McG

Cyber Security 🇬🇧🏴󠁧󠁢󠁳󠁣󠁴󠁿

[McG @CyberMcG]

@Zaddyzaddy Partly true but don’t forget AI is trained from data sets so it just grabs all current information out there to see if it may fit, mostly it screams critical finding 9/10 times and doesn’t have any substantial findings or creative new findings and only based off known bugs

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

AI won't affect the bug bounty 🤡🤡🤡

https://t.co/W0dxZCxxZZ

[McG @CyberMcG]

Due to people submitting AI slop reports, not only are programs for bug bounties shutting down, I feel like I'm having to prove my valid reports 10x more and do the work of triagers before they hand it to the actual program managers. 1 week of having to submit proof ... mental

[McG @CyberMcG]

Claude Mythos potentially releasing tomorrow? 👀

[McG @CyberMcG]

@njcve_ @Hacker0x01 Damn, congrats! 🥂

[International Cyber Digest @IntCyberDigest]

‼️🚨 UPDATE: The TanStack npm attack is now a full campaign.

'Mini' Shai-Hulud has hit:
- OpenSearch
- Mistral AI
- Guardrails AI
-UiPath
- Squawk packages across npm and PyPI

The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.

[nader dabit @dabit3]

This is crazy. The hacker installed a dead-man's switch that will wipe your computer if you revoke the GitHub token they stole from you. Revoking the token is what triggers the wipe.

[McG @CyberMcG]

Seems like every day due to AI slop reports so many companies on bug bounty programs shutting down

[shirish @shiri_shh]

VERCEL just got breached.

They’re selling internal DB + employee accounts + GitHub/NPM tokens for $2M on BreachForums.

looks like someone got early access to Claude Mythos 💀

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[McG @CyberMcG]

Well that makes open sourcing Claude code easier

[Chaofan Shou @shoucccc]

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G

[klöss @kloss_xyz]

do you understand what just happened to one of the most used npm packages on the internet?

→ axios gets downloaded over 100 million times a week and today it got compromised

→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions

→ [email protected] and [email protected]… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine

→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too

→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely

→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package

→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself

this is the wake up call all vibe coding bros need to hear right now:

→ if you installed either version… assume your system is compromised

→ pin to [email protected] or [email protected]

→ rotate all secrets, API keys, SSH keys, and credentials on affected machines

→ check network logs for C2 connections

→ add –ignore-scripts to CI npm installs going forward

100 million weekly downloads and one compromised maintainer account…

that’s all it took to wreak absolute havoc

and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding

be safe out there y’all

[Wes Bos @wesbos]

‼️Do not npm install or deploy anything right now

Supply chain attack on axios 1.14.1 - even if you don’t use axios it may be a nested dep.

Pin versions or wait until this is resolved

[Masonhck357 @Masonhck3571]

How it feels submitting AI-assisted findings.

[Intigriti @intigriti]

chat, we got a winner! 🏆

[Dan Neidle @DanNeidle]

I see some weird things but this takes the biscuit. A vulnerability in the Companies House website, that let anyone view the private dashboard of any one of the five million registered companies, see directors' personal details.

And modify them.

[Cloudflare Developers @CloudflareDev]

Introducing the new /crawl endpoint - one API call and an entire site crawled.

No scripts. No browser management. Just the content in HTML, Markdown, or JSON.

[Mellow Dev 🎧 @mellowdevx]

@andersonbcdefg Cloudfare fighting Cloudfare crawlers

[Anthropic @AnthropicAI]

We partnered with Mozilla to test Claude's ability to find security vulnerabilities in Firefox.

Opus 4.6 found 22 vulnerabilities in just two weeks. Of these, 14 were high-severity, representing a fifth of all high-severity bugs Mozilla remediated in 2025.

[McG @CyberMcG]

@stokfredrik I’d have assumed it be one of the first things to go anyway, it’s a main use case