smoothly in contested environments.
OpenAI AI Agents Expose User Images in Third-Party Sites
OpenAI has confirmed a security incident where its AI agents accidentally shared 53 user-uploaded images with third-party sites, but stresses that most users were unaffected and the breach was limited in scope. The mishap occurred when research environment agents transmitted training data while using external image-hosting services.
Kiteworks Alerts Customers to Possible Cyber Attack, Urges 9-Hour System Shutdown
Kiteworks has issued a critical alert to customers after receiving credible threat intelligence from federal authorities suggesting a potential cyber attack, and is urging a 9-hour system shutdown as a precautionary measure to ensure safety. The company emphasizes that this is a preventative move, with no evidence of customer system compromise.
Elementor Plugin CSRF Flaw Enables Site Takeovers
A single click on a malicious link by a logged-in WordPress user can be all an attacker needs to take control of a site, thanks to a critical flaw in the popular Elementor Website Builder plugin. This shocking vulnerability allows hackers to execute any action a user's account can perform, with just one cleverly crafted link.
Defense Tech Firms Accelerate Innovation to Meet Expanding US Warfighter Needs
As threats escalate daily, defense tech firms are racing to innovate and meet the growing needs of US warfighters. Top industry leaders gathered at Piper Sandler's Government and Defense Technology CEO Summit to tackle this pressing challenge and outline their strategies for success.
Kiteworks Orders Global Server Shutdown Over Zero-Day Threat
Kiteworks has issued a rare global server shutdown alert due to a credible threat of an imminent cyberattack, urging customers to power down their servers for six hours on Saturday. The shutdown window spans multiple time zones, from Australian Eastern Standard Time to Pacific Daylight Time, to protect against the potential threat.
ShinyHunters Exploits Grav CMS Flaw to Breach Clop Leak Site
The Grav CMS flaw, tracked as CVE-2026-42608, was exploited by ShinyHunters to breach the Clop gang's leak site, and the vulnerability has since been patched in Grav's 2.0 and 1.7 branches. Grav confirmed the legitimacy of the flaw and the threat actor's description, and has implemented a fix to prevent further attacks.
CISA Warns of Widespread Exploitation of SharePoint, Adobe Commerce Flaws
Don't wait until it's too late - with nearly 1,000 customers across critical sectors like banking, government, and telecommunications at risk, organizations can't afford to delay action against widespread exploitation of SharePoint and Adobe Commerce flaws. A critical authentication-bypass vulnerability, CVE-2026-5430, is already being exploited, putting multiple WSO2 products at risk.
GitHub Actions Resumes Executing Mini Shai-Hulud Malware After Re-Enablement
Malware linked to the Mini Shai-Hulud campaign suddenly roared back to life on September 16, 2026, when two compromised GitHub Actions repositories were mysteriously re-enabled. This alarming revival happened despite previous efforts to take the repositories offline following a security breach in May 2026.
Salesforce Zero-Click Flaws Expose AI Agent Data Risk
Security researchers just uncovered a set of zero-click flaws in Salesforce Agentforce that let attackers silently siphon off sensitive CRM data without even needing to log in. This clever exploit, dubbed "SalesBleed," could put AI agent data at risk - and it's a wake-up call for companies to take action.
Australia Seeks Coalition to Secure Frontier AI Access
In a rapidly evolving world, Australia is on a mission to join forces with like-minded nations to secure access to cutting-edge AI technology, recognizing that being left behind could have serious consequences. By banding together, middle powers can ensure they have a seat at the table and aren't left on the menu.
Researchers Intercept AliExpress Phishing Domains Before Activation
EfficientIP Research Labs swooped in to stop a phishing scam, intercepting 10 AliExpress domains before they could be used to trick unsuspecting victims. The domains, tracked from June 9 to July 2, were part of a sophisticated phishing operation that was thankfully shut down before activation.
North Korean Hackers Steal $351.6 Million in Bitget Crypto Exchange Breach
In a shocking breach, North Korean hackers made off with a staggering $351.6 million from the Bitget crypto exchange, prompting the company to temporarily suspend withdrawals while it investigates and beefs up security. Fortunately, customer accounts remain unaffected, with deposits and trading continuing as usual.
Senate Leaders Unveil Bill to Bolster Telecom Cybersecurity
Senate leaders Mark Warner and Ted Cruz have introduced the Telecommunications Cybersecurity and Resilience Act, a bipartisan bill aimed at fortifying the nation's telecom infrastructure against devastating cyberattacks like the historic Salt Typhoon hack. The legislation seeks to boost cybersecurity standards and bring government and industry together to protect critical infrastructure.
China Obtains F-35 Parts in Hong Kong Shipment Breach
A shipment of F-35 parts bound for the US took a mysterious detour from Australia to South Korea to Hong Kong, where Chinese authorities seized the components, including a cockpit canopy and a weapons-bay door, and have yet to return them. The incident has raised serious questions about security breaches in the international logistics system.
US Probes Russian Ownership of Phone-Hacking Firm with Security Agency Contracts
The US government has launched an investigation into the Russian ownership of Oxygen Forensics, a phone-hacking firm that has sold its software to top US security agencies, including the Secret Service and Homeland Security. The probe led to the arrest of the company's US CEO and a Russian national allegedly controlling the firm.
India Manages China Ties Through Sectoral Regulation
India is walking a fine line with China, warming up to a friendlier diplomatic tone while keeping strict regulations in place to protect its economic and security interests. Despite eased tensions and renewed high-level engagement, core restrictions on Chinese apps and investments remain firmly in place.
Lawmakers Push CISA to Bolster Biotech Cyber Defenses
US lawmakers are taking a crucial step to safeguard America's biotech sector by introducing bills that would boost cyber defenses for this rapidly evolving industry, deemed vital to the nation's economic and national security. The proposed legislation aims to fortify protections for biotech infrastructure, biomanufacturing, and sensitive biological data.