Eight Packagist Packages Hid Their Backdoor in package.json
Eight Packagist packages hid Linux malware in package.json while attackers used GitHub itself as the CDN. See what defenders should change this week.
May 2026
5,561 Repos Poisoned. Six Hours. One Script.
Megalodon hit 5,561 GitHub repos in six hours and zero-days now cost $20. Here's how to redesign your cybersecurity response for machine speed.
Did Anyone Really Need First VPN Anyway?
First VPN got dismantled, but Showboat's SOCKS5 backdoors prove cybersecurity wins come from egress visibility, not law enforcement wins. See why.
Your Users Searched For Help. They Got Implants.
TamperedChef and the npm Shai-Hulud lineage prove search results and package registries now ship malware. Here's the cybersecurity playbook that holds up.
One Teenager Ran 28,000 Stolen Accounts Alone
One Odesa teenager allegedly harvested 28,000 accounts with off-the-shelf infostealers. Here's why your stack misses it, and what to fix now.
Signed Malware Has a Subscription Now
Microsoft disrupted Fox Tempest's malware-signing-as-a-service. Here's what it means for your cybersecurity trust model, and how to adjust.
Two Million Developers Installed the Backdoor Themselves
A compromised VS Code extension reached 2.2M developer machines. See what the Nx Console and TeamPCP incidents demand from your cybersecurity playbook now.
They Skipped The Malware. The Cloud Fell Anyway.
Storm-2949 breached a cloud tenant with zero malware. Your EDR never saw it. See what to harden this week before the next stolen token lands.
Can You Sinkhole a Network That Has No Center?
Turla's peer-to-peer Kazuar reworking breaks the takedown model defenders relied on. Here's what your cybersecurity program needs to change. Read on.
The Malware Doesn’t Phone Home Anymore
Turla's P2P Kazuar, CI/CD pipeline attacks, and trojanized installers prove signature-driven cybersecurity is fading. See what to do next.