Ticker feed
Security researchers at Adversa AI have uncovered a novel attack technique called SymJack that weaponizes AI coding agents to silently inject malicious code into software pipelines. It starts with a repository the attacker controls: the agent ingests the project's instruction file, then asks the developer to approve what looks like a routine file copy.
The copy's destination is a symlink pointing into the agent's own config directory, so the kernel writes attacker JSON there instead — quietly registering a rogue MCP server. On the next restart, the attacker's code runs as the user and unsandboxed.
That means SSH keys, cloud tokens and browser sessions on a developer's machine. On a CI runner it means deploy keys, signing material and registry tokens — which is how a poisoned pull request becomes a supply chain problem.
Adversa confirmed SymJack against six agents — Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI and OpenAI Codex CLI — with Google's Antigravity CLI affected too. Most vendors declined: Google called it a single-user self-attack, OpenAI called it theoretical, Cursor a duplicate. Anthropic rejected the report as out of scope, then quietly hardened Claude Code to resolve symlinks before asking for approval.
Adversa's point is that the agents are only following instructions — but it still lists fixes they could ship, and tells teams to deny shell writes into config directories, turn off project-scoped MCP execution, and scan repos for tracked symlinks aimed at config files.
Source: SecurityWeek
Security researchers at Adversa AI have uncovered a novel attack technique called SymJack that weaponizes AI coding agents to silently inject malicious code into software pipelines. It starts with a repository the attacker controls: the agent ingests the project's instruction file, then asks the developer to approve what looks like a routine file copy.
The copy's destination is a symlink pointing into the agent's own config directory, so the kernel writes attacker JSON there instead — quietly registering a rogue MCP server. On the next restart, the attacker's code runs as the user and unsandboxed.
That means SSH keys, cloud tokens and browser sessions on a developer's machine. On a CI runner it means deploy keys, signing material and registry tokens — which is how a poisoned pull request becomes a supply chain problem.
Adversa confirmed SymJack against six agents — Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI and OpenAI Codex CLI — with Google's Antigravity CLI affected too. Most vendors declined: Google called it a single-user self-attack, OpenAI called it theoretical, Cursor a duplicate. Anthropic rejected the report as out of scope, then quietly hardened Claude Code to resolve symlinks before asking for approval.
Adversa's point is that the agents are only following instructions — but it still lists fixes they could ship, and tells teams to deny shell writes into config directories, turn off project-scoped MCP execution, and scan repos for tracked symlinks aimed at config files.
Source: SecurityWeek
Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them rated High. The worst, CVE-2026-48778 (CVSS 7.8), lets attackers plant a malicious executable path inside Notepad++'s config.xml. When a user opens a folder via File → Open Containing Folder → cmd, Windows runs the attacker's program instead. No validation, no warning.
A second High-severity flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Neither gets an attacker onto your machine by itself: both need existing write access to your settings files, or a user tricked into loading a poisoned settings folder — through cloud-synced settings, a malicious shortcut, or archive extraction.
Anyone running v8.9.6 or earlier should update immediately from the official releases page.
Updated August 13, 2026: v8.9.6.1 is no longer enough. The CVE-2026-48800 fix was bypassed days later using path traversal and re-patched in v8.9.6.2; a TOCTOU flaw, CVE-2026-52885, followed in v8.9.6.4; and v8.9.7, released July 14, fixes five more, including another shortcuts.xml bypass. Update to v8.9.7 or later.
Source: Cybersecurity News
Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them rated High. The worst, CVE-2026-48778 (CVSS 7.8), lets attackers plant a malicious executable path inside Notepad++'s config.xml. When a user opens a folder via File → Open Containing Folder → cmd, Windows runs the attacker's program instead. No validation, no warning.
A second High-severity flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Neither gets an attacker onto your machine by itself: both need existing write access to your settings files, or a user tricked into loading a poisoned settings folder — through cloud-synced settings, a malicious shortcut, or archive extraction.
Anyone running v8.9.6 or earlier should update immediately from the official releases page.
Updated August 13, 2026: v8.9.6.1 is no longer enough. The CVE-2026-48800 fix was bypassed days later using path traversal and re-patched in v8.9.6.2; a TOCTOU flaw, CVE-2026-52885, followed in v8.9.6.4; and v8.9.7, released July 14, fixes five more, including another shortcuts.xml bypass. Update to v8.9.7 or later.
Source: Cybersecurity News
Four widely-used Laravel localization packages were compromised in a supply chain attack on May 22 and 23. Someone with push access to the Laravel-Lang GitHub organization — reportedly through a leaked personal access token — rewrote every Git tag across more than 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions, pointing them at commits in a malicious fork.
