At ISC2 Security Congress 2026 in Denver, Atlassian product security manager Deepam Kanjani described a real incident, with details altered to protect confidentiality, in which a malicious package carrying the Shai-Hulud worm evaded detection despite a matching SHA hash and a credible-looking GitHub repository. The malicious code sat three layers deep as a transitive dependency, so it never appeared in a top-level audit, and the organization's SBOM showed the environment as clean even as a behavioral scanner's warning was initially dismissed as a false positive.
darkreading.com
· 2026-10-27
At GTC Berlin on October 21, Nvidia announced a series of multi-billion-dollar agreements with substrate, packaging, testing and optics suppliers including Ibiden, Unimicron, Samsung Electro-Mechanics, SPIL and Amkor. The deals run through 2028 and target steep capacity increases, such as 2.5x dedicated substrate capacity within three years, a 15x expansion in optical engine output by mid-2027, and a 300% rise in interposer wafer capacity by end-2028.
tomshardware.com
· 2026-10-27
Criminal groups are reportedly using GPS spoofing devices to trick fleet-tracking systems and steal truckloads of cargo destined for data centers, according to reports of highway thefts. The stolen goods are said to be worth millions of dollars, with thieves able to mask a truck's real location to delay detection and recovery.
yro.slashdot.org
· 2026-10-26
A Brown University student named Ma has created a public map tracing links between 13 data labeling firms, 141 of their corporate clients, and worker sites in 31 countries, mostly in the Global South. The map draws on existing databases plus her own research into delivery center locations, aiming to expose the often-hidden chain of human labor—including workers reviewing disturbing content—that underlies AI training.
brown.edu
· 2026-10-26
Wiz Research has tracked an ongoing campaign called Gheist, active since September 15, 2026, that uses compromised GitHub tokens to plant a malicious 'sync-check' workflow across repositories. The workflow base32-encodes repository secrets to bypass GitHub's log masking, prints them to a workflow log, then an automated process downloads and deletes the log within seconds. Wiz has found over 13,500 planted branches across more than 850 compromised accounts, including private and enterprise repositories, and reported the activity to GitHub.
wiz.io
· 2026-10-25
Microsoft's Security blog reports that Storm-0940, a China-state-aligned hacking group, used an open-source AI agentic penetration-testing tool called ARTEX to exploit stolen ConnectWise application credentials, attempting sign-ins across more than 2,250 Microsoft 365 tenants. The group also ran automated password-spraying attacks against 327 accounts at eight organizations, generating over 151,000 failed login attempts without success. Microsoft says the breach did not stem from any vulnerability in its own systems and that it remains unclear how the ConnectWise credentials were obtained or how many tenants were actually compromised.
tomshardware.com
· 2026-10-23
Microsoft said the threat actor it tracks as Storm-0940 used compromised application credentials tied to ConnectWise Cloud Backup to try to access more than 2,250 downstream Microsoft 365 customer tenants. In some cases attackers reached privileged cloud access within three hours of targeting, and Microsoft said the group used an agentic AI penetration-testing framework to speed up the campaign. ConnectWise disclosed unauthorized access to its Cloud Backup application identities on Oct. 16 but has not said how attackers first obtained control of them.
darkreading.com
· 2026-10-22
The LiteLLM project's release pipeline was compromised on October 21, allowing attackers to publish a malicious version 1.107.0 to PyPI and Docker Hub containing compiled malware that steals credentials, secrets and environment variables. Affected artifacts included all seven PyPI wheels and several Docker Hub and GHCR image tags, live for roughly two to three hours before removal. The maintainer confirmed enterprise customers running the private version were not impacted, and said attackers modified only the installation package rather than the application code.
bleepingcomputer.com
· 2026-10-22
Supply chain sources cited by DigiTimes say Apple has increased iPhone Duo production orders by more than 40%, raising its 12-month shipment target from 9.7 million to 14 million units. The move follows what Apple called 'extraordinary' pre-order demand that caused delivery estimates to slip into late January within minutes of launch.
9to5mac.com
· 2026-10-22
OVHcloud confirmed that a compromised developer GitHub account was used to replace legitimate releases of its open-source ovhcloud-cli tool with malicious binaries designed to steal secrets from users' disks. The tainted versions were available for about 90 minutes and downloaded roughly 250 times before a user flagged suspicious activity, prompting OVHcloud to remove them within 30 minutes. CEO Octave Klaba urged affected users to update or delete the tool and rotate any exposed secrets.
darkreading.com
· 2026-10-21
A LiteLLM release published to PyPI as version 1.107.0 contained three hidden files that installed a credential-stealing script and a persistent backdoor on any machine that ran pip install, regardless of whether litellm was ever imported. The malicious code harvested SSH keys, cloud and CI/CD credentials, browser passwords and LLM API keys, sent them to an external domain, and set up an hourly process that fetched and executed remote code. PyPI has removed the release, and the official GitHub source and other recent versions were confirmed clean.
safedep.io
· 2026-10-21
OVHcloud confirmed that an attacker hijacked a developer's GitHub account and altered releases 0.11.0 through 0.15.0 of its open-source CLI tool to distribute information-stealing malware. CEO Octave Klaba said the tainted release went live at 14:47 on October 19 and was pulled by 16:21 after a customer flagged it, while versions 0.10.0 and 0.16.0 remained unaffected.
bleepingcomputer.com
· 2026-10-20
GoKawiil