9 new stories · 1 update
Supply chain attacks lead today: the GhostAction workflow campaign, a Tensorlake npm release carrying a Shai-Hulud worm variant, and a SubQuery package with a hidden credential-stealing payload. On the edge side, CISA added Citrix NetScaler flaw CVE-2026-88779 to KEV and five Flax Typhoon-exploited flaws with an October 11 federal deadline.
Attackers planted credential-stealing GitHub Actions workflows across hundreds to tens of thousands of repositories.
Why it matters: Stolen CI/CD secrets, cloud keys and tokens mean affected repos need workflow audits and credential rotation, not just removal of the fake workflows.
Read the reporting at Cybersecuritynews → · Also reported by Thehackernews, Cybersecuritynews
A compromised Tensorlake npm package carried a worm that steals developer secrets and wipes machines when revoked.
Why it matters: The release was published with an npm provenance attestation, so provenance alone did not signal it was safe, and the worm wipes machines when secrets are revoked, which changes incident response order.
Read the reporting at Stepsecurity → · Also reported by Cybersecuritynews
One independent source stands behind this story, or only discussion threads do. It is shown so you are not behind on it, and it keeps this label until a second independent outlet reports it. Reddit, Hacker News and X are shown as discussion and never count as confirmation. How every briefing is checked →
Attackers compromised the SubQuery ecosystem to steal credentials and install backdoors.
Why it matters: A hidden payload in @subql/common@5.8.3 collects credentials and supports remote shell access, so anyone who installed it should treat the host as compromised.
CISA warned that Citrix NetScaler flaws, including a third zero-day, are being actively exploited.
Why it matters: Citrix NetScaler is back in KEV for the second time in ten days, so exposed ADC and Gateway appliances move to the top of the patch queue.
CISA ordered federal agencies to patch five exploited flaws by October 11 amid a Flax Typhoon campaign.
Why it matters: The October 11 deadline for federal agencies is a useful external benchmark for everyone else running the same software against a named threat actor.
One independent source stands behind this story, or only discussion threads do. It is shown so you are not behind on it, and it keeps this label until a second independent outlet reports it. Reddit, Hacker News and X are shown as discussion and never count as confirmation. How every briefing is checked →
An ISACA blog argues federal zero trust fails on process rather than technology.
Why it matters: ISACA's argument that federal zero trust fails on process gives practitioners a case for funding governance work alongside tooling.
EU firms are moving to mandatory zero trust under NIS2 enforcement.
Why it matters: NIS2 enforcement is pushing EU firms toward mandatory zero trust, which affects compliance planning for anyone serving them.
Commentary asks what breaks when one vendor or cloud provider underpins many critical services.
Why it matters: Commentary on concentration risk pushes teams to map which critical services depend on a single vendor or cloud provider.
Read the reporting at Nhimg → · Also reported by Nhimg
Google halted submissions to its open-source vulnerability program amid a surge of invalid AI reports.
Why it matters: Google's pause on open-source vulnerability submissions after a surge of invalid AI reports removes a reporting channel and signals triage strain for maintainers.
Further CISA KEV additions affecting enterprise edge products and collaboration platforms Cybersecuritynews reports CISA added the Citrix NetScaler flaw CVE-2026-88779 to the KEV catalog as actively exploited, and Thehackernews reports CISA set an October 11 patch deadline for five Flax Typhoon-exploited flaws.
One side: One report says GhostAction compromised 346 GitHub repositories using two hijacked maintainer accounts.
The other: Another report says GhostAction compromised 772 GitHub repositories.
68 sources read for this niche today. 16 couldn't stand as a citation and were set aside. 9 stories cleared the bar. Reddit, Hacker News and X are shown as discussion and never counted as corroboration. Built 01:19 UTC. How every briefing is checked →
This briefing in your inbox every Monday. We skip emails when there are no new stories to report.
Free · weekly · unsubscribe in one click · no account needed. Pro: daily, or the weekdays you pick.