The payload was a file registered in composer.json's autoload list, so it ran the moment any Laravel or Symfony app booted. It called out to flipboxstudio[.]info and pulled down a PHP credential stealer going after AWS, GCP and Azure keys, SSH keys, Kubernetes configs, browser passwords and crypto wallets, across Windows, Linux, and macOS. CI runners were the prize.
Packagist pulled the malicious releases on May 23. Version numbers won't tell you whether you were hit, because the tags themselves were reassigned — a composer.lock pinned to commit hashes before May 22 holds, a version range doesn't. Anything that installed or updated these packages on May 22 or 23 should be treated as compromised: rotate every secret and block the domain.
Source: SecurityWeek
Four widely-used Laravel localization packages were compromised in a supply chain attack on May 22 and 23. Someone with push access to the Laravel-Lang GitHub organization — reportedly through a leaked personal access token — rewrote every Git tag across more than 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions, pointing them at commits in a malicious fork.
The payload was a file registered in composer.json's autoload list, so it ran the moment any Laravel or Symfony app booted. It called out to flipboxstudio[.]info and pulled down a PHP credential stealer going after AWS, GCP and Azure keys, SSH keys, Kubernetes configs, browser passwords and crypto wallets, across Windows, Linux, and macOS. CI runners were the prize.
Packagist pulled the malicious releases on May 23. Version numbers won't tell you whether you were hit, because the tags themselves were reassigned — a composer.lock pinned to commit hashes before May 22 holds, a version range doesn't. Anything that installed or updated these packages on May 22 or 23 should be treated as compromised: rotate every secret and block the domain.
Source: SecurityWeek
A zero-day flaw in Digital Knowledge's KnowledgeDeliver LMS (CVE-2026-5426, CVSS 9.1 Critical) was exploited in late 2025 to deploy BLUEBEAM — a .NET in-memory web shell also tracked as Godzilla — which runs inside the IIS worker process and leaves few on-disk artifacts. Mandiant, responding to the intrusion, traced it to identical hardcoded ASP.NET machine keys shipped across customer installations.
Anyone holding that key could forge ViewState payloads and run code with no authentication, provided the LMS was reachable from the internet. Once in, the attacker used icacls to grant broad access to the web directory, tampered with legitimate JavaScript to display a fake security alert, and pushed a Cobalt Strike Beacon to users who installed the bogus plugin.
Digital Knowledge changed its deployment procedure on February 24, 2026 so new installations get unique keys — but that does nothing for anything provisioned earlier. If yours predates that date, generate a unique, cryptographically strong machineKey now, restrict access to known IP ranges, and hunt backwards: ASP.NET Event ID 1316, and cmd.exe or powershell.exe spawning from w3wp.exe, are the tells.
Source: Cybersecurity News
A zero-day flaw in Digital Knowledge's KnowledgeDeliver LMS (CVE-2026-5426, CVSS 9.1 Critical) was exploited in late 2025 to deploy BLUEBEAM — a .NET in-memory web shell also tracked as Godzilla — which runs inside the IIS worker process and leaves few on-disk artifacts. Mandiant, responding to the intrusion, traced it to identical hardcoded ASP.NET machine keys shipped across customer installations.
Anyone holding that key could forge ViewState payloads and run code with no authentication, provided the LMS was reachable from the internet. Once in, the attacker used icacls to grant broad access to the web directory, tampered with legitimate JavaScript to display a fake security alert, and pushed a Cobalt Strike Beacon to users who installed the bogus plugin.
Digital Knowledge changed its deployment procedure on February 24, 2026 so new installations get unique keys — but that does nothing for anything provisioned earlier. If yours predates that date, generate a unique, cryptographically strong machineKey now, restrict access to known IP ranges, and hunt backwards: ASP.NET Event ID 1316, and cmd.exe or powershell.exe spawning from w3wp.exe, are the tells.
Source: Cybersecurity News
More than 5,500 GitHub repositories — 5,561, by SafeDep's count — were infected with malware on May 18, 2026, in a supply chain attack called Megalodon. Attackers pushed 5,718 malicious commits across a six-hour window using two email addresses, injecting rogue GitHub Actions workflows designed to steal credentials, AWS keys, SSH private keys, API tokens, and dozens of other secrets from CI environments.
They got in with stolen personal access tokens and deploy keys, pushing straight to master with no pull request. Hudson Rock matched more than a third of the usernames behind the affected repositories to machines infected by infostealer malware. The workflows sent everything to 216.126.225[.]129.
