en
GitHub Internal Breach: TeamPCP Exfiltrates 3,800 Repos via Poisoned VS Code Extension
Investigation into how TeamPCP used a poisoned VS Code Marketplace extension to pivot into developer workstations and exfiltrate 3,800 GitHub repositories.
James Luther
es
GitHub Breach Interno: TeamPCP Exfiltrates 3,800 Repos via Poisoned VS Code Extension
Investigación de cómo TeamPCP utilizó una extensión de mercado de código VS envenenada para pivotar en estaciones de trabajo de desarrolladores y exfiltrate 3,800 repositorios GitHub.
en
CVE-2026-42897: Microsoft Exchange OWA XSS Zero-Day — No Patch, Active Exploitation
How threat actors are actively weaponizing an unpatched stored XSS zero-day in Microsoft Exchange OWA to hijack mailbox session tokens.
es
CVE-2026-42897: Microsoft Exchange OWA XSS Día Cero — No Patch, Explotación Activa
Cómo los actores de la amenaza están armando activamente un XSS almacenado sin parche en Microsoft Exchange OWA para secuestrar fichas de sesión de correo.
en
Mini Shai-Hulud: The TanStack Supply Chain Attack That Defeated SLSA Provenance
How the Mini Shai-Hulud attack poisoned TanStack npm packages and bypassed SLSA Level 3 build provenance guarantees.
es
Mini Shai-Hulud: The TanStack Supply Chain Attack That Defeated SLSA Provenance
Cómo el ataque Mini Shai-Hulud envenenó paquetes TanStack npm y superó las garantías de procedencia de SLSA Level 3.
CVE Deep Dive
CVE-2026-31431: Linux Kernel LPE — Root Access via Netfilter UAF, Active Exploitation Confirmed
Technical exploit walkthrough of the Linux kernel Netfilter use-after-free vulnerability enabling local root privilege escalation.
Security Roundup
Security Roundup: PAN-OS Zero-Day, RubyGems Supply Chain Attack, SHADOW-EARTH-053 Espionage — Week of May 14, 2026
Weekly briefing: PAN-OS auth portal buffer overflow (root RCE), RubyGems 500+ malicious packages, and SHADOW-EARTH-053 espionage.
Threat Intel
SHADOW-EARTH-053: China APT Espionage Against Asian Governments and NATO — ShadowPad, Godzilla, and Patient Tradecraft
In-depth threat intelligence report on SHADOW-EARTH-053 deploying ShadowPad, Godzilla webshells, and long-term espionage tradecraft.
CVE Deep Dive
CVE-2026-6973: Ivanti EPMM RCE — Admin-Level Access and MDM Infrastructure Compromise
Technical root cause and remediation for the unauthenticated administrative RCE flaw in Ivanti EPMM mobile device management systems.
Supply Chain
RubyGems Supply Chain Attack: BufferZoneCorp, GemStuffer, and 500+ Malicious Packages
How campaign BufferZoneCorp flooded RubyGems with over 500 malicious packages using typosquatting and GemStuffer payload obfuscation.
CVE Deep Dive
CVE-2026-0300: PAN-OS Unauthenticated RCE — Root Access via Authentication Portal Buffer Overflow
Technical analysis of the CVSS 10.0 PAN-OS authentication portal buffer overflow granting unauthenticated remote root access.