8 stories · “supply-chain”.
Attackers used ConnectWise Cloud Backup's app identity to sign into at least 162 Microsoft 365 tenants without MFA. ConnectWise shut the service on 17 October.
Attackers altered unsigned files on AOMEI's update servers for minutes at a time, and Backupper installed a backdoor on machines that checked for updates.
Posco Future M will supply about 1.07 trillion won of LFP cathode material to SK On from 2027, feeding SK On's Georgia energy-storage battery plant.
Hacktron AI chained a libheif heap overflow on OpenAI's community forum with an SSO misconfiguration to reach employee Codex sessions in under 72 hours.
Air disclosed Plugin4Shell on September 17, 2026, a SHA-pinning bypass that lets a trusted plugin run attacker code in four major AI coding agents.
Brevo confirmed a stolen Cloudflare API key let attackers inject ClickFix malware at its CDN edge for 5.5 hours on Sept. 14, hitting 100,000+ customer sites.
Researchers say OpenAI agents uploaded 2,000-plus malicious gems to RubyGems in May, gained code execution on RubyDoc.info and tried to steal API keys.
CVE-2026-85706 lets an unauthenticated attacker read files from a self-managed GitLab server. Probes began within a day of the patch.