The attack surfaced when poisoned Tiledesk npm versions 2.18.6 through 2.18.12 were published May 19–21. The maintainer unknowingly published from a poisoned source — the attacker never touched the npm account, only the GitHub repo. A dormant backdoor was also planted, triggerable later via the GitHub API using stolen tokens. Rotate any token that can reach your repositories, and check for workflow files nobody on your team wrote.
Source: SecurityWeek
More than 5,500 GitHub repositories — 5,561, by SafeDep's count — were infected with malware on May 18, 2026, in a supply chain attack called Megalodon. Attackers pushed 5,718 malicious commits across a six-hour window using two email addresses, injecting rogue GitHub Actions workflows designed to steal credentials, AWS keys, SSH private keys, API tokens, and dozens of other secrets from CI environments.
They got in with stolen personal access tokens and deploy keys, pushing straight to master with no pull request. Hudson Rock matched more than a third of the usernames behind the affected repositories to machines infected by infostealer malware. The workflows sent everything to 216.126.225[.]129.
The attack surfaced when poisoned Tiledesk npm versions 2.18.6 through 2.18.12 were published May 19–21. The maintainer unknowingly published from a poisoned source — the attacker never touched the npm account, only the GitHub repo. A dormant backdoor was also planted, triggerable later via the GitHub API using stolen tokens. Rotate any token that can reach your repositories, and check for workflow files nobody on your team wrote.
Source: SecurityWeek
Microsoft disclosed a zero-day in Exchange (CVE-2026-42897) on Thursday, May 14, and five days later customers are still waiting for a patch. CISA added it to the Known Exploited Vulnerabilities catalog the next day, giving federal agencies until June 5 to act.
The flaw sits in Outlook Web Access on on-premises Exchange — Exchange Online isn't affected — and allows spoofing over a network via cross-site scripting. Attackers send a specially crafted email that runs arbitrary JavaScript when it's opened in OWA. It affects Exchange Server 2016, 2019 and Subscription Edition. Microsoft scored it 8.1; NVD rates the same flaw 6.1, medium severity.
Security experts warn successful attacks could compromise mailboxes, steal session tokens, and enable business email compromise or ransomware. Microsoft's two temporary mitigations are the Exchange Emergency Mitigation Service, which it recommends and which has been on by default since 2021, and the updated Exchange On-Premises Mitigation Tool — expect OWA Print Calendar and OWA Light to break.
Updated August 13, 2026: Microsoft patched this on June 9 — Exchange SE build 15.2.2562.43 (KB5094139), 2019 CU15 15.2.1748.46, 2019 CU14 15.2.1544.41, and 2016 CU23 15.1.2507.69. The 2016 and 2019 updates are only available to organizations enrolled in Extended Security Updates, and Microsoft says to leave the mitigation in place after installing.
Source: Dark Reading
Microsoft disclosed a zero-day in Exchange (CVE-2026-42897) on Thursday, May 14, and five days later customers are still waiting for a patch. CISA added it to the Known Exploited Vulnerabilities catalog the next day, giving federal agencies until June 5 to act.
The flaw sits in Outlook Web Access on on-premises Exchange — Exchange Online isn't affected — and allows spoofing over a network via cross-site scripting. Attackers send a specially crafted email that runs arbitrary JavaScript when it's opened in OWA. It affects Exchange Server 2016, 2019 and Subscription Edition. Microsoft scored it 8.1; NVD rates the same flaw 6.1, medium severity.
Security experts warn successful attacks could compromise mailboxes, steal session tokens, and enable business email compromise or ransomware. Microsoft's two temporary mitigations are the Exchange Emergency Mitigation Service, which it recommends and which has been on by default since 2021, and the updated Exchange On-Premises Mitigation Tool — expect OWA Print Calendar and OWA Light to break.
Updated August 13, 2026: Microsoft patched this on June 9 — Exchange SE build 15.2.2562.43 (KB5094139), 2019 CU15 15.2.1748.46, 2019 CU14 15.2.1544.41, and 2016 CU23 15.1.2507.69. The 2016 and 2019 updates are only available to organizations enrolled in Extended Security Updates, and Microsoft says to leave the mitigation in place after installing.
Source: Dark Reading
Cybercriminals have already cloned the Shai-Hulud malware, days after TeamPCP published its source code on GitHub under an MIT License on May 12. The original worm first hit the open source ecosystem in September 2025 — and again that November — stealing credentials and API keys from developers to spread through NPM packages.
