Tag: supply chain
1748 articles
Air Force Grapples with Boeing Over T-7 Data Rights
The Air Force is facing a major headache in maintaining its new T-7 Red Hawk aircraft, with a high risk of sustainment issues due to a lack of technical data and parts shortages. This looming challenge threatens to severely hinder the aircraft's upkeep, a source close to the program warns.
Malicious npm Package Exploits Supply Chain with Multi-Stage Windows RAT
Beware of sneaky impostors in your build dependencies - a recent discovery by JFrog revealed a malicious npm package masquerading as a popular JavaScript tool, hiding a multi-stage Windows remote access trojan. Treat similar-sounding package names with caution, as they could be potential delivery mechanisms for threats.
LastPass Breach Exposes Customer Data in Supply Chain Hack
LastPass recently discovered a security incident at Klue, a third-party platform they use, which led to an unauthorized actor accessing some customer data through its Salesforce environment. Fortunately, customer vaults and core products remain secure, and swift action has been taken to mitigate the breach.
Malicious npm Packages Deliver Windows RAT via PostCSS Tooling
Beware of malicious npm packages masquerading as popular tools like PostCSS - researchers have uncovered three fake packages that have racked up over 1,000 downloads and deliver a sneaky Windows remote access trojan. These lookalike packages, published just over a month ago, have been cleverly designed to fly under the radar.
US Issues Orders to Advance Quantum Computing and Counter Its Risks
The US is taking a bold step forward in quantum computing, with two new executive orders aimed at harnessing its potential while mitigating risks, and National Cyber Director Sean Cairncross emphasizing the need to balance innovation and security. The orders will drive a national effort to accelerate quantum innovation, foster partnerships, and develop a skilled workforce.
France, Germany Finalize KNDS Shareholding Pact Ahead of Potential IPO
France and Germany have taken a giant leap in their defense collaboration, finalizing a pact that paves the way for equal shareholding in European defense giant KNDS, cementing their sovereignty in land defence. This strategic move marks a significant milestone in their joint effort to strengthen defense ties and cooperation.
Cloud Providers' Global Namespace Flaw Enables Bucket Hijacking
A newly discovered flaw in cloud providers' global namespace has been exploited in a simple yet powerful bucket hijacking technique, allowing attackers to redirect sensitive data streams into their own accounts. This alarming vulnerability affects multiple services across major cloud providers.
Tool Exposes Stale AI Overrides in JavaScript Ecosystem
Discover how a simple oversight in your JavaScript ecosystem can leave you vulnerable to security threats, and learn how the CVE Lite CLI tool can help you identify and fix stale AI overrides. This free, OWASP-endorsed dependency scanner provides actionable vulnerability fixes and keeps your projects secure.
FortiBleed Campaign Exploits FortiGate Devices to Harvest Credentials
A massive cyber operation, known as FortiBleed, has been secretly targeting over 430,000 FortiGate firewalls worldwide since February 2026, allowing hackers to harvest and crack sensitive VPN and authentication credentials on a huge scale. This alarming campaign has enabled large-scale credential harvesting, putting countless online security systems at risk.
WordPress Plugins Backdoored in ShapedPlugin Supply Chain Attack
A recent supply chain attack on ShapedPlugin compromised the updates for several WordPress plugins, including Product Slider Pro for WooCommerce, injecting backdoor code that could give attackers full control of affected sites. This severe vulnerability, rated 10.0 on the CVSS scale, highlights the importance of staying vigilant about plugin updates and security.
Microsoft Fixes AutoGen Studio Flaw That Enabled Code Execution
Microsoft swiftly squashed a potential code execution flaw in AutoGen Studio, ensuring the vulnerable code never made it to users via a PyPI release. The fix addressed a sneaky three-part vulnerability chain, dubbed AutoJack, that could have been exploited to run malicious code.
Australia's Food Security Prepares for Stress Test
A year of global turmoil has put Australia's food security to the test, proving that ensuring a steady food supply is crucial to national resilience. Recent events, from the Iran-Israel missile exchange to Strait of Hormuz pressures, have highlighted the need for governments to address vulnerabilities in the country's food system before it's too late.
