GitHub Actions

Checkmarx Jenkins Plugin Compromised by TeamPCP Malware Attack

Critical RCE Vulnerability in Microsoft GitHub Repository Disclosed

Critical Vulnerability in Claude Code GitHub Actions Exposes Repositories to Attacks

Tensorlake npm Package Compromised by Shai-Hulud Worm

Trivy Vulnerability Scanner Compromised in Supply Chain Attack

Malicious PyPI Package Compromises Developer Data and Cryptocurrency Wallets

LiteLLM Python Package Compromised in Major Supply Chain Attack by TeamPCP

Re-enabled Malicious GitHub Actions Expose Thousands to Mini Shai-Hulud Payload

Megalodon Campaign Infects Over 5,500 GitHub Repositories with Malware

Ivanti ITSM Vulnerability Allows Privilege Escalation for Authenticated Users

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages

GitHub Actions Exploited to Attack cPanel and WHM Servers

TeamPCP Targets CI/CD Pipelines to Steal Developer Credentials

Sleeper Packages in Supply Chain Attack Target GitHub Actions and Credential Theft

GitHub Breach: 3,800 Internal Repositories Compromised via Malicious VS Code Extension

GitBait Phishing Campaign Targets Mexican Banks via GitHub Pages

AI Coding Tools Under Siege: New Threats Emerge

Exploitation of GitHub Actions via pull_request_target Trigger

TeamPCP Supply Chain Attack Compromises Databricks Platform

AI-Driven Command Injection Vulnerability Exposes Snowflake Jira Credentials

SleeperGem: Malicious RubyGems Package Targets Developer Environments

TanStack Considers Invitation-Only Pull Requests After Supply Chain Attack

Supply Chain Attack on GitHub Action Exposes CI/CD Credentials

OpenAI Issues Urgent Security Update Following Axios Compromise

Prompt Injection Vulnerability in GitHub Actions AI Agents Exposes Secrets

Emerging Cyber Threats: CRPx0 Ransomware and TeamPCP Supply Chain Attacks

Shai Hulud npm Worm Compromises Over 26,000 Repositories

New GitHub Exploit Allows AI Coding Agents to Execute Malicious Payloads

AI Vendors Downplay Security Flaws in Popular Tools

OpenAI Faces Supply Chain Attack via TanStack npm Library

Open-source CI/CD Abuse Detector Launches to Combat Credential Theft

GitHub Actions Enhances Security Against 'Pwn Request' Attacks

Exploits for CVE-2026-43499 Affect Samsung Devices with Linux Kernel

38% of GitHub Actions Workflows Vulnerable to Script Injection

GitHub Outage Disrupts Global CI/CD Services

Automated AI Attack Targets Major GitHub Repositories

npm Vulnerability Exposes 1,500 Packages to Unauthorized Publication

npm Trusted Publishing Flaw Exposes 1,500+ Packages to Hijacking

Supply-Chain Vulnerability Exposes 1,500 npm Packages to Malicious Takeover

GitHub Actions Vulnerability Affects Fortune 500 Companies

Shai-Hulud Malware Infects npm Packages, Compromising Thousands of Repositories

Launch of TurboPentest: Affordable AI-Enabled Penetration Testing Platform

Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to ...

Over 1,500 npm packages exposed by Trusted Publishing validation flaw

A Hijacked TensorLake npm Release Turned Installation Into a Credential Risk

Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack

Google Suspends Open

Top threat intelligence feeds in 2026

Exploit for Use After Free in Linux Linux_Kernel

Mini Shai Hulud Actions

Infosecurity Magazine

New malware loader GHAPPIER abused npm trusted publishing | brief

GHAPPIER -One loader, sixty-five repositories, twenty-two accounts

Ai Code Security Overview

AI Coding Tools Are Now Prime Targets for Threat Actors, Google Warns

AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

KELA research leads to alleged TeamPCP Members Arrested

Gitlost How We Tricked Githubs Ai Agent Into Leaking Private Repos

Wiz AI Agent Finds Critical Snowflake GitHub Repo Flaw Advanced Security Missed

Wiz agent finds Snowflake repo flaw in code co

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

An AI broke Snowflake's code. Then another AI agent exploited it

AI-Generated GitHub Copilot "Autofix" Allowed Compromise of Snowflake's Jira

Keyv And Cacheable Compromise

Researchers find 'agent-to-agent' privilege escalation in Google's ADK for Python repo

>> Read this brief on krypteiasec.com

Daily Threat Brief: July 27, 2026

Announcing the Launch of TurboPentest, an Affordable Self

SleeperGem attack targets Ruby ecosystem with malicious gems

SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

Megalodon Mass Github Repo Backdooring Ci Workflows

M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Spoofed Git Identity Ai Code Reviewer

Link

GitLost: GitHub's AI agent leaks private repos when asked

GitHub AI agent leaks private repositories via prompt injection attack

'GitLost' prompt injection leaks private repos via GitHub Agentic Workflows

GitLost - One word is all it takes to make GitHub's AI agent leak your private repos

Over 250,000 Potential Security Issues Uncovered in GitHub Actions Workflows

GitHub AI agent leaks private repos when asked nicely

'GitLost' Flaw Leaks Private Data from GitHub's Agentic Workflows