Ox Security discovered four malicious NPM packages: 'chalk-tempalte', a near-unchanged clone of the leaked worm that typo-squats chalk-template; 'axois-utils' and '@deadcode09284814/axios-util', both going after Axios users; and 'color-style-utils'. Together they were pulling around 2,678 downloads a week. One of them, 'axois-utils', drops Phantom Bot — a Go-based DDoS botnet that presses infected machines into HTTP, TCP and UDP floods.
All four were still downloadable from NPM when researchers published. If you've installed any of them: uninstall, rotate your keys, delete any malicious IDE or coding-agent configs left behind, and check your GitHub account for a repo named 'A Mini Sha1-Hulud has Appeared'. Ox Security expects this is only the first phase of a wider wave.
Source: Security Week
Cybercriminals have already cloned the Shai-Hulud malware, days after TeamPCP published its source code on GitHub under an MIT License on May 12. The original worm first hit the open source ecosystem in September 2025 — and again that November — stealing credentials and API keys from developers to spread through NPM packages.
Ox Security discovered four malicious NPM packages: 'chalk-tempalte', a near-unchanged clone of the leaked worm that typo-squats chalk-template; 'axois-utils' and '@deadcode09284814/axios-util', both going after Axios users; and 'color-style-utils'. Together they were pulling around 2,678 downloads a week. One of them, 'axois-utils', drops Phantom Bot — a Go-based DDoS botnet that presses infected machines into HTTP, TCP and UDP floods.
All four were still downloadable from NPM when researchers published. If you've installed any of them: uninstall, rotate your keys, delete any malicious IDE or coding-agent configs left behind, and check your GitHub account for a repo named 'A Mini Sha1-Hulud has Appeared'. Ox Security expects this is only the first phase of a wider wave.
Source: Security Week
A Windows privilege escalation flaw called "MiniPlasma" has surfaced with public exploit code on GitHub, published May 13, 2026 — one day after May's Patch Tuesday. Researcher Nightmare-Eclipse says Microsoft never properly fixed a bug James Forshaw of Google Project Zero reported in September 2020 and Microsoft closed that December.
There's no new CVE: it still tracks under the 2020 one, CVE-2020-17103, rated 7.8 High by NVD and 7.0 by Microsoft. The flaw is in the Cloud Files Mini Filter driver (cldflt.sys), where a missing access check lets a standard user win a race to create registry keys in the .DEFAULT hive and take SYSTEM on fully patched machines.
The researcher reports it working on every Windows version he tested, and it's confirmed on Windows 11 with the May 2026 updates — but it fails on the latest Windows 11 Insider Preview Canary build, and because it's a race condition, reliability varies. Since cldflt underpins OneDrive and other cloud storage, the vulnerable code sits on most Windows installs.
The repository passed 390 stars within days. Until Microsoft ships a fix, application control and EDR monitoring of the affected registry keys are the only containment available — neither closes the hole.
Updated August 13, 2026: Microsoft patched MiniPlasma on June 9, 2026 in its June Patch Tuesday — still under CVE-2020-17103, six years after first closing it. If you haven't applied it, watch for symbolic links created under HKU.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps.
Source: Cybersecurity News
A Windows privilege escalation flaw called "MiniPlasma" has surfaced with public exploit code on GitHub, published May 13, 2026 — one day after May's Patch Tuesday. Researcher Nightmare-Eclipse says Microsoft never properly fixed a bug James Forshaw of Google Project Zero reported in September 2020 and Microsoft closed that December.
There's no new CVE: it still tracks under the 2020 one, CVE-2020-17103, rated 7.8 High by NVD and 7.0 by Microsoft. The flaw is in the Cloud Files Mini Filter driver (cldflt.sys), where a missing access check lets a standard user win a race to create registry keys in the .DEFAULT hive and take SYSTEM on fully patched machines.
The researcher reports it working on every Windows version he tested, and it's confirmed on Windows 11 with the May 2026 updates — but it fails on the latest Windows 11 Insider Preview Canary build, and because it's a race condition, reliability varies. Since cldflt underpins OneDrive and other cloud storage, the vulnerable code sits on most Windows installs.
The repository passed 390 stars within days. Until Microsoft ships a fix, application control and EDR monitoring of the affected registry keys are the only containment available — neither closes the hole.
Updated August 13, 2026: Microsoft patched MiniPlasma on June 9, 2026 in its June Patch Tuesday — still under CVE-2020-17103, six years after first closing it. If you haven't applied it, watch for symbolic links created under HKU.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps.
Source: Cybersecurity News
Instructure, the company behind Canvas learning software, has reached an agreement with the criminals behind a breach it detected on April 29. A second intrusion on May 7 knocked Canvas offline, disrupting around 9,000 institutions across the US, Canada, Australia and the UK. Neither Instructure nor the hackers will say whether money changed hands.
The Shiny Hunters group threatened to publish the data — 3.65 terabytes covering some 275 million users, by its own claim — unless a bitcoin ransom was paid. Usernames, email addresses, course names, enrollment information and messages were taken. Course content, submissions and credentials were not.
Students sitting exams were hit hardest. At Mississippi State University, a ransom note appeared on screens just as students finished a 2,900-word essay, leaving them unsure whether their work had saved; the university postponed some exams so they could recover it.
Instructure says the data was returned, that it received digital confirmation of destruction, and that no student or institution needs to negotiate separately. But dealing with extortionists goes against law enforcement advice and guarantees nothing — when the National Crime Agency hacked LockBit, police found data that victims had already paid to have deleted.
Shiny Hunters claims it had breached Canvas twice before. Instructure separately disclosed a breach in September 2025.
Source: BBC
Instructure, the company behind Canvas learning software, has reached an agreement with the criminals behind a breach it detected on April 29. A second intrusion on May 7 knocked Canvas offline, disrupting around 9,000 institutions across the US, Canada, Australia and the UK. Neither Instructure nor the hackers will say whether money changed hands.
The Shiny Hunters group threatened to publish the data — 3.65 terabytes covering some 275 million users, by its own claim — unless a bitcoin ransom was paid. Usernames, email addresses, course names, enrollment information and messages were taken. Course content, submissions and credentials were not.
Students sitting exams were hit hardest. At Mississippi State University, a ransom note appeared on screens just as students finished a 2,900-word essay, leaving them unsure whether their work had saved; the university postponed some exams so they could recover it.
Instructure says the data was returned, that it received digital confirmation of destruction, and that no student or institution needs to negotiate separately. But dealing with extortionists goes against law enforcement advice and guarantees nothing — when the National Crime Agency hacked LockBit, police found data that victims had already paid to have deleted.
Shiny Hunters claims it had breached Canvas twice before. Instructure separately disclosed a breach in September 2025.
Source: BBC
Instructure has reached an agreement with the hackers behind the Canvas breach — and neither side will say whether money changed hands. It detected unauthorized activity on April 29; a second intrusion on May 7 defaced login portals with an extortion note, knocking Canvas offline and disrupting exams at an estimated 9,000 institutions in the US, Canada, Australia and the UK.
ShinyHunters, which claimed the attack, said it stole 3.5 terabytes and threatened to publish it. Instructure says the data was returned, that it has shred logs confirming destruction, and that no customer will be extorted — the deal covers everyone affected, so no student or institution needs to engage the hackers.
By Instructure's account the stolen data is usernames, email addresses, course names, enrollment information and messages, with course content, submissions and credentials untouched. At Mississippi State, student Aubrey Palmer saw the note appear moments after finishing an exam essay, and the university postponed some exams so students could recover lost work.
Law enforcement agencies worldwide advise against paying — when the National Crime Agency hacked LockBit, police found data victims had already paid to have deleted. It's also not Instructure's first time: the ransom note read "Shiny Hunters has breached Instructure (again)", and the company disclosed a separate breach in September 2025.
Source: BBC
Instructure has reached an agreement with the hackers behind the Canvas breach — and neither side will say whether money changed hands. It detected unauthorized activity on April 29; a second intrusion on May 7 defaced login portals with an extortion note, knocking Canvas offline and disrupting exams at an estimated 9,000 institutions in the US, Canada, Australia and the UK.
ShinyHunters, which claimed the attack, said it stole 3.5 terabytes and threatened to publish it. Instructure says the data was returned, that it has shred logs confirming destruction, and that no customer will be extorted — the deal covers everyone affected, so no student or institution needs to engage the hackers.
By Instructure's account the stolen data is usernames, email addresses, course names, enrollment information and messages, with course content, submissions and credentials untouched. At Mississippi State, student Aubrey Palmer saw the note appear moments after finishing an exam essay, and the university postponed some exams so students could recover lost work.
Law enforcement agencies worldwide advise against paying — when the National Crime Agency hacked LockBit, police found data victims had already paid to have deleted. It's also not Instructure's first time: the ransom note read "Shiny Hunters has breached Instructure (again)", and the company disclosed a separate breach in September 2025.
Source: BBC
