Docker disclosed a critical flaw in Docker Hub where converting a personal account into an organization could reassign that account's personal access token to a named owner without rotating the token or requiring the target's consent. An attacker could exploit this to authenticate as the target user, gaining the ability to pull, push, or delete images in their repositories, depending on the token's scope and permissions. The bug has existed since August 26, 2024, though it did not grant web access or allow changes to passwords, email, or two-factor settings.
bleepingcomputer.com
· 2026-10-13
A version of the popular Zod validation library, 4.6.6, has surfaced containing obfuscated JavaScript that fetches remote instructions via blockchain RPC calls and downloads a secondary payload to execute. The code queries multiple Ethereum nodes, decodes the response into a domain, then retrieves a loader script that writes and runs an additional file in a temporary directory before cleaning up traces.
github.com
· 2026-10-12
Users of Ledger crypto wallets purchased through reseller CryptoBillis have reported drained accounts, with reports citing over $86 million stolen from hundreds of wallets. Photos shared on social media appear to show a hidden circuit board implanted under the wallet's screen that captures the seed passphrase and transmits it via an embedded SIM card. Ledger has asked CryptoBillis to pause all sales while it investigates, and says there is no evidence its own systems or directly purchased wallets were compromised.
theverge.com
· 2026-10-10
Walmart has spent billions automating its warehouses but is struggling with tasks as simple as removing items from boxes, according to the Wall Street Journal. After testing multiple robotics vendors, Walmart deployed small wheeled robots in over a dozen warehouses, but these machines cannot handle heavier items like bags of dog food and frequently break down. WSJ sources say the engineers needed to maintain the robots cost more than the unskilled warehouse workers they were meant to replace.
futurism.com
· 2026-10-10
An executive in the cotton industry describes spending close to 200 days annually traveling to farms, mills, factories, brand headquarters and trade meetings worldwide. The executive says this constant in-person contact with people across the supply chain has shaped how they lead and make decisions.
fastcompany.com
· 2026-10-08
The U.S. Department of War's Office of Strategic Capital has issued Wolfspeed Inc. a conditional 30-year loan commitment letter worth $1.5 billion. Wolfspeed, which makes silicon carbide and gallium nitride materials, plans to use the funds to upgrade GaN epitaxy capabilities and develop radiation hardening for its products. The loan requires Wolfspeed to issue warrants for up to 7.5% of its fully diluted equity, and remains subject to due diligence, government approvals and existing lender consent.
tomshardware.com
· 2026-10-08
Detroit-based startup Bloom has closed a $3.6 million seed round led by SNAK Venture Partners, with participation from Flyover Capital, Mana Ventures, and Detroit-area investors. Originally founded in 2023 to help mobility companies outsource manufacturing and logistics, Bloom pivoted into a marketplace model that uses AI agents to connect buyers with domestic suppliers, parts makers, and manufacturing services. CEO Justin Kosmides says the company has facilitated over 2,000 matches for more than 140 companies so far.
techcrunch.com
· 2026-10-07
American start-ups including Unigrid are developing sodium-ion batteries aiming for fully US-sourced supply chains, unlike lithium-ion batteries where China dominates materials and manufacturing. Unigrid's founder Tan says the company currently sources its sodium-ion cells from China but could shift to US suppliers later. Scientists have raised concerns that chromium-3 used in Unigrid's cathode could form toxic chromium-6 under certain conditions, though Tan and one outside researcher say the risk is manageable and the battery has passed safety certification.
bbc.co.uk
· 2026-09-29
Microsoft Threat Intelligence disclosed a previously unknown modular backdoor called NeedyMantis, active since at least October 2025, used in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental bodies and government contractors. The malware was found while investigating the DAEMON Tools supply chain compromise reported by Kaspersky in May, and Microsoft has linked some activity to a China-based actor it tracks as Storm-3069, though not all deployments are attributed to that group.
darkreading.com
· 2026-09-29
Energy economists report that US crude oil prices jumped from about $66 per barrel in late February 2026 to $101 by April 13, following American and Israeli attacks on Iran that closed the Strait of Hormuz. Because oil underpins transportation, plastics, fertilizers and countless supply chains, the price increase has spread globally, raising costs for manufacturers and consumers across many industries.
theconversation.com
· 2026-09-29
GitHub Actions repositories actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled in May after being compromised in the Mini Shai-Hulud supply-chain attack, were reinstated by their maintainer starting September 16 without removing the malicious code. Socket researchers found the release tags still pointed to the original tainted commit, meaning any workflow referencing those version tags resumed downloading and executing the malware payload through at least September 25.
bleepingcomputer.com
· 2026-09-26
A federal appeals court ruled 2-1 that the Pentagon acted within its legal authority when it designated Anthropic a supply chain risk, effectively blacklisting the AI company from certain defense-related dealings. The ruling affirms an earlier decision favoring the government's position over Anthropic's challenge.
gizmodo.com
· 2026-09-25
GoKawiil