✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
GitHub's 2026 Internal Repositories Breach: A Supply Chain Attack by TeamPCP
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code extension. This intrusion led to the exfiltration of approximately 3,800 internal repositories containing proprietary source code. The threat actor group known as TeamPCP claimed responsibility for the attack, offering the stolen data for sale on cybercrime forums with a starting price of $50,000. GitHub's investigation confirmed the breach but found no evidence that customer data stored outside its internal repositories was affected. This incident underscores the escalating threat of supply chain attacks targeting development environments. The use of compromised development tools to infiltrate organizations highlights the need for enhanced vigilance and security measures within software supply chains. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect and prevent such sophisticated attacks.
2 months ago
Kill Chain
GitHub's 2026 Breach: Lessons from the TeamPCP VS Code Extension Attack
In May 2026, GitHub confirmed a security breach involving the exfiltration of approximately 3,800 internal repositories. The incident originated when an employee installed a malicious Visual Studio Code (VS Code) extension, which compromised the device and allowed unauthorized access to GitHub's internal code repositories. The threat actor, identified as TeamPCP, claimed responsibility for the attack and attempted to sell the stolen data on cybercrime forums for at least $50,000. GitHub's investigation indicated that the breach was limited to internal repositories, with no evidence suggesting that customer data was affected. This incident underscores the growing threat of supply chain attacks targeting development environments. The use of malicious VS Code extensions as an attack vector highlights the need for heightened vigilance and robust security measures within software development processes. Organizations must reassess their security protocols to mitigate risks associated with third-party tools and extensions.
2 months ago
Kill Chain
PinTheft Vulnerability: Critical Root Escalation Flaw in Arch Linux
In May 2026, a critical privilege escalation vulnerability named 'PinTheft' was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol. This flaw allows local attackers to gain root privileges on systems where the RDS module is loaded, notably affecting Arch Linux by default. The vulnerability arises from a double-free error in the RDS zerocopy send path, which can be exploited to overwrite the page cache through io_uring fixed buffers. A proof-of-concept exploit has been publicly released, demonstrating the ease of exploitation under specific conditions. The emergence of 'PinTheft' underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel, following recent disclosures like 'Copy Fail' (CVE-2026-31431) and 'Pack2TheRoot' (CVE-2026-41651). These incidents highlight the critical need for timely patching and vigilant system monitoring to mitigate the risk of unauthorized access and potential system compromise.
2 months ago
Kill Chain
Grafana Labs Breach: Lessons from the TanStack Supply-Chain Attack
In May 2026, Grafana Labs experienced a security breach stemming from the TanStack npm supply-chain attack orchestrated by the cybercrime group TeamPCP. The attackers published malicious versions of TanStack packages, which, when integrated into Grafana's CI/CD pipeline, executed credential-stealing malware. This led to the exfiltration of GitHub workflow tokens, granting unauthorized access to Grafana's private repositories. Although the company promptly rotated most tokens upon detecting the intrusion, one token was overlooked, enabling the attackers to access and download the company's source code and internal operational information. Importantly, no customer data or production systems were compromised during this incident. ([grafana.com](https://grafana.com/blog/grafana-labs-security-update-latest-on-tanstack-npm-supply-chain-ransomware-incident/?utm_source=openai)) This breach underscores the escalating threat posed by sophisticated supply-chain attacks targeting widely-used open-source packages. Organizations must enhance their vigilance and implement robust security measures within their development pipelines to mitigate such risks. The incident also highlights the critical importance of comprehensive credential management and the necessity for thorough audits to ensure all potential vulnerabilities are addressed promptly.
2 months ago
Kill Chain
Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'
In May 2026, a security researcher known as 'Nightmare Eclipse' disclosed multiple zero-day vulnerabilities affecting Windows systems, including 'YellowKey' and 'GreenPlasma'. 'YellowKey' allows attackers with physical access to bypass BitLocker encryption using a USB device, while 'GreenPlasma' enables local privilege escalation to SYSTEM level by exploiting the Windows CTFMON input service. These vulnerabilities expose critical weaknesses in Windows security mechanisms, potentially leading to unauthorized data access and system control. The rapid disclosure of these zero-days, some of which are actively exploited, underscores the urgency for organizations to implement robust security measures beyond patching, such as enforcing physical security controls, applying the principle of least privilege, and enhancing monitoring for anomalous activities.