Dify Vulnerabilities Expose AI Chats Across Tenants
Researchers have uncovered four critical vulnerabilities in Dify, a popular AI platform with over 146,000 GitHub stars, that could allow attackers to read sensitive AI conversations across different customer applications without needing authentication. These flaws, collectively known as DifyTap, expose a broad attack surface due to Dify's default multi-tenant setup.
Unpatchable Apple BootROM Flaw Targets A12, A13 Chips
A newly discovered Apple BootROM flaw affecting A12 and A13 chips poses a lifelong security risk to affected devices, as the issue is embedded in unchangeable code that can't be fixed with a simple software update. This vulnerability, known as usbliter8, is a complex combination of hardware and firmware flaws that creates a pathway to compromise the boot chain on impacted Apple systems.
Malicious Google Ads Deliver CastleStealer via New OXLOADER Malware
Beware of malicious Google ads that can deliver CastleStealer via the new OXLOADER malware, which has shown impressive engineering skills and is worth keeping an eye on. Victims are tricked into downloading fake Node.js versions through ads masquerading as legitimate sources.
FortiBleed Campaign Exposes 80K Targets Worldwide
A massive cybersecurity threat, dubbed FortiBleed, has exposed over 80,000 Fortinet FortiGate devices worldwide, with alarming ease, by exploiting weak passwords and reused credentials. The US Cybersecurity agency is urging affected customers to secure their appliances immediately to prevent a potential breach.
Legacy Infrastructure Exposes AI Agents to Hijacking Risks
Legacy infrastructure can put your AI agents at risk of hijacking, as seen with CVE-2025-24813, a remote code execution flaw that lets attackers turn a routine server compromise into a full takeover. An unpatched Internet-facing Apache Tomcat server is all it takes to expose your enterprise to this threat.
Microsoft Links North Korea to Mastra AI Supply Chain Compromise
Microsoft has uncovered a massive supply chain attack on the npm registry, where over 140 packages were compromised, and has linked the operation with high confidence to Sapphire Sleet, a notorious North Korean state actor known for targeting the financial sector. This large-scale attack highlights the growing threat of North Korean hacking groups.
Klue Breach Exposes Cybersecurity Firms to OAuth Token Abuse
A single compromised credential led to a massive security breach at Klue, allowing an unauthorized actor to exploit OAuth tokens and gain access to sensitive customer data on third-party platforms like Salesforce. This incident highlights the growing threat of OAuth token abuse and the need for robust cybersecurity measures.
NCSC Warns Fortinet Customers of Credential Theft Fallout
A massive database of 75,000 stolen credentials, including usernames, email addresses, and passwords, has been discovered, putting organisations like Oracle, Spotify, and AT&T at risk. The leak, dubbed "FortiBleed," affects customers in 194 countries and over 21,000 domains, with nearly half of all internet-accessible Fortinet firewalls potentially exposed.
Australia Urged to Rapidly Develop Cheap Drone Interceptors
In a chilling display of modern warfare, Russia's 900-strong drone assault on Ukraine in 2026 has sounded alarm bells - will Australia be prepared to counter the threat of cheap, destructive drones? Shahed-class drones, with their 50kg high-explosive warheads, have proven capable of devastating effects, from leveling apartment blocks to crippling critical infrastructure.
Microsoft attributes Mastra AI supply chain attack to North Korean hackers Sapphire Sleet
Microsoft warns that a recent supply chain attack on the Mastra AI npm environment was carried out by Sapphire Sleet, a notorious North Korean hacking group known for targeting the financial sector. This latest incident is part of a larger pattern of attacks that exploit open-source distribution channels.
Klue OAuth Breach Expands as Icarus Hackers Claim Multiple Victims
Klue's CEO Jason Smith revealed that on June 12, unauthorized activity was detected in their integration infrastructure, prompting a thorough investigation with cybersecurity experts to understand the breach and support affected customers. The incident allowed hackers to steal OAuth tokens through a compromised legacy credential, impacting connections to third-party platforms like Salesforce.
Pakistan Taps Private Sector to Accelerate Drone Development
Pakistan is taking a giant leap in drone technology, bringing together the country's top defence officials and private sector innovators to revolutionize its unmanned capabilities. By joining forces, they're set to supercharge the development of homegrown drones for warfare and surveillance.