G1lzy

ǝɔɐןd ɹǝɟɐs ɐ ɹoɟ ʇunH
-
Retweeting as bookmarks

[Hackmanac @H4ckmanac]

🚨Data Breach Alert Update ‼️

GitHub Confirms Internal Repository Breach via Malicious VS Code Extension

GitHub confirmed unauthorized access to internal repositories after an employee device was compromised through a malicious VS Code extension.

The company stated that the attacker’s claim of approximately 3,800 repositories aligns with its ongoing investigation, removed the malicious extension, isolated the affected device, and rotated critical credentials.

Full details and impact assessment on https://t.co/eB7qgxKFAa

[JFrog Security @JFrogSecurity]

“Shai Hulud: Here We Go Again” (May 19 wave) PyPI supply chain campaign has returned! “durabletask” versions 1.4.1, 1.4.2, 1.4.3 have been compromised. These versions have been uploaded to PyPI ~2 hours ago and are STILL LIVE 🧵

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[Simplifying AI @simplifyinAI]

Someone just open-sourced shadcn-style map components for React.

It's called mapcn. Theme-aware, fully composable, and built on MapLibre GL so you get full mapping power without the Mapbox bill.

100% Open Source.

[Dylan W. @dylan_wlms]

Grosse dinguerie

Des milliers de doc .MD basé sur des sites de fou furieux qu’on peut directement brancher dans Claude etc

Quel plaisir 2026

[NZ ☄️ @CodeByNZ]

Apple accidentally left Claude.md files in today's Apple Support app update (v5.13)

[Claude @claudeai]

Claude Security is now in public beta for Claude Enterprise customers.

Claude scans your codebase for vulnerabilities, validates each finding to cut false positives, and suggests patches you can review and approve.

[Weston Walker @westonlwalker]

You can detect Copy Fail exploitation with the following auditd rules:

-a always,exit -F arch=b64 -S bind -F a2=88 -F key=alg_bind
-a always,exit -F arch=b64 -S setsockopt -F a1=279 -F key=alg_setsockopt

The exploit binds to this saddr once for each 4 bytes of the shellcode. So, if you see like 30-40 of these, it's probably a bad guy.

#DetectionEngineering

[Google @Google]

We just released Gemma 4 — our most intelligent open models to date.

Built from the same world-class research as Gemini 3, Gemma 4 brings breakthrough intelligence directly to your own hardware for advanced reasoning and agentic workflows.

Released under a commercially permissive Apache 2.0 license so anyone can build powerful AI tools. 🧵↓

[Matt Dancho (Business Science) @mdancho84]

RIP document extractors.

Google just released LangExtract: Open-source. Free. Better than $100K enterprise tools.

Here’s what it does: 🧵

[flavio @flaviocopes]

How Axios was compromised 🤯

[SpecterOps @SpecterOps]

Relayed NTLM creds are powerful, if you can use them.

@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.

Read more ⤵️ https://t.co/BdtzoKquD1

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Linus ✦ Ekenstam @LinusEkenstam]

Here is the repo:

https://t.co/2ndX1lYNYS

[Numa @NumaBuilds]

Google vient de sortir Stitch.
Qualité meilleure que 80% des freelances sur Malt.

Je lui ai filé mes idées, mon copywriting. Il m'a sorti une landing page complète avec design system, 5 sections, et le front intégré.

Temps passé : 10 minutes. Coût : 0€.
On en parle ou on fait semblant de pas voir ?

[CyrilXBT @cyrilXBT]

https://t.co/e1LW0C8XKf

[Viktor Oddy @viktoroddy]

I recorded a 18-min tutorial on The New Google Stitch - Better than Figma (And It's Free)

[The DFIR Report @TheDFIRReport]

Threat Actors are "Bringing Their Own Forensics"

In a recent ClickFix campaign, we saw threat actors likely related to Interlock Ransomware, running Volatility (https://t.co/Vq0vkvWutb) directly on victim machines.

Commonly a tool for defenders, the TAs are using it to: