‼️🚨 UPDATE: The TanStack npm attack is now a full campaign.
'Mini' Shai-Hulud has hit:
- OpenSearch
- Mistral AI
- Guardrails AI
-UiPath
- Squawk packages across npm and PyPI
The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.
🚨 WARNING: The self-spreading “Mini Shai-Hulud” worm compromised npm & PyPI packages tied to TanStack, Mistral AI, Guardrails AI, OpenSearch & more.
The attack used GitHub OIDC token hijacking and cache poisoning to spread credential-stealing malware across 42 TanStack packages and 84 versions.
Check your dependencies immediately → https://t.co/33fxlrOPzz
🚨 The cPanel Situation Is Spiraling Fast
On April 29, CVE-2026-41940 was disclosed: a critical pre-authentication bypass in cPanel/WHM that lets remote attackers skip the login flow entirely and gain elevated access. Within 24 hours, it was already being weaponized. Censys watched the fallout in real time.
The 6-day timeline (cPanel hosts flagged malicious):
Apr 26: 117
Apr 27: 47
Apr 28: 106
Apr 29: 70
Apr 30: 146
May 1: 15,448
On May 1 alone, total malicious hosts jumped by +19,131, and 15,302 of those (roughly 80%) were cPanel/WHM systems. Compare that to the prior days where cPanel made up well under 1.2% of daily changes. This was not background noise. It was a coordinated spike.
Top affected providers:
DigitalOcean: 1,043
Contabo: 716
OVH: 501
Vultr: 391
Oracle: 321
Unified Layer: 280
Hetzner: 277
Akamai/Linode: 275
GoDaddy: 209
Microsoft: 169
With 1,052,657 cPanel/WHM hosts exposed on the public internet and only 9,595 currently flagged as malicious, the attack surface is enormous and growing. At least two campaigns are running in parallel: a Mirai botnet variant (nuclear.x86) deployed post-compromise, and a ransomware campaign tied to the Sorry/Hidden-Tear family.
Ransomware footprint:
~7,000 cPanel servers with ".sorry" encrypted files
6,465 hosts: index.html.sorry
1,637 hosts: index.php.sorry
795 hosts: wp-config.php.sorry
Victims directed to attackers via qTox
If you run cPanel/WHM, patch immediately.
Source: https://t.co/49i8p33EER
Hablemos de CVE-2026-31431 o "Copy Fail" es una vulnerabilidad que afecta TODOS los kernels de Linux desde 2017 en adelante y permite ganar acceso root con una línea de código:
‼️🚨 BREAKING: Wiz got access to millions of GitHub repositories across users and organizations using one git push.
CVE-2026-3854: git push -o options injected into an internal header split by semicolons, parsed last-write-wins.
GitHub patched production in 6 hours.
Si pierdes tu base de datos pierdes tu aplicación.
Al parecer un desarrollador de PocketOS dio una tarea a un agente de Cursor, y este detectó que los entornos de staging y producción no se parecían así que decidió borrar el volume de producción llevándose toda la base de datos y los backups al mismo tiempo.
Un proyecto que ha pasado por una evolución tan natural como profunda: lo que comenzó como Clawdbot, mutó a Moltbot y hoy parece alcanzar su forma más madura bajo el nombre de OpenClaw.
https://t.co/TRC5CKaLOi
#clawdbot#OpenClaw#Claude
Si estan cansados de que sus diagramas cloud siempre se vean iguales…
Esta semana encontré FossFLOW 👀
Es algo tipo https://t.co/yJXXPcslFN y webs similares, pero open-source y enfocado en diagramas isométricos de infraestructura.
Funciona en el navegador, sin cuenta, drag & drop, offline y con un estilo 3D limpio para explicar arquitecturas reales.
Repo 👉 https://t.co/FIfvm4YQg7
🚀NASA Space Apps Challenge 2025!!
Tuve el agrado de participar como jurado en la primera edición de NASA Space Apps Challenge que se realizaba en el norte del Perú, justo en la ciudad donde vivo, aquí les dejo un resumen de este evento.😊😊