Wiz Research uncovered the Gheist campaign, a Gheist GitHub campaign planting 13,500 rogue branches across 850+ accounts to steal private repo secrets.

Related Posts:

• Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
• GMO Desktop Cloud Breach Exposes 26,000 FX Servers
• Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign

The post Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets appeared first on Daily CyberSecurity.

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

Related Posts:

• Google Updates Chrome VRP Rewards for Memory Flaws
• Google Play AI Apps Revolutionize Android Publishing
• Google Gemini 4 Argon Model Officially Launches

The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.

A CVSS 10 GeoServer Cloud vulnerability in a GitHub Actions workflow could have leaked repository secrets. No abuse found, and the workflow is gone.

Related Posts:

• Critical Apache PLC4X Flaw Lets Attackers Hijack OPC UA Connections to PLCs
• TeamViewer Fixes Five High-Severity Flaws in Full Client and Host
• Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities

The post GeoServer Cloud Fixes CVSS 10 GitHub Actions Flaw That Exposed Repository Secrets appeared first on Daily CyberSecurity.

GitGuardian discovered 474 leaked GitHub App private keys still active. Learn how exposed GitHub App private keys threaten organizations like the CDC.

Related Posts:

• Meta Muse Secretly Used Humans for AI Phone Calls
• ShinyHunters Syndicate Alleges Major FBI Network Compromise
• OpenAI's Project Lily Employs Humans to Read ChatGPT Chats

The post Leaked GitHub App Private Keys Expose Critical Infrastructure appeared first on Daily CyberSecurity.

A $1.8 million App Store scam lawsuit tests how much software vetting Australian firms can safely outsource.

The post Why Apple’s Recent Crypto Lawsuit Should Worry Australian IT Leaders appeared first on TechRepublic.

Healthcare software vendor Craneware confirmed attackers stole data during a cyberattack, underscoring growing cybersecurity risks facing healthcare suppliers.

The post Craneware Confirms Data Theft After Cyberattack, Investigations Underway appeared first on TechRepublic.

Tata Electronics is investigating a cyber incident after leaked files reportedly included manufacturing documents for Apple and Tesla.

The post Tata Electronics Leak Exposes 200,000 Files, Including Apple and Tesla Documents appeared first on TechRepublic.

AI supply chain security: Explore the risks of poisoned datasets, compromised open-source libraries, and AI-powered phishing.

The post Securing the AI Supply Chain: What are the Risks and Where to Start?   appeared first on Security Boulevard.

See how the attack works, what to look for, and how to remediate.

The post Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install appeared first on Security Boulevard.

Software supply chain attacks are evolving. Beyond compromised packages, discover the 2026 "Agentic" threat surface—where prompt injection, toolchain poisoning, and hallucinated dependencies bypass traditional DevSecOps. Learn how the 3 Pillars and AI-driven sandboxing provide a new defensive architecture.

The post Coding Agents Widen Your Supply Chain Attack Surface  appeared first on Security Boulevard.

On March 20, 2026 at 20:45 UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were receiving unauthorized patch updates, all containing the same hidden malicious code. What they had caught was CanisterWorm, a self-spreading npm worm deployed by the threat actor group TeamPCP. We track this […]

The post CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive appeared first on Security Boulevard.

The CDK Global breach exposed how niche vendors can cripple entire industries. Move beyond questionnaires to continuous, AI-driven monitoring of third-, fourth- and nth‑party dependencies, dynamic prioritization, and threat‑informed supply‑chain risk management.

The post The Silent Supply Chain: Why Your Fourth-Party Vendor is Your Biggest Blindspot  appeared first on Security Boulevard.