Red.

Software Engineer, geek & lifelong learner | 🇹🇬 in 🇲🇦| ❤️ & 🤣

[Cristiano Ronaldo @Cristiano]

RIP THE SCRIPT @Nike

#Ad

[VoidZero @voidzerodev]

VoidZero is joining Cloudflare.

Our mission stays the same: to make JavaScript developers more productive than ever before. Vite, Vitest, Rolldown, Oxc, and Vite+ remain MIT-licensed. Evan and the VoidZero team will continue leading them.

Cloudflare shares our commitment to open source. Together, we can keep investing in the tooling developers rely on every day, while bringing the Vite ecosystem and Cloudflare’s platform even closer together.

[Jahir Sheikh @jahirsheikh8]

“CLAUDE I’VE EXPLAINED THIS BUG TO YOU 10 TIMES AND YOU STILL KEEP BREAKING IT, THINK LIKE A SOFTWARE ENGINEER WITH 15 YEARS OF EXPERIENCE AND FIX IT PROPERLY MAKE NO MISTAKES”

[2M.ma @2MInteractive]

✈️ Royal Air Maroc a annoncé la suspension provisoire de plusieurs lignes internationales, dans un contexte marqué par la forte hausse des prix du kérosène liée aux tensions géopolitiques au Moyen-Orient.

➡️ Plusieurs dessertes au départ de Casablanca, Tanger et Marrakech sont concernées, notamment vers l’Afrique centrale et certaines villes européennes. La compagnie assure mettre en place des mesures d’accompagnement pour les passagers impactés.

Les lignes concernées:

* Casablanca – Bangui

* Casablanca – Brazzaville

* Casablanca – Kinshasa

* Casablanca – Douala

* Casablanca – Yaoundé

* Casablanca – Libreville

* Tanger – Malaga

* Tanger – Barcelone

* Marrakech – Lyon

* Marrakech – Bordeaux

* Marrakech – Marseille

* Marrakech – Bruxelles

🔗: https://t.co/BDbODQR1EA

[Cristiano Ronaldo @Cristiano]

CHAMPIONS!!!!! 🏆 🟡🔵

[RG @carmela9i4]

T’es là, t’es pas bien t’as le coeur lourd et puis y’a ta nièce de 5 ans qui vient te demander « Tata c’est quoi la couleur préférée de Dieu ? » ma grande stp

[Socket @SocketSecurity]

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.

Newly confirmed compromised artifacts:

@​opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)

mistralai: 2.4.6 on PyPI

guardrails-ai: 0.10.1 on PyPI

additional @​squawk/* packages on npm

guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.​pyz, writes it to /tmp/transformers.​pyz, and runs it with python3 without integrity verification.

The git-tanstack.​com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”

The page also linked to a YouTube video and you can probably guess which one.

[Socket @SocketSecurity]

Update: Socket has found 121 more compromised npm package artifacts across 84 package names, including 64 UiPath artifacts.

Combined w/ TanStack, the current known total is 205 affected npm package artifacts across enterprise automation, AI/MCP, auth, workflow, and dev tooling.

[Aikido Security @AikidoSecurity]

Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral.

373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct, and more.

The malware propagates by stealing your CI credentials and using them to publish new compromised versions.

Full IOCs, affected package list, and detection steps: https://t.co/jWG9DUCu3x

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Socket @SocketSecurity]

🚨 BREAKING: 84 TanStack npm packages were compromised in an ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware.

Socket flagged every malicious version within six minutes of publication. This is a developing story.

[TU SAIS PAS QUOI ?! @tuCpakoa]

Les fourmis légionnaires Dorylus sont tenaces : une fois qu'elles ont pincé leur proie, elles ne lâchent plus prise !
C'est pourquoi des peuples d'Afrique les ont utilisé comme points de suture, en les faisant pincer la plaie puis en arrachant leur corps.

https://t.co/Se9aLRnkk7

[Lion @LionInCrisis]

Fiber, I was constipated

[Expo @expo]

We just cut the SDK 56 beta 😅

◆ 50%+ faster iOS builds (precompiled XCFrameworks) ◆ 40% faster cold starts on Android
◆ Expo UI is stable
◆ iOS widgets are stable
◆ expo-router rebuilt from scratch
◆ Inline native modules
◆ Brownfield multi-app support

The obvious themes are speed and stability. But there are a lot of other interesting changes (like Expo Router decoupling itself form React Navigation). Get all the nuance and detail in the changelog below ↓

[Google Health @googlehealth]

New dream team just dropped.

Get the lowdown on everything #GoogleHealth announced today: https://t.co/tVl6HuDYMw

[Sandi Slonjšak @sandislonjsak]

Haven’t met anyone working less after adopting the AI.

[Amazon @amazon]

TODAY: Amazon is opening its entire logistics network—freight, distribution, fulfillment, and parcel shipping capabilities—to every business, of all types and sizes. 📦

Amazon has built one of the most reliable and efficient supply chains on Earth. Now, Amazon Supply Chain Services gives all businesses access to the same infrastructure that moves, stores, and ships goods for hundreds of thousands of Amazon sellers.

Healthcare, automotive, manufacturing, retail, and more. Businesses across industries can now tap into Amazon's logistics network. Learn more here. ⬇️

[Dark Web Informer @DarkWebInformer]

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017.

Website: https://t.co/f5G6KnEv35

Write-up: https://t.co/W86Pz2PC6C

GitHub: https://t.co/zAMTC6nTRk

It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su.

Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise.

Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.