Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Enforcing GitHub Repository Backups with Rubrik and GitHub Actions

Your CI pipeline enforces tests, security scans, and policy checks before code hits production. But your backups? Still running on a schedule, completely disconnected from your deployments. In this video, I'll walk you through how to use Rubrik's powerful APIs to build what I'm calling "Backup as Code": a GitHub Action that triggers an on-demand Rubrik snapshot of your GitHub repository every time code is merged into the main branch. We'll look at the action code, wire it up to a live repo, and watch the whole thing run end to end.

STARDUST CHOLLIMA Likely Compromises Axios npm Package

On March 31, 2026, a threat actor used stolen maintainer credentials to compromise the widely used HTTP client library Axios Node Package Manager (npm) package and deploy platform-specific ZshBucket variants. CrowdStrike Counter Adversary Operations attributes this activity to STARDUST CHOLLIMA with moderate confidence based on the adversary’s deployment of updated variants of ZshBucket (malware uniquely attributed to STARDUST CHOLLIMA) and overlaps with known STARDUST CHOLLIMA infrastructure.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install

On March 30-31, 2026, threat actors published two malicious versions of the popular HTTP library axios (versions 1.14.1 and 0.30.4) to the npm registry. Both versions included a new dependency named plain-crypto-js which, in its 4.2.1 release, contained a fully-featured cross-platform dropper that silently installed a Remote Access Trojan (RAT) on developer machines.

Emerging Threat: Axios npm Supply Chain Attack Drops Remote Access Trojan (RAT)

On March 31, 2026, two malicious versions of axios were published to npm, , using credentials stolen from a lead axios maintainer. The attacker injected a hidden dependency into both releases that drops a remote access trojan (RAT) on any machine that ran npm install during the exposure window. No CVE identifier has been assigned at the time of writing. The malicious dependency executes automatically at install time via a postinstall hook, without any action by the developer.

Ransomware in Healthcare: It's Disruption, Distraction, and Data Theft

Ransomware attacks are about disruption, distraction, and data theft happening at the same time. Nelson Carreira breaks down how modern threat actors operate. While one attack disrupts operations, another may be quietly exfiltrating sensitive data. That complexity is why healthcare organizations must prepare for recovery environments that allow clinical operations to continue safely while production systems are rebuilt.

AI Takes Over RSAC Conference (Now What?) with Dave Bittner

In this RSAC 2026 Conference recap, Dave Bittner, Host of the CyberWire Daily podcast, joins Data Security Decoded host Caleb Tolin from the guest seat to discuss the biggest theme dominating the conference: artificial intelligence, and, more specifically, agentic AI. From wall-to-wall AI messaging across San Francisco to in-depth conversations with security leaders and analysts, one thing became clear: the industry has moved past debating whether AI will take hold. It already has. Now, the focus has shifted to making it safe.

Why Incident Response Fails (And It's Not the Technology)

Incident response plans rarely fail because of technology. It’s usually because of coordination, or the lack of. Nelson Carreira explains why organizations that build isolated recovery environments should use them not only for recovery testing but also to strengthen incident response planning. Simulation exercises reveal a critical need: clear roles, leadership authority, and secure communication channels during a crisis.

Cyber Resilience in Healthcare: Why Recovery Starts at the Endpoint

On this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, Nelson Carreira explains why recovery planning in healthcare has to consider the entire environment, from user devices to network architecture. In large incidents, the blast radius can extend far beyond servers, sometimes forcing organizations to rebuild tens of thousands of endpoints before operations can safely resume. As he puts it.

How to protect yourself from ransomware

• Ransomware complaints filed with the FBI rose 9% in 2024; the FBI describes ransomware as the most pervasive threat to critical infrastructure (FBI IC3 2024 Annual Report). • The average ransom payment reached $2 million in 2024 — a fivefold increase from 2023 — while recovery costs averaged $2.73 million excluding any ransom paid (Sophos State of Ransomware 2024).