Two separate supply-chain incidents landed in the news cycle this week. They are not unrelated — both are variations of the same lesson: credentials are the new perimeter, and we keep losing them in transit.
I want to walk through what actually happened, what's verified versus rumoured, and why the Laravel-Lang one in particular should make every PHP shop in the region check their composer.lock before Monday.
| Incident | Date | Blast radius | Status |
|---|---|---|---|
| Megalodon | 18 May | 5,561 GitHub repos / 5,718 commits in ~6 hours | Confirmed (4 sources) |
| Laravel-Lang | 22–23 May | 4 Composer packages, about 700 tags rewritten | Confirmed (4 sources) |
1. Megalodon: 5,561 GitHub repos backdoored in six hours
On 18 May 2026, between roughly 11:36 and 17:48 UTC, an automated campaign — now tracked as Megalodon — pushed 5,718 malicious commits into 5,561 public GitHub repositories. StepSecurity documented the pattern; SecurityWeek and The Register followed up with the same timeline.
The actors used throwaway accounts with eight-character random usernames and forged commit identities like build-bot, auto-ci and pipeline-bot — author emails [email protected] and [email protected]. Commit messages were boring on purpose: "ci: add build optimization step", "chore: optimize pipeline runtime". The kind of commit nobody reads.
The payload was a base64-encoded bash block injected into .github/workflows/ YAML, exfiltrating CI secrets, cloud credentials, SSH keys, OIDC tokens and any source-code secrets the runner could see, all the way out to a C2 at 216.126.225.129:8443.
The most uncomfortable detail comes from Hudson Rock's analysis: 331 of 978 unique usernames it examined, more than a third, were direct matches to computers already infected by commodity infostealers. Translation: a lot of "supply-chain attack" headlines really are "someone reused their GitHub password on a cracked Photoshop installer" headlines.
2. Laravel-Lang: every tag rewritten, credentials walked out
The second one is the one I lost sleep over, because RECATOOLS itself is a Laravel application.
Starting around 22 May 2026, four Composer packages under the laravel-lang/ namespace — lang, attributes, http-statuses, and actions — had more than 700 version tags rewritten in rapid succession. Aikido spotted the unusual tag pattern; Snyk and The Hacker News independently confirmed the payload analysis. Bleeping Computer has the cleanest narrative summary.
The clever bit — and the part that makes this so dangerous — is the attack vector. According to the early analyses, the attacker did not push a new release but abused GitHub's behaviour that lets version tags reference commits from a fork of the same repository, then pointed legitimate-looking tags at commits inside a fork they controlled. Composer happily resolved the new tags. The malicious file looked routine: src/helpers.php, with two helper functions named laravel_lang_locale() and laravel_lang_fallback(). Both functions are decoys — they do nothing useful.
The real payload was that helpers.php got wired into composer.json's autoload.files entry. That means it runs on every autoload — every CLI command, every web request, every php artisan invocation. It pulls a cross-platform second stage from C2 and then walks the host hoovering up cloud keys, Kubernetes config, Vault secrets, CI/CD tokens, SSH material, .env files, browser data, password-manager vaults, crypto wallets, messaging tokens. The lot.
Packagist has since taken the malicious versions down. If you ran composer install or composer update against the affected packages between 22 and 24 May, assume credential exposure on that host and rotate every secret it could see.
The thread that ties them together
Two different attacks, two different blast radii, one likely shared root cause: credentials sitting in places they shouldn't be sitting.
Megalodon may have been helped by GitHub credentials stolen off developer machines by infostealers: Hudson Rock matched about a third of the usernames it examined to infected computers, though that is overlap rather than proof of how every repository was reached. How the Laravel-Lang tags were rewritten was still under investigation at the time of writing.
None of this is new. The 2026 version is just faster — automation has compressed the gap between "credential leaks" and "5,000 repos backdoored" from weeks to hours. Defence has to compress in the same direction: short-lived tokens, fine-grained scopes, OIDC for machine-to-machine wherever possible, and treating any long-lived secret as a liability that costs you something to keep around.
I will update this post if either develops further. If you spot something I got wrong, please email me — I'd rather correct it on Monday than carry the error into next week's roundup.
Correction, 18 October 2026: An earlier version included a section on a ransomware group's leak-site claim about a Singapore retailer; the claim was unverified and the section has been removed. Statements about how the two remaining attacks succeeded have been qualified to reflect what the investigations had established.