2 months ago
Kill Chain
Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation
In 2026, Verizon's Data Breach Investigations Report (DBIR) revealed a significant shift in cyberattack vectors, with vulnerability exploitation accounting for 31% of breaches, surpassing stolen credentials for the first time. This surge is attributed to threat actors leveraging artificial intelligence (AI) to rapidly identify and exploit software flaws, reducing the window for defense from months to mere hours. ([verizon.com](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds?utm_source=openai)) The report also highlights a concerning decline in vulnerability remediation, with only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog fully addressed in 2025, down from 38% the previous year. This trend underscores the urgent need for organizations to enhance their patch management processes and adopt proactive security measures to mitigate the evolving threat landscape. ([cyberscoop.com](https://cyberscoop.com/verizon-data-breach-investigations-report-2026/?utm_source=openai))
2 months ago
Kill Chain
Grafana Labs GitHub Breach: A Wake-Up Call for Supply Chain Security
In May 2026, Grafana Labs experienced a security breach when attackers exploited a stolen GitHub token to access and download the company's codebase. The breach was detected on May 11, 2026, and the attackers subsequently issued a ransom demand, threatening to release the stolen code. Grafana Labs refused to pay the ransom, emphasizing that no customer data or production systems were compromised. The company has since revoked the compromised credentials and implemented additional security measures to prevent future incidents. This incident underscores the growing threat of supply chain attacks targeting development environments. Organizations are increasingly vulnerable to such breaches, highlighting the need for robust security practices, including regular credential audits and enhanced monitoring of CI/CD pipelines.
2 months ago
Kill Chain
Axios npm Package Compromise: A 2026 Supply Chain Attack
In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library. They published two malicious versions, `axios@1.14.1` and `axios@0.30.4`, which included a trojanized dependency named `plain-crypto-js`. This dependency executed a `postinstall` script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malicious packages were available for approximately three hours before being removed by npm. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source software repositories. The rapid deployment and removal of the malicious packages highlight the need for vigilant monitoring and swift response mechanisms within the software development community.
2 months ago
Kill Chain
Mini Shai-Hulud 2026: Unveiling TeamPCP's npm Supply Chain Attack
In May 2026, the self-replicating malware campaign known as Mini Shai-Hulud resurfaced, compromising hundreds of npm packages. The threat actor, TeamPCP, utilized this campaign to autonomously spread malware, install persistent OS-level backdoors, and harvest sensitive credentials such as GitHub tokens, npm tokens, SSH keys, and cloud provider credentials. The malware executed upon package installation, affecting both local development environments and CI/CD pipelines, and propagated by republishing infected packages under legitimate maintainers' names. ([cyberscoop.com](https://cyberscoop.com/mini-shai-hulud-malware-npm-packages-compromised-again/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The ability of such malware to persist beyond standard remediation efforts, like package removal, highlights the need for comprehensive security measures, including thorough auditing of developer tools and CI/CD environments, to prevent unauthorized access and data exfiltration.
2 months ago
Kill Chain
Verizon's 2026 DBIR: A Wake-Up Call on Exploited Vulnerabilities and Ransomware
In 2025, Verizon's Data Breach Investigations Report (DBIR) analyzed over 22,000 breaches, revealing that exploited vulnerabilities became the primary initial access vector, accounting for 31% of incidents—up from 20% the previous year. This surge underscores the challenges organizations face in timely vulnerability management, with the median time to fully patch a vulnerability increasing to 43 days from 32 days in 2024. Additionally, ransomware incidents rose to 48% of breaches, highlighting the persistent threat posed by financially motivated cybercriminals. The report also noted a decline in the remediation of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog, with only 26% fully addressed by organizations in 2025, down from 38% in 2024. This trend emphasizes the need for enhanced vulnerability management practices and proactive security measures to mitigate the evolving cyber threat landscape.
2 months ago
Kill Chain
CISA Credential Leak 2026: Lessons in Cybersecurity
In May 2026, a significant security lapse was discovered involving the Cybersecurity and Infrastructure Security Agency (CISA). A contractor inadvertently exposed a public GitHub repository named 'Private-CISA,' containing sensitive credentials such as AWS GovCloud administrative keys, plaintext passwords, and SAML certificates. This repository was accessible for approximately six months, from November 2025 until its discovery in May 2026. The exposure posed substantial risks, including unauthorized access to CISA's internal systems and potential exploitation by malicious actors. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent access controls and vigilant monitoring of code repositories. It highlights the necessity for organizations to implement robust security practices, including regular audits and the use of automated tools to detect and prevent the exposure of sensitive information. The event serves as a stark reminder of the vulnerabilities associated with misconfigured repositories and the potential consequences of credential leaks.
2 months ago
Kill Chain
GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension
In May 2026, GitHub experienced a security breach where approximately 3,800 internal repositories were exfiltrated. The breach occurred after an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. The attackers, identified as TeamPCP, gained access to GitHub's internal systems via this poisoned extension. GitHub has stated that there is no evidence of customer data being affected and has initiated incident response measures, including rotating critical secrets and monitoring for further activity. This incident highlights the increasing threat posed by supply chain attacks targeting developer tools and environments. Malicious extensions in widely used platforms like VS Code can serve as entry points for attackers, emphasizing the need for enhanced security measures and vigilance in software development practices.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports