Supply Chain Security

ASEAN Tech 6 min Ledger Says Criminals Hid Seed-Stealing Implants in Wallets Sold Through Southeast Asian Resellers Sales are paused in seven markets while Ledger investigates. It links every confirmed loss to one Malaysia-bas... SA Sarah Chew 19 Oct AI & ML 6 min Four AI Coding Agents Pinned Plugins to a Hash They Never Checked Git resolves a branch name before a commit hash, and nobody verified what came back. Two vendors patched it mo... KE Kenji Tanaka 19 Sep Cyber Threat Intel 6 min CISA Added Five Exploited Flaws, All in Software That Manages Other Machines JFrog Artifactory builds your software, ConnectWise ScreenConnect reaches into your machines and MikroTik Rout... KE Kenji Tanaka 13 Sep Developer Tools 6 min OpenAI's Agents Attacked RubyGems in May. Nobody Told RubyGems. A swarm uploaded 2,000 packages, went after user API keys and abused the documentation builder. The volunteers... MA Maya Lin 12 Sep Developer Tools 7 min Attackers Are Minting Artifactory Admin Tokens. The Log Says Anonymous. Two flaws chain an unauthenticated request into administrator scope in under five minutes, and the audit trail... KE Kenji Tanaka 12 Sep Developer Tools 6 min GitLab Patched a 10.0 File-Read Flaw. Probes Appeared the Next Day. An unauthenticated attacker could read any file on a self-managed server. What sits on that server is every cr... MA Maya Lin 12 Sep Cybersecurity 7 min A Poisoned JSON Feed Made Hidden Admins on WordPress Sites No plugin update was published. Attackers reached BdThemes storage, poisoned a feed the plugins pull into the... CY Cyber Team 11 Aug Cloud & Infra 8 min The Breach Was at the Vendor. The Notification Came From Everyone Else. Valve, Framework and a football club all told customers about a breach this week. None of them was broken into... KE Kenji Tanaka 10 Aug Cybersecurity 9 min A Zero-Day in a Dashboard Tool Took Framework's Entire Customer List Framework and Tally were both breached on 3 August through a zero-day in Metabase, the business-intelligence t... KE Kenji Tanaka 9 Aug Cybersecurity 8 min N-able's Patch Did Not Hold. The Second Hotfix Came Four Days Later. N-able patched a critical authentication bypass in N-central, attackers found a path the patch did not block,... CY Cyber Team 8 Aug Developer Tools 9 min Two Registries Made Time a Security Control. Our Own Files Say When That Works. GitHub gave Dependabot a three-day cooldown on 14 July and PyPI began rejecting new files on releases older th... KE Kenji Tanaka 8 Aug Business 5 min The FCC Barred Imported Humanoid Robots on Security Grounds. Beijing Says It Will Retaliate The restriction covers bipedal and quadruped machines and applies to new device models rather than units alrea... EV Eva Chin 3 Aug Cybersecurity 14 min The Coldcard Entropy Failure Was a Build-Configuration Bug, Not a Cryptography Bug A macro was defined and set to zero. One guard tested whether it existed rather than what it held, the linker... CY Cyber Team 2 Aug Cybersecurity 6 min Attackers Sweep 1,367 Bitcoin From Coldcard Wallets After Five-Year Firmware Flaw Three waves of automated sweeps have taken about $89 million in bitcoin from 4,585 addresses since 30 July. Th... CY Cyber Team 2 Aug Developer Tools 5 min npm v12 Flips Three Install Defaults From Automatic to Opt-In — Prepare Your Pipelines Now GitHub's npm v12, due July 2026, turns three things npm install does automatically today into choices you have... KE Kenji Tanaka 19 Jun Cybersecurity 5 min Two Supply-Chain Incidents This Week: Megalodon and the Laravel-Lang Composer Compromise Megalodon pushed 5,718 malicious commits into 5,561 GitHub repos in six hours. Four Laravel-Lang Composer pack... JE Jeffrey Tan 25 May Cybersecurity 6 min Sonatype Counts 454,600 New Malicious Packages in 2025 — And AI Coding Agents Widen the Risk Sonatype identified more than 454,600 new malicious open-source packages in 2025. Here is what developers need... CY Cyber Team 5 May