NewsArs Technica — Security
An undercover Google analyst infiltrated a notorious supply-chain hacking gang
Teaser from the source
Google’s threat intelligence group said it had a mole inside TeamPCP's inner circle.
This is the RSS-feed teaser. Read the full article at the original source.
Read at Ars Technica — SecurityMore on supply-chain
Other advisories
- Not ratedosv:GHSA-93qj-5q5v-3c2hTrojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- Criticalghsa:GHSA-93qj-5q5v-3c2hTrojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- Not ratedosv:GO-2026-5416gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify
- HighCVE-2026-41387OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
- Not ratedosv:CVE-2026-28500ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
- CriticalCVE-2026-28500ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
- CriticalCVE-2026-27180MajorDoMo (auch Major Domestic Module) ist anfällig für nicht authentifizierte Remote-Code-Ausführung durch Supply-Chain-Kompromittierung via Vergiftung der Update-URL.
- CriticalCVE-2018-25117VestaCP-Commits a3f0fa1 (2018-05-31) bis ee03eff (2018-06-13) enthielten eingebetteten Schadcode, der zu einem Supply-Chain-Angriff führte.
Other news entries
- WordPress SEO plugin Rank Math compromised to backdoor websitesNewsBleepingComputer
- Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attackNewsBleepingComputer
- Hallucinated domain in official OpenAI skill underscores AI supply chain risksNewsCSO Online
- Ledger asks sellers across Asia to halt sales after supply-chain attackNewsBleepingComputer
- Over 1,500 npm packages exposed by Trusted Publishing validation flawNewsCSO Online
- Four Cyber Threats Harboring Big Plans for the FutureNewsSecurityWeek
- New npm malware finds a way around install script defensesNewsCSO Online
- Brevo supply-chain attack injected ClickFix scripts on customer sitesNewsBleepingComputer
ID