Dave Ferguson

Product Manager in Software Supply Chain Security. 20-year AppSec pro. Constant & curious learner. Former engineer/developer/consultant/pen tester/SA.

[ReversingLabs @ReversingLabs]

https://t.co/u2ViF76nKK

[ReversingLabs @ReversingLabs]

On June 1, an attacker published malicious versions of 31 packages in a 72-second automated scripted push — affecting approximately 9.8 million total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.

[Dave Ferguson @_sc0rn]

Cognitive Surrender to AI is real. https://t.co/I4uRATn9bl

[ReversingLabs @ReversingLabs]

TeamPCP's mini Shai-hulud campaign is spreading.

What started with backdoored TanStack packages on npm has now expanded to UiPath, Mistral AI, OpenSearch, guardrails-ai and more — across both npm and PyPI.

[Dave Ferguson @_sc0rn]

100% accurate. How can they not see this?

[Florian Roth ⚡️ @cyb3rops]

If people really believe companies can stop hiring junior devs and keep a few senior developers around to review AI-written code all day, they haven’t understood senior developers.

Many of them would rather join a medieval tooth-pulling show at a fairground than spend every day maintaining AI-generated code nobody really understands

[ReversingLabs @ReversingLabs]

What makes the #CopyFail #Linux privilege escalation attack particularly alarming is how easy it is to exploit. Use these five #YARA rules ASAP for detection and remediation. https://t.co/yXKgbb4hde

[Dave Ferguson @_sc0rn]

Great post by @nathanhamiel dissecting the Mythos hype. https://t.co/ZN3gxS48N3

[ReversingLabs @ReversingLabs]

🚨Versions 2.6.2 and 2.6.3 of the PyPI package "lightning" are compromised. RL research note: It is the same type of #Shaihulud malware as in recent Bitwarden and SAP compromises.

[Dave Ferguson @_sc0rn]

Containers to be replaced by WASM modules soon? https://t.co/UiLz6qbLC4

[ReversingLabs @ReversingLabs]

High-end AppSec isn’t just for the Fortune 500.

Spectra Assure Community gives devs, AppSec teams & OSS maintainers pro-grade supply chain security insights — without the cost or complexity.

Move beyond blind trust 👉 https://t.co/mDS1Gap7v1

[The Hacker News @TheHackersNews]

🛑 Adobe released emergency fixes for a 9.6 CVSS flaw (CVE-2026-34621) in Acrobat/Reader, confirmed under active exploitation.

A prototype pollution bug lets malicious PDFs run arbitrary code via JavaScript. Evidence shows attacks may date back to Dec 2025.

🔗 Read → https://t.co/y0BJMEd2ly

[Kaspersky @kaspersky]

If you downloaded any CPUID software between Apr 9 15:00 UTC and Apr 10 10:00 UTC — assume compromise. Check your DNS logs for these 4 malicious domains and scan for CRYPTBASE.dll artifacts. Full IoCs, hashes, attack chain analysis and detection rules: https://t.co/wUEbuEBFaR [6/6]

[Dave Ferguson @_sc0rn]

JPMC's CISO Patrick Opet discusses his open letter to third-party software suppliers. https://t.co/GbBFeBN6ac

[Dave Ferguson @_sc0rn]

@reginaldbear @NamesJaysmith Iowa's Ben McCollum is our best choice at 44 yrs old. But born & raised in Iowa.

[Dave Ferguson @_sc0rn]

@mubix https://t.co/c5uOnDIeR8

[Rob Fuller @mubix]

Haven’t validated myself but here is the post:

https://t.co/rpTqR9Rghl

And here is the specific software that is specified: https://t.co/YDEkQOliN2

[Dave Ferguson @_sc0rn]

Hey @gmail. An email sent to my business email account and marked as Spam (so I never saw it) created a calendar entry on my Google Calendar. Why did that happen?

[Dave Ferguson @_sc0rn]

Good review of the compromises in open source due to TeamPCP. https://t.co/mqdN71m26J

[ReversingLabs @ReversingLabs]

👁️ Be on the look out for compromised versions 1.82.7 and 1.82.8 of the "litellm" PyPI package, which has more than 479 million downloads 🧵👇
https://t.co/Fu70kZ8Koz

[ReversingLabs @ReversingLabs]

Look out for compromised version of Checkmarx ast-results OpenVSX extension https://t.co/20kuauO2j2