GitHub CISO Alexis Wales has named the malicious VS Code extension behind the recent breach: Nx Console, a popular developer tool.

Attackers can hide malicious code in shared machine learning models. Learn how to manage machine learning model security and protect systems.

Threat actors have launched a coordinated campaign exploiting previously unknown flaws in critical semiconductor manufacturing systems.

At this week's Black Hat Europe conference, two researchers urged developers to adopt a shared responsibility model for open source software.

An attacker has published backdoored Axios npm packages that trigger the installation of droppers and remote access trojans.

HYCU introduces R-Shield to provide comprehensive cyber resilience across SaaS, cloud, and on-premises environments as organizations face growing supply chain attacks.

Group-IB's threat lead on making software supply chain security a daily practice, from SBOM triage to AI-driven attack timelines.

Through artifact attestation and the SLSA framework, GitHub's director of product management, Jennifer Schelkopf, argues that at least some supply chain attacks can be stopped in their tracks.

Unknown attackers have compromised 30+ Red Hat Cloud Services npm packages with malware that goes after developers' secrets.

well as the date of the automatic update read more about VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

Sohail Iqbal, CISO at Veracode, addresses modern AppSec threat detection, CI/CD compromise methods, and how to reduce attacker dwell time.

Google Threat Intelligence Group has revealