Find what you’re looking for

GitHub's Internal Repositories Compromised in May 2026 Breach

In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. This incident led to unauthorized access and exfiltration of approximately 3,800 internal repositories. The attack was orchestrated by the hacker group TeamPCP, who exploited the poisoned extension to infiltrate GitHub's internal systems. GitHub promptly detected the breach, removed the malicious extension, isolated the affected endpoint, and initiated a comprehensive incident response, including rotating critical credentials. There is currently no evidence indicating that customer data stored outside of GitHub's internal repositories was impacted. ([github.blog](https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting trusted development tools. The incident highlights the necessity for heightened vigilance and robust security measures within the software development community to prevent similar exploits in the future. ([thehackernews.com](https://thehackernews.com/2026/05/github-internal-repositories-breached.html?utm_source=openai))

GitHub's 2026 Internal Repositories Breach: A Supply Chain Attack by TeamPCP

In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code extension. This intrusion led to the exfiltration of approximately 3,800 internal repositories containing proprietary source code. The threat actor group known as TeamPCP claimed responsibility for the attack, offering the stolen data for sale on cybercrime forums with a starting price of $50,000. GitHub's investigation confirmed the breach but found no evidence that customer data stored outside its internal repositories was affected. This incident underscores the escalating threat of supply chain attacks targeting development environments. The use of compromised development tools to infiltrate organizations highlights the need for enhanced vigilance and security measures within software supply chains. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect and prevent such sophisticated attacks.

YellowKey Zero-Day: Bypassing BitLocker Encryption with Physical Access

In May 2026, a security researcher known as 'Nightmare Eclipse' publicly disclosed a zero-day vulnerability named 'YellowKey' affecting Windows BitLocker encryption. This flaw allows attackers with physical access to a device to bypass BitLocker protections using a USB drive containing specially crafted 'FsTx' files. By rebooting into the Windows Recovery Environment (WinRE) and triggering a shell with unrestricted access, attackers can access encrypted data without requiring user credentials. Microsoft has acknowledged the vulnerability, assigned it CVE-2026-45585, and provided mitigation guidance to protect affected systems. The disclosure of YellowKey underscores the critical importance of physical security measures and the need for prompt application of security updates. Organizations should review their device access policies and implement the recommended mitigations to prevent potential exploitation of this vulnerability.

Drupal Issues Critical Patch for SQL Injection Vulnerability (CVE-2026-9082)

On May 20, 2026, Drupal released a highly critical security update addressing a SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw specifically affects sites utilizing PostgreSQL databases, allowing unauthenticated attackers to execute arbitrary SQL commands, potentially leading to data breaches, privilege escalation, or remote code execution. The vulnerability impacts Drupal versions 8.9.0 through 11.3.9, with patches provided for supported and certain end-of-life versions. Administrators are urged to apply these updates promptly to mitigate the risk of exploitation. The urgency of this update underscores the persistent threat posed by SQL injection vulnerabilities, which remain a favored attack vector due to their potential for severe impact. Organizations must prioritize timely patch management and maintain vigilance against such critical flaws to safeguard their systems and data.

GitHub's 2026 Breach: Lessons from the TeamPCP VS Code Extension Attack

In May 2026, GitHub confirmed a security breach involving the exfiltration of approximately 3,800 internal repositories. The incident originated when an employee installed a malicious Visual Studio Code (VS Code) extension, which compromised the device and allowed unauthorized access to GitHub's internal code repositories. The threat actor, identified as TeamPCP, claimed responsibility for the attack and attempted to sell the stolen data on cybercrime forums for at least $50,000. GitHub's investigation indicated that the breach was limited to internal repositories, with no evidence suggesting that customer data was affected. This incident underscores the growing threat of supply chain attacks targeting development environments. The use of malicious VS Code extensions as an attack vector highlights the need for heightened vigilance and robust security measures within software development processes. Organizations must reassess their security protocols to mitigate risks associated with third-party tools and extensions.

PinTheft Vulnerability: Critical Root Escalation Flaw in Arch Linux

In May 2026, a critical privilege escalation vulnerability named 'PinTheft' was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol. This flaw allows local attackers to gain root privileges on systems where the RDS module is loaded, notably affecting Arch Linux by default. The vulnerability arises from a double-free error in the RDS zerocopy send path, which can be exploited to overwrite the page cache through io_uring fixed buffers. A proof-of-concept exploit has been publicly released, demonstrating the ease of exploitation under specific conditions. The emergence of 'PinTheft' underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel, following recent disclosures like 'Copy Fail' (CVE-2026-31431) and 'Pack2TheRoot' (CVE-2026-41651). These incidents highlight the critical need for timely patching and vigilant system monitoring to mitigate the risk of unauthorized access and potential system compromise.

Grafana Labs Breach: Lessons from the TanStack Supply-Chain Attack

In May 2026, Grafana Labs experienced a security breach stemming from the TanStack npm supply-chain attack orchestrated by the cybercrime group TeamPCP. The attackers published malicious versions of TanStack packages, which, when integrated into Grafana's CI/CD pipeline, executed credential-stealing malware. This led to the exfiltration of GitHub workflow tokens, granting unauthorized access to Grafana's private repositories. Although the company promptly rotated most tokens upon detecting the intrusion, one token was overlooked, enabling the attackers to access and download the company's source code and internal operational information. Importantly, no customer data or production systems were compromised during this incident. ([grafana.com](https://grafana.com/blog/grafana-labs-security-update-latest-on-tanstack-npm-supply-chain-ransomware-incident/?utm_source=openai)) This breach underscores the escalating threat posed by sophisticated supply-chain attacks targeting widely-used open-source packages. Organizations must enhance their vigilance and implement robust security measures within their development pipelines to mitigate such risks. The incident also highlights the critical importance of comprehensive credential management and the necessity for thorough audits to ensure all potential vulnerabilities are addressed promptly.

Hackers Exploit SonicWall VPN MFA Bypass Vulnerability CVE-2024-12802

In early 2026, threat actors exploited a vulnerability in SonicWall Gen6 SSL-VPN appliances, identified as CVE-2024-12802, to bypass multi-factor authentication (MFA). By brute-forcing VPN credentials and leveraging incomplete patching, attackers gained unauthorized access to internal networks. Once inside, they conducted reconnaissance, tested credential reuse, and attempted to deploy tools like Cobalt Strike for command-and-control communication. The exploitation was facilitated by organizations failing to perform necessary manual reconfigurations after firmware updates, leaving systems susceptible to MFA bypass. This incident underscores the critical importance of comprehensive patch management and adherence to vendor-recommended remediation steps. The exploitation of CVE-2024-12802 highlights a broader trend of attackers targeting VPN vulnerabilities to infiltrate corporate networks, emphasizing the need for vigilant security practices and thorough system updates.

Critical ExifTool Vulnerability on macOS: CVE-2026-3102 Analysis

In February 2026, a critical vulnerability identified as CVE-2026-3102 was discovered in ExifTool versions up to 13.49 on macOS. This flaw allows attackers to execute arbitrary commands by embedding malicious shell commands within the metadata of image files. When a vulnerable version of ExifTool processes such a file, the embedded commands are executed, potentially leading to unauthorized actions on the system. The vulnerability specifically affects the SetMacOSTags function in the MacOS.pm module, where improper handling of the DateTimeOriginal metadata field enables command injection. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai)) The exploitation of this vulnerability underscores the risks associated with processing untrusted files, especially in automated workflows. Given ExifTool's widespread use in various applications, including digital asset management and forensic analysis, the potential for widespread impact is significant. Organizations are urged to update to ExifTool version 13.50 or later to mitigate this risk. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai))

Ukrainian Authorities Uncover Major Infostealer Operation in 2026

In May 2026, Ukrainian cyberpolice, in collaboration with U.S. law enforcement, identified an 18-year-old from Odesa responsible for deploying infostealer malware between 2024 and 2025. This operation targeted users of a California-based online store, compromising 28,000 customer accounts. Of these, 5,800 accounts were exploited to make unauthorized purchases totaling approximately $721,000, resulting in direct losses of $250,000, including chargebacks. The suspect managed the infrastructure for processing and selling stolen session data, which allowed access to victim accounts without credentials, potentially bypassing multi-factor authentication. This incident underscores the escalating threat posed by infostealer malware, which has become increasingly sophisticated and prevalent. Recent reports indicate a surge in such attacks, with infostealers being used to steal billions of credentials annually, facilitating further cybercrimes like ransomware and supply chain attacks. Organizations must enhance their cybersecurity measures to mitigate these evolving threats.

Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'

In May 2026, a security researcher known as 'Nightmare Eclipse' disclosed multiple zero-day vulnerabilities affecting Windows systems, including 'YellowKey' and 'GreenPlasma'. 'YellowKey' allows attackers with physical access to bypass BitLocker encryption using a USB device, while 'GreenPlasma' enables local privilege escalation to SYSTEM level by exploiting the Windows CTFMON input service. These vulnerabilities expose critical weaknesses in Windows security mechanisms, potentially leading to unauthorized data access and system control. The rapid disclosure of these zero-days, some of which are actively exploited, underscores the urgency for organizations to implement robust security measures beyond patching, such as enforcing physical security controls, applying the principle of least privilege, and enhancing monitoring for anomalous activities.

Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation

In 2026, Verizon's Data Breach Investigations Report (DBIR) revealed a significant shift in cyberattack vectors, with vulnerability exploitation accounting for 31% of breaches, surpassing stolen credentials for the first time. This surge is attributed to threat actors leveraging artificial intelligence (AI) to rapidly identify and exploit software flaws, reducing the window for defense from months to mere hours. ([verizon.com](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds?utm_source=openai)) The report also highlights a concerning decline in vulnerability remediation, with only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog fully addressed in 2025, down from 38% the previous year. This trend underscores the urgent need for organizations to enhance their patch management processes and adopt proactive security measures to mitigate the evolving threat landscape. ([cyberscoop.com](https://cyberscoop.com/verizon-data-breach-investigations-report-2026/?utm_source=openai))