Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

foresiet

GitHub Internal Repositories Breached: Source Code and Internal Data Allegedly Exfiltrated in 2026 Supply Chain Attack

May 20, 2026 By foresiet In Foresiet
In a significant security incident unfolding on May 20, 2026, GitHub confirmed unauthorized access to its internal repositories. The breach involved the exfiltration of sensitive internal source code and organizational data, reportedly totaling around 3,800 to 4,000 private repositories. A threat actor surfaced on underground forums advertising the stolen materials for sale, complete with directory listings of compressed archives and sample verification offers.
Read Post
indusface

How to Prevent SQL Injection Attacks (2026): 7 Proven Techniques

May 20, 2026 By Venkatesh Sundar In Indusface
Your database is one apostrophe away from a breach. SQL injection has been the most common web vulnerability for three consecutive years. The 2025 Verizon DBIR reports it contributed to 12% of all data breaches, up from 9% the year before. In December 2024, a PostgreSQL SQL injection zero-day gave state-sponsored attackers a path into the US Treasury. In 2023, a single campaign used it to steal 2 million job seeker records across 65 websites in one month. The fix has been known for two decades.
Read Post
Tines

Why AI-era attacks demand deterministic defense

May 20, 2026 By Thomas Kinsella In Tines
The security industry spent a good chunk of early 2026 debating whether Anthropic’s Mythos and OpenAI’s Daybreak are truly dangerous or just good marketing. It's a reasonable debate. But while we're having it, attackers are asking a different question: how do we use tools like this to move faster than defenders can respond?
Read Post
sophos

WantToCry ransomware remotely encrypts files

May 19, 2026 By Sophos Counter Threat Unit Research Team In Sophos
SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access and then exfiltrating files to attacker-controlled infrastructure for remote encryption. The detection surface is significantly reduced because WantToCry operates without local malware execution, and there is no post-compromise activity beyond exfiltrating files and rewriting them to disk.
Read Post
mend

Mini Shai-Hulud Hits @antv: 323 npm Packages Compromised Through the atool Maintainer Account

May 19, 2026 By Alina Podoba In Mend
An active supply chain attack has compromised 323 npm packages published under the atool npm maintainer account. The wave sweeps the entire @antv data-visualization organization alongside standalone libraries with wide independent adoption: echarts-for-react, timeago.js, size-sensor, and canvas-nest.js. With echarts-for-react pulling roughly 1.1 million weekly downloads, any project that auto-updates these packages is in scope.
Read Post
Snyk

The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised

May 19, 2026 By Liran Tal In Snyk
The ink was barely dry on our coverage of the AntV Shai Hulud supply chain attack when a new compromise surfaced in the Python ecosystem. The target this time is durabletask, an open source Python package associated with Microsoft, used for building durable, fault-tolerant workflow orchestration on top of the Durable Task Framework. The latest safe version of durabletask is 1.4.0, and three known versions have been yanked from the PyPI registry.
Read Post

Kevin Mandia on AI-Powered Attacks: The Race Just Got Faster | Black Hat | Reach Security

May 19, 2026 By Reach Security In Reach Security
At Black Hat last year, we sat down with Kevin Mandia to talk about what's coming. His take: offense is going to accelerate with AI. Not slow down. Not plateau. Accelerate. When you've run more red teams than practically anyone on the planet, the pattern is clear. Getting into a victim network is already a race. AI compresses those time frames further. The attack surface isn't changing. Misconfigurations, things that slipped, controls that were on and got turned off. The entry point stays the same. AI just makes the race to exploit it faster.
View Video
indusface

DDoS Attack Prevention: 15 Best Practices to Stop Attacks in 2026

May 18, 2026 By Venkatesh Sundar In Indusface
DDoS attacks cost businesses an average of $6,130 per minute in downtime losses. According to the Indusface State of Application Security 2026 report, 70% of all websites faced at least one DDoS attack in 2025, attacks per website grew 27% year over year, and APIs were targeted 675% more than traditional websites.
Read Post

Mini Shai-Hulud: The Most Sophisticated NPM Supply Chain Attack of 2026

May 18, 2026 By Snyk In Snyk
On May 11, 2026, the TanStack namespace was hit by a "Mini Shai-Hulud" supply chain attack. Unlike typical attacks, this did not involve stolen credentials; instead, the threat group TeamPCP hijacked the legitimate GitHub Actions release pipeline. This video covers the technical details of the OIDC token extraction, the "Dead Man's Switch" that triggers a rm -rf / upon credential revocation, and the mandatory remediation order you must follow to save your data. We also discuss how to harden your workflow using release-age cooldowns and OIDC pinning.
View Video
armo

Prompt Analysis for AI Attack Detection: Four Signal Categories, Three Blind Spots, One Correlation Layer

May 17, 2026 By Yossi Ben Naim In ARMO
At 2:47 PM on a Tuesday, a customer support agent receives a routine ticket asking about return policy edge cases. The agent retrieves a section from your internal policy wiki through RAG to formulate the response. Three weeks earlier, an attacker had planted a hidden instruction in that wiki page. Bedrock Guardrails scored the retrieved context at 0.04 — well within benign range.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.