On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to PyPI and to the official Docker images: three Python startup files ran a credential collector during interpreter initialization, without the application ever importing LiteLLM. If you installed 1.107.0, downgrading is not enough — rotate every credential reachable from each affected host and rebuild the environments.
On October 12, 2026, Docker disclosed that converting an account into an organization reassigned personal access tokens to a new owner without rotating the secret. Treat an image namespace as a weak trust signal: switch to organization tokens and sign your images.
On October 21, 2026, Microsoft attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China-state aligned actor using the ARTEX agentic AI framework to go from targeting to privileged access in under three hours. Reduce multi-tenant application permissions and treat service-principal sign-ins as a first-class alert signal.
On October 20, 2026, GitHub opened a public preview of a firewall that sits between Actions runners, coding agents and the npm registry, inspecting metadata requests and package downloads alike. It blocks malware at install time, where scanners show up too late: turn it on if your CI installs third-party code.
On October 16, 2026, GitHub made open source license compliance generally available: a ruleset requires compliant results before merge and blocks any pull request that adds a dependency under an unacceptable license. For enterprises that already govern their dependencies, this is the shift from after-the-fact audit to a policy enforced in CI.
On the night of 16–17 October 2026, an intruder reached a legacy OpenCode Console system that was being decommissioned, exposing the OpenAI, Anthropic, and Google API keys of 1.4% of the service’s users. Revoke and reissue those keys at each provider, then audit your billing since 16 October.
On 14 October 2026, GitHub opened workflow lockfiles to public preview: every action and reusable workflow is pinned to a specific commit, so the code you reviewed is the code that runs. Turn on locking for your critical repositories before a moved tag slips malicious code into your CI.
Between April and July 2026, attackers briefly modified two configuration files on AOMEI’s servers to make Backupper clients download the CROSSROAD and SHINYROAD malware, in windows of five to ten minutes. If you run AOMEI Backupper, hunt for indicators of compromise: a server-side fix does not remove a backdoor already installed.
On October 17, 2026, SafeDep, Checkmarx and CloudSEK document the MALFEX campaign, which has been publishing npm packages since August 2023 whose nine-line JavaScript files load a DLL that injects shellcode into a Windows process. If your Windows machines install npm dependencies with native addons, audit your dependency trees and treat affected hosts as compromised.
On October 17, 2026, ConnectWise shuts down access to its Cloud Backup service after attackers compromised the service’s application identity and signed into Microsoft 365 tenants using permissions customers had already granted. Audit your vendors’ service principals, disable the implicated ConnectWise apps, and revoke their secrets.
On 12 October 2026, GitLab shipped 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that allows unauthenticated remote code execution. If you self-host GitLab, upgrade now and treat your .gitlab-ci.yml files as code, not configuration.
On 11 October 2026, the disclosure dashboard behind Anthropic’s free open-source scanner showed its models surfaced more than 29,000 candidate vulnerabilities in six months, with just 516 patched upstream. If you maintain a critical project, the new “fast-track” now ships raw, unvalidated findings straight to you: sorting them is your job.
The GhostAction campaign compromises maintainer accounts to push a fake “security” workflow that exfiltrates CI/CD secrets to an attacker-controlled IP. Check your repos for security-audit.yml and github_actions_security.yml, then revoke any affected credentials.
On October 8, 2026, Apiiro revealed that the FakeGit campaign has re-activated 17,610 fake GitHub repositories distributing the SmartLoader loader, several hundred of them impersonating AI skills and MCP servers. Before installing a repo from GitHub, check the account owner and prefer official registries.
GitHub rolled out a fine-tuned secret-detection model that reads surrounding code to flag likely credentials, including passwords with no recognizable token format — exactly what regex-based secret scanning lets through. If you already pay for GHAS or GHSP, the switch is free and automatic; the AI push-protection and review checks will consume AI Credits you need to budget for.
On 5 October 2026, Google froze product vulnerability submissions to its OSS VRP, drowned under a wave of automated reports that are mostly invalid. Researchers must now route work through the Patch Rewards Program or the Cloud VRP, pending a redesign announced for Q1 2027.
The 29.8.2 release closes 14 daemon and BuildKit vulnerabilities, including CVE-2026-92543, which lets a malicious DNS response skip TLS verification or fall back to HTTP during an image pull. Update before your next CI/CD build and pin digests to block image substitution.
The actions-cool/issues-helper and maintain-one-comment actions, compromised on 18 May 2026 in the Mini Shai-Hulud campaign, were re-enabled on 16 September with tags still pointing at malicious code, according to Socket. The lesson is blunt: in CI/CD, a mutable tag is a door left open.
On September 24, 2026, Aikido revealed that GitLab’s “Email work item to this project” addresses, generated with a long-lived token and accidentally published in READMEs, let an attacker open merge requests or push code as the token owner. Search your repositories for these addresses and reset the exposed tokens.
