The Hacker News (2 hours ago)
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository’s secrets into its GitHub Actions logs, which the attackers then download before deleting the runs.
Read the full story on The Hacker News.
What makes them safer – and where they fall short
Keeping secrets is difficult in an open world, but we’ve done it before and must do it again
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Microsoft Entra ID is retiring custom CSS positioning in company branding to stop phishing. Custom placement reverts to default layouts, but core logos and colors remain.
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.
71 active sources
26 Turkish · 45 English
All sources
