topic
Poisoned packages, CI/CD and third-party compromises.
Want to defend against threats like these? Get hands-on cybersecurity training at Skillmate
15 posts, newest first
Google has introduced a new program allowing third-party Android app stores to install and update apps with one tap on Android 17 QPR2 or...
Skillmate
GitHub has announced a package firewall for npm packages that checks them against an enterprise’s policy before installation, blocking...
Skillmate
In September 2025, attackers promoted a counterfeit model context protocol (MCP) server mimicking technology to integrate Postmark, an...
Skillmate
The attack showed that SBOMs alone cannot reveal the extent of compromised production code and affected services. The vulnerability or...
Skillmate
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services reported multiple cyberattacks compromising third-party suppliers...
Skillmate
PwC announced the breach of a third-party vendor site containing employee learning records, amid claims by the Everest ransomware group....
Skillmate
Eight intermediate CA certificates from eMudhra were found to use weak private keys, potentially allowing attackers to issue trusted...
Skillmate
LiteLLM, an open-source AI tool, experienced a supply-chain attack last week, affecting tens of thousands of users. The attack originated...
Skillmate
A breach at IT management software provider ConnectWise affected thousands of downstream customers, with one nation-state actor gaining...
Skillmate
Microsoft researchers identified a China-state aligned threat group, Storm-0940, as the culprit behind an attack on ConnectWise’s Cloud...
Skillmate
The LiteLLM Python package has been compromised, distributing a credential stealer and backdoor to users through PyPI wheels and Docker...
Skillmate
DevGuard is an open-source vulnerability management platform that collects security findings in one place and ranks them by risk. Earlier...
Skillmate
The threat actor behind the GhostAction supply chain attack expanded their tactics by injecting a credential stealer disguised as a fake...
Skillmate
A fake Web3 accelerator named Apex Accelerator distributed malware and backdoors to Windows and macOS systems through malicious npm...
Skillmate