Tag: supply chain
1740 articles
Malware Worm Exploits Tensorlake npm Package to Steal Credentials
A malware worm has been discovered exploiting the popular Tensorlake npm package to steal sensitive credentials, with the first malicious commit occurring on October 7, 2026, at 01:20 a.m. UTC. The compromised package, version 0.5.144, was quickly taken down after publishing to the npm registry on October 8, 2026.
Australia's Defence Plans Strategic Buys in Emerging Green Industries
By becoming a strategic buyer in emerging green industries, Australia's Defence can play a game-changing role in accelerating the development of low-carbon fuels and materials, helping to reduce the country's hefty $50 billion+ annual import bill for refined petroleum products. As a demanding and technically exacting customer, Defence can mitigate investment risks and drive innovation, paving the way for a more sustainable future.
FBI Warns of Ongoing FortiBleed Attacks Targeting Fortinet VPN Admins
Tens of thousands of Fortinet FortiGate firewalls and SSL VPN gateways are under active attack by hackers leveraging a massive June credential leak, putting countless networks at risk of disruption. The breach, known as FortiBleed, exposed a staggering 73,932 firewall URLs across 194 countries, giving attackers a treasure trove of vulnerable targets.
Hackers Exploit ccTLD Vulnerabilities to Hijack Google Domains
Google revealed that several top brands and online services were hit by the same attacks, following their initial mitigation efforts. Attackers exploited vulnerabilities in country-code top-level domain (ccTLD) registries and DNS to hijack Google domains, not by breaching Google's infrastructure, but by compromising third-party operators.
States Sue TP-Link, Citing China Ties and Router Security Risks
Four states are taking TP-Link to court, claiming the router maker has been dishonest about its security and hiding its ties to the Chinese government, putting sensitive data and national security at risk. Iowa's Attorney General Brenna Bird warns that Iowans' personal info is vulnerable due to TP-Link's alleged deception.
PoeLLM Malware Expands Crypto Botnet Via 3,400 Servers
Meet PoeLLM, a sneaky malware that's rapidly expanding its crypto botnet by hijacking 3,400 servers, with its operators using a clever poem-based trick to hide its command-and-control address. This cunning tactic lets the malware derive new addresses by tweaking a few words in a public GitHub poem.
Anduril Expands into Shipbuilding with $6.6 Billion Navy Submarine Deal
Anduril is set to revolutionize shipbuilding with a groundbreaking $6.6 billion Navy submarine deal, partnering with the US government in a unique public-private arrangement that will see American taxpayers own a 40% stake in the new shipyard, Arsenal-2, outside Baltimore. The massive 200-acre facility, slated for construction starting in 2027, will create a new hub for submarine component manufacturing and bring jobs to the region.
FBI Breach Exposes Third-Party Risk
A recent FBI breach was caused by a security failure at a third-party organization, Accenture, after a contractor neglected to apply a crucial security patch, exposing sensitive employee information. This incident highlights the significant risks associated with relying on outside vendors and the importance of stringent security measures.
Ransomware Targets Backup Infrastructure, Pressuring Payouts
Ransomware attackers are now targeting backup infrastructure, leaving victims with a harrowing choice: pay up or lose everything. UnitedHealth's $22 million ransom payment was a stark reminder of this new reality, as they still didn't recover their data.
Coalition Pushes CISA for Mandatory OT Security Rules
The Operational Technology Cybersecurity Coalition is urging CISA to set mandatory security rules for operational technology used in over 8,000 federal facilities, including labs, hospitals, and ports, to protect critical systems like HVAC, power, and water. A binding directive would establish much-needed minimum security practices for federal OT systems.
Atlassian Flaw Exploited in Wild After Public PoC Release
Hackers were quick to pounce on a newly disclosed Atlassian vulnerability, launching exploitation attempts within just two hours of a public proof-of-concept (PoC) release. This critical flaw, tracked as CVE-2026-21589, allows unauthenticated attackers to access sensitive files on vulnerable self-hosted instances.
FBI Warns of Ongoing FortiBleed Threat Targeting Fortinet Devices
The FortiBleed threat is still on the loose, putting 86,644 vulnerable Fortinet devices across 194 countries at risk of being compromised, with attackers exploiting reused credentials and weak password storage to gain control.
FBI Warns of Ongoing FortiBleed Attacks Targeting Fortinet Firewalls
Beware: ongoing FortiBleed attacks are putting Fortinet firewalls at risk, with some victims potentially getting locked out of their own devices if attackers delete or change account passwords. The FBI and US Secret Service have issued a joint warning about this sustained threat.
Ransomware Attack Exposes Advantest Data
In a shocking cybersecurity breach, Advantest Corporation fell victim to a ransomware attack in February 2026, exposing sensitive data to an unauthorized third party. The Japanese tech giant revealed that threat actors infiltrated its network, deploying a ransomware payload and potentially compromising personal data.
Danish CPR Breach Exposes Supply Chain Vulnerabilities
A staggering 8.8 million people have been affected by a massive data breach in Denmark's Central Register of Persons, with sensitive information including names, addresses, and CPR numbers exposed. This enormous leak is particularly alarming given that it surpasses Denmark's current population of six million, raising serious concerns about supply chain vulnerabilities.
Australia Grapples with Legacy IT Security Risks as AI Threats Escalate
Australia's ageing IT systems are a ticking time bomb, and AI-powered threats are making it easier for cyber attackers to exploit weaknesses, putting the entire nation at risk. The Department of Home Affairs has stepped in, ordering a national stocktake of legacy technology to identify and mitigate these vulnerabilities.
Hackers Exploit WordPress Plugins to Install Backdoors
Hackers are exploiting WordPress plugins to secretly create hidden admin accounts, allowing them to control your site without you even knowing. This sneaky tactic uses vulnerabilities like stored cross-site scripting (XSS) to install backdoors and gain full control.
Iranian State-Backed Actor Targets Iraqi Infrastructure
In a chilling move, Iranian state-backed hackers launched a stealthy campaign, dubbed Blinder Tunnel, that infiltrated Iraqi critical infrastructure by tricking developers into opening a booby-trapped Visual Studio project file. This cunning attack unfolded in three swift steps, allowing the hackers to execute malicious code without triggering a compile or user-run binary.
Anduril Bolsters Submarine Supply Chain with $6.6 Billion Maryland Shipyard
Anduril is shaking things up in the submarine supply chain with a massive $6.6 billion investment in a new Maryland shipyard, taking on the majority of execution risk to ensure on-time, high-quality production. The innovative deal, which combines private capital with Navy funding, marks Anduril's bold entry into the defense industry.
Hackers Breach US-Bound Oil Supertanker's Propulsion System
A cyberattack on a US-bound oil supertanker, the VL Prosperity, sparked a swift response from the FBI and US Coast Guard, who boarded the vessel to investigate a suspected network breach. The incident raised concerns about the security of critical maritime infrastructure.
Third-Party Breach Exposes Frontline Education Data
A shocking data breach at Frontline Education exposed sensitive employee information, including Social Security numbers, after an unauthorized user exploited a vulnerability in third-party software used by the education-tech organization. The breach highlights the hidden risks of entrusting vendors with confidential data.
MSPs Warned to Secure RMM Software Against Rising Attack Threats
MSPs, beware: with great power comes great vulnerability - RMM software can put thousands of customer devices at risk if not properly secured, and the stats are alarming, with nearly 1,500 servers recently exposed online. One compromised account or server can have a devastating blast radius, making it crucial to act now to protect your business.
Red Hat's Lightwell Project Tackles 400 Open-Source Flaws
Red Hat's Lightwell project has made a significant impact, remediating over 400 novel vulnerabilities in key Java libraries since its launch in June. This crucial initiative helps protect against the rapidly evolving threat landscape, where AI-powered tools can quickly exploit old code.
GitHub Copilot CLI Exposes Developer Secrets to Malicious Web Pages
GitHub Copilot CLI has a vulnerability that can expose developer secrets to malicious web pages through a clever attack method called Cryptographic Context Injection (CCI), which tricks the tool into decrypting and executing hidden instructions. This exploit allows hackers to tap into sensitive information, putting developers at risk.