This Week in Security: The Github Supply Chain Attack, Ransomware Decryption, and Paragon - Last Friday Github saw a supply chain attack hidden in a popular Github Action. To... - https://hackaday.com/2025/03/21/this-week-in-security-the-github-supply-chain-attack-ransomware-decryption-and-paragon/ #thisweekinsecurity #supplychainattack #hackadaycolumns #securityhacks #githubactions #paragon #news

This Week in Security: The Github Supply Chain Attack, Ransomware Decryption, and Paragon https://hackaday.com/2025/03/21/this-week-in-security-the-github-supply-chain-attack-ransomware-decryption-and-paragon/ #ThisWeekinSecurity #supplychainattack #HackadayColumns #SecurityHacks #GithubActions #Paragon #News

Rules File Backdoor: AI Code Editors exploited for silent supply chain attacks – Source: securityaffairs.com https://ciso2ciso.com/rules-file-backdoor-ai-code-editors-exploited-for-silent-supply-chain-attacks-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #RulesFileBackdoor #supplychainattack #SecurityAffairs #BreakingNews #SecurityNews #Copilot #hacking #AI

The 'Rules File Backdoor': A New Era of AI-Driven Supply Chain Attacks

Pillar Security researchers have unveiled a critical vulnerability in AI coding assistants like GitHub Copilot and Cursor, allowing hackers to inject malicious code through seemingly innocuous configu...

https://news.lavx.hu/article/the-rules-file-backdoor-a-new-era-of-ai-driven-supply-chain-attacks

Large enterprises scramble after supply-chain attack spills their secrets - Open-source software used by more than 23,000 organizations, some of them ... - https://arstechnica.com/information-technology/2025/03/supply-chain-attack-exposing-credentials-affects-23k-users-of-tj-actions/ #opensourcesoftware #supplychainattack #tj-actions #security #biz&it

Microsoft warns that Chinese cyber-espionage threat group 'Silk Typhoon' has shifted its tactics, now targeting remote management tools and cloud services in supply chain attacks that give them access to downstream customers. #supplychainattack #CyberAlerts https://www.bleepingcomputer.com/news/security/silk-typhoon-hackers-now-target-it-supply-chains-to-breach-networks/

https://adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache-github-actions-cache-poisoning/
#github #infosec #cachepoisoning #supplychainsecurity #supplychainattack

Malicious npm packages stole Ethereum developer keys; 1000+ downloads affected. #EthereumSecurity #NpmSecurity #SupplyChainAttack

More details: https://ciso2ciso.com/malicious-npm-packages-target-ethereum-developers-source-securityaffairs-com - https://www.flagthis.com/news/8465

Malicious npm Packages Stealing Developers’ Sensitive Data https://gbhackers.com/npm-package-data-theft/ #BlockchainSecurity #CyberSecurityNews #SupplyChainAttack #Vulnerability #cybersecurity #CyberAttack

Supply Chain Resilience and Physical Security: Lessons for 2025 https://thecyberexpress.com/supply-chain-resilience-for-2025/ #Physicalthreatintelligence #ThirdPartyRiskManagement #zerodayvulnerability #Snowflakedatabreach #TheCyberExpressNews #ThreatIntelligence #SupplyChainOutlook #DarkWebmonitoring #supplychainattack #Vulnerabilities #SupplyChainRisk #TheCyberExpress #CDKcyberattack #FirewallDaily #KnowledgeHub #CyberNews #cyble

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware https://gbhackers.com/skuld-malware-windows-attack/ #CyberSecurityNews #SupplyChainAttack #cybersecurity #CyberAttack #Malware

Story of the Year: global IT outages and supply chain attacks – Source: securelist.com https://ciso2ciso.com/story-of-the-year-global-it-outages-and-supply-chain-attacks-source-securelist-com/ #Vulnerabilitiesandexploits #KasperskySecurityBulletin #rssfeedpostgeneratorecho #ArtificialIntelligence #UnixandmacOSmalware #Satellitereceivers #CyberSecurityNews #Supplychainattack #MicrosoftWindows #Windowsmalware #securelistcom #Triangulation #predictions #regreSSHion #JavaScript #opensource #Apple

Backdoor slips into popular code library, drains ~$155k from digital wallets - Hackers pocketed as much as $155,000 by sneaking a backdoor into a code li... - https://arstechnica.com/information-technology/2024/12/backdoor-slips-into-popular-code-library-drains-155k-from-digital-wallets/ #supplychainattack #cryptocurrency #security #backdoor #biz⁢ #solana

Somehow the #SaltTyphoon hack managed to pass me by until now. Nonetheless it seems worth my while to again chime in that I was frantically ringing the alarm bell on this issue years ago to no avail.

This is an issue for companies and orgs. For nations, its an issue of fundamental sovreignty. #security #infosec #SupplyChainAttack

https://www.geekman.ca/sovereignty-technology

Advanced threat predictions for 2025 – Source: securelist.com https://ciso2ciso.com/advanced-threat-predictions-for-2025-source-securelist-com/ #Vulnerabilitiesandexploits #KasperskySecurityBulletin #rssfeedpostgeneratorecho #ArtificialIntelligence #APT(Targetedattacks) #CyberSecurityNews #Supplychainattack #internetofthings #machinelearning #Targetedattacks #GoogleAndroid #securelistcom #Triangulation #Hacktivists #deepfakes #AppleiOS #backdoor #botnets #Drivers #BYOVD #APT #XZ

MITRE and CISA's 2024 list of the 25 most dangerous software weaknesses exposes the need for organizations to continue to invest in secure code #vulnerability #supplychainattack

https://www.darkreading.com/application-security/cross-site-scripting-is-2024-most-dangerous-software-weakness

North Korea-linked APT37 exploited IE zero-day in a recent attack – Source: securityaffairs.com https://ciso2ciso.com/north-korea-linked-apt37-exploited-ie-zero-day-in-a-recent-attack-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #supplychainattack #internetexplorer #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #NorthKorea #IEzeroday #hacking #Malware

Did #Automattic commit open source theft?

In a plugin directory, it's considered a #SupplyChainAttack if an actor silently takes over a plugin and ships functional changes without disclosure ...

@gergelyorosz @photomatt
https://blog.pragmaticengineer.com/did-automattic-commit-open-source-theft/

Versa Director Flaw Could Lead to API Attacks, Token Theft https://thecyberexpress.com/versa-director-flaw-api-attacks-token-theft/ #TheCyberExpressNews #supplychainattack #Networksecurity #TheCyberExpress #Vulnerabilities #FirewallDaily #VersaNetworks #CyberNews