An identical, highly sophisticated malicious program has successfully breached both sides of a major programming language divide simultaneously. On September 23, deeply infected releases of the MemTensor packages inexplicably materialized within both the npm (Node.js) and PyPI (Python) registries. Concealed deep within these compromised distributions lurked sckit, a remarkably versatile, cross-platform worm written in Go. The cybersecurity firm Aikido, which spearheaded the discovery, officially christened the campaign…

The mere restoration of public access to previously suspended repositories proved catastrophically sufficient to reinvigorate a dormant supply chain attack, shattering four months of enforced tranquility. Two critical GitHub Actions repositories, explicitly managed by the 'actions-cool' organization, abruptly became accessible once again on September 16. Appallingly, the malicious tags injected back in May had never been expunged. Consequently, unsuspecting automated workflows inadvertently resumed downloading and executing the virulent Mini Shai-Hulud malware payload.

Infrastructure code has horrifyingly metamorphosed into a convenient snare for developer workstations. Cybersecurity firm Aikido recently unearthed malicious code deeply embedded within dual Terraform providers and twin Go modules. The company classifies this terrifying discovery as the inaugural documented instance of systematic malware distribution weaponizing the official Terraform Registry. The malicious providers, specifically designated as gocommunity-io/dockerd and kreuzwenker/docker, were surreptitiously published in early September.

A malicious npm package,

An expert analysis of tw-pkgprobe-7731, a malicious npm package that impersonated Twilio bug bounty tools to steal developer credentials.

At a Glance Attribute Details Malware Family sckit Go binary Threat Actor Unknown Target Victims AI developers and LLM researchers Delivery Vector Malicious npm and PyPI package releases Key Capabilities Credential harvesting, background execution, environment scanning Source Socket Executive Summary A severe software supply chain attack hit the popular open-source AI memory framework MemOS. The MemTensor MemOS compromise distributed credential-stealing malware to artificial intelligence developers.

https://www.osintinvestigate.com A major cybersecurity incident involving Brevo exposed more than 100,000 websites to malicious code. In this episode, we examine how attackers compromised Brevo, abused a long-lived Cloudflare API key, and used a malicious Cloudflare Worker to inject scripts into Brevo services and JavaScript assets embedded by customers. The attack also involved ClickFix social engineering and attempts to install malicious WordPress plugins when administrators visited affected websites. We explain the September 2026 timeline, how the attack worked, why supply chain compromises can have such a wide impact, and what website administrators should check after the incident.

The Clop ransomware group claims a mass data theft campaign targeting Shell, Philips, and GE by exploiting a critical vulnerability (CVE-2026-12569) in...

The server management panel Virtualizor recently suffered a devastating supply chain attack. Hackers maliciously manipulated Border Gateway Protocol (BGP) routing to redirect legitimate Virtualizor updates directly toward servers they controlled. Consequently, the attackers successfully installed backdoors onto host machines actively utilizing Virtualizor. They then injected their own SSH key pairs to guarantee total administrative control. Preliminary investigations reveal a remarkably severe BGP hijacking incident.

The veteran VPS server management panel Virtualizor has confirmed a serious supply-chain attack. Between 28 and 30 August 2026 UTC, attackers hijacked the BGP routing for the IP range hosting some Softaculous servers, diverting traffic bound for the management panel's update servers to hosts under the attackers' control. Related discussion now also confirms that the host machines of several downstream VPS providers had backdoors implanted by the attackers.

Intelligence | An OSINT reconstruction of how ordinary communications devices became weapons, what public evidence proves and what remains unresolved

Australian news outlets and law enforcement agencies recently announced a significant breakthrough. On August 26, 2026, the Australian Federal Police collaborated with the Western Australia Police Force and the United States Federal Bureau of Investigation. Together, they executed multiple search warrants across the Perth region of Western Australia. Consequently, officers arrested two young men allegedly involved intimately with the international cybercrime syndicate known as TeamPCP.