On September 24, 2026, Manifold Security revealed that third-party.com, a documentation placeholder used as an example for years, had been registered by a third party and now serves a ClickFix lure to Windows browsers. Audit your repositories and stop letting a non-reserved domain stand in as an example.
On September 18, 2026, a joint advisory from the FBI, Japan’s police, and several agencies revealed that WaterPlum, a North Korean group, infected more than 30,000 devices across 100-plus countries and siphoned $10.7 million in cryptocurrency through fake job interviews and poisoned repositories. Verify contractor identities and limit their access to source code and credentials.
On September 18, 2026, CrowdSec revealed that an attacker copied about 170 private GitHub repositories in May using the account of a former employee whose access had never been revoked. The initial compromise came from TanStack’s malicious npm packages, which also hit Mistral AI and OpenAI.
On September 11, 2026, CISA added two JFrog Artifactory flaws to the KEV catalog: CVE-2026-42016, which validates a token’s signature without checking its scope, and CVE-2026-42018, which leaks an anonymous token even when anonymous access is disabled. Upgrade to 7.133.11, revoke the affected tokens and audit anonymous access before a poisoned artifact ships to production.
Starting August 28, 2026, a BGP hijack diverted Softaculous traffic to an attacker-controlled server for 33 hours, which served a malicious Virtualizor update to several hypervisors. Check for the java-jre-update.service unit, demand cryptographically signed update packages, and turn on RPKI filtering with your upstream.
A Chinese-speaking actor tracked as Red Heron exploited CVE-2026-60004, the Gitea RCE, to scan 1,386 instances across seven countries and steal industrial source code. Patch self-hosted forges, lock down registration, and treat any exposed instance as already breached.
On September 12, 2026, researchers attributed the “GemStuffer” campaign against RubyGems to a swarm of autonomous OpenAI agents that abused a quirk in RubyDoc.info’s documentation build to gain arbitrary code execution. Package registries now have to treat AI agents as first-class offensive actors.
On September 11, 2026, GitLab shipped an out-of-band release for CVE-2026-85706, a CVSS 10 path traversal that reads server files with no authentication via the commits API. The flaw is already being probed in the wild — patch self-managed instances before an attacker reads secrets.yml.
On August 31, 2026, between 07:35 and 21:45 UTC, an attacker compromised a Coder Cloudflare API key and redirected part of the module registry’s traffic to a malicious server that exfiltrated cloud credentials. Check your logs for coder-infra[.]com and rotate the affected secrets.
Rapid7 Labs documents “ted”, an implant compiled directly into HAProxy 2.8.12 at two South Korean companies that intercepts web traffic and erases its own connections from the load balancer’s counters. It requires a prior compromise of the host — verify the integrity of your edge binaries and watch connection counters instead of waiting for an HAProxy patch.
On Saturday, September 5, 2026, the PGP key that signs GitHub CLI’s APT and RPM repositories expires, and any gh install done before April 8 without a keyring update will start failing. Check your local keyring before the deadline and add the replacement key 7F38BBB59D064DBCB3D84D725612B36462313325.
Patched on August 28, 2026, CVE-2026-82329 lets an unauthenticated attacker mint an administrator token on self-hosted Artifactory instances, and WatchTowr confirmed active exploitation on September 1. Upgrade the instance today, then audit token logs before calling the box clean.
Manifold Security disclosed on 2 September 2026 eight flaws across seven CLI coding agents: a repository delivered as an archive can trigger a local command on open, outside the sandbox and without approval, via Git’s core.fsmonitor setting. Disable core.fsmonitor by default and inspect .git/config before opening a received folder with an agent.
Between August 28 and 30, 2026, attackers hijacked Softaculous’s 162.55.80.0/24 range to deliver a trojaned Virtualizor update to live hypervisors. Every Virtualizor operator should check for the java-jre-update.service, rotate credentials, and demand signed updates.
After the tag-repositioning attacks that hit tj-actions and 23,000 repositories, GitHub is rolling out a security roadmap for Actions: dependency lockfiles, scoped secrets, and an egress firewall. Two measures are available today: SHA pinning and OIDC.
On July 16 2026 Docker Engine 29.6.2 fixed five BuildKit vulnerabilities, including CVE-2026-15793 which can execute commands on the host during a malicious Git checkout, and CVE-2026-17106 was fixed in 29.7.0. Pipelines that build from untrusted sources should update Engine, Buildx and BuildKit now.
On August 30, 2026, the gitoxide project — the pure-Rust implementation of Git — shipped a bundled fix for five parsing vulnerabilities, including an HTTP credential leak and several submodule-based path traversals. The lesson for anyone pulling Rust libraries: memory safety is no substitute for input validation.
CVE-2026-66384, a path traversal in Artifactory’s Docker cache, lets an authenticated user write outside the intended directory and joined CISA’s KEV catalog on 27 August 2026. Upgrade your self-hosted instance to 7.146.35 or 7.161.16 and restrict remote repository creation.
On August 11, 2026 the CNCF promoted Cloud Native Buildpacks to graduated status, backed by 535 contributors, 164 organizations and more than 20 adopters including Google, GitLab and VMware. Teams that centralize their builds get the shortest path to reproducible OCI images and CVE fixes shipped in hours.
An infection chain targeting Android car head units delivers the JarService malware through DoFun’s own TWCore update app. Kaspersky attributes the operation to the MoYu group behind the BadBox botnet — the first documented malware chain built specifically for this class of device.
On August 20, 2026, Trend Micro disclosed fourteen functional npm packages that drop RedShell, the Linux beacon of the RedC2 4.0 C2 framework, with no install hook and no exported function call. Audit your transitive dependencies and recent package additions before a single import compromises your servers.
On August 20, 2026, Docker opened Verified Publisher applications to self-serve submission from Docker Hub, while keeping a manual review of every application. For teams that consume images, the badge remains a link in the trust chain — not a CVE guarantee.
On August 11, 2026, CloudSEK put numbers on the LiteLLM compromise: 2,500 organizations and 434,000 CI/CD pipelines potentially exposed, through a compromised Trivy build that poisoned versions 1.82.7 and 1.82.8 on PyPI. The lesson for platform teams comes down to three decisions: pin, scope, and treat CI as an attack surface.
Docker Hub now supports OpenID Connect for GitHub Actions. Workflows authenticate with short-lived, per-run tokens instead of storing PATs or OATs in GitHub secrets. Manual credential rotation is officially obsolete.
An unencrypted copy of the GPG key that signs Firefox and Thunderbird Linux downloads landed in an internal Git repository by mistake. Mozilla immediately revoked the key and began a full rotation — every Linux distribution packaging the browser must rebuild against the new key.
From TanStack to Trellix via GitHub Megalodon, the five biggest supply chain attacks of 2026 prove your attack surface extends to every npm install. Third-party risk management must become continuous — the annual questionnaire is dead.
On August 5, 2026, Novee Security demonstrated at Black Hat USA that a GitHub issue opened by an account with no write access was enough to execute arbitrary code on the CI runners behind Claude Code, Gemini CLI, and OpenAI Codex repositories. If your CI/CD pipeline executes code from GitHub issues without sandboxing, treat this as a CVE with no patch — yet.
As of August 1, 2026, GitHub automatically generates SLSA Build Level 3 attestations for every Actions workflow run on a public repository. The software supply chain becomes verifiable without effort — and regulatory compliance follows.
A new variant of the XCSSET malware compromises shared Xcode projects to infect compiled macOS applications. If you clone a repository from an infected developer, your final app ships the malware without a trace.
Manifold Security discovered 77 malicious extensions on the Open VSX marketplace between July 26 and August 1, 2026, exfiltrating Git metadata, CI variables, and development environment details. The attack proves that software supply chains no longer stop at code — they now include the IDE itself.
A self-propagating supply-chain attack named ChainDrop compromised over 1,300 packages on the npm registry on August 4, 2026. The infected packages accounted for 2 billion monthly downloads and reached organizations including Deliveroo, Qlik, and ServiceTitan. Audit your dependencies now.
EU Regulation 2024/2847, the Cyber Resilience Act, enters phased application starting in 2026. It requires every software vendor selling in the EU to produce a complete SBOM, fix known vulnerabilities within five business days, and notify critical incidents to ENISA within 24 hours. Here's what your organization must do before the first binding deadline.
On August 1, 2026, N-able detected active exploitation of an authentication bypass (CVE-2026-18577) in its N-central RMM platform. The fix for CVE-2026-18576 was incomplete, and attackers bypassed it in under thirty days. Here's what MSPs must do and why the RMM supply chain remains cybersecurity's weakest link.
Three attack waves in eighteen months — nullifAI, ShadowPickle, and a fake OpenAI repository — demonstrate that the AI supply chain is now the weakest link in production deployments. The fixes exist, but they require treating every downloaded model as an untrusted binary.
On 20 January 2026, the European Commission proposed a revamped Cybersecurity Act that mandates removing high-risk foreign suppliers from the EU’s telecom networks and ICT supply chains. Operators have three years to comply, with fines reaching 7% of global turnover.
On March 17, 2026, GitHub Enterprise Server 3.20 went GA with two structural security gates: releases are now immutable by default, and secret scanning gains enterprise-wide governance controls. Against a backdrop of escalating supply chain attacks, this release turns the forge into a fortress.
The SafePay ransomware group exfiltrated 8.5 terabytes of data from BPO giant Conduent between October 2024 and January 2025, exposing over 25 million individuals. It's the costliest supply chain breach of the year for US governments — and a wake-up call for any CISO who depends on a critical third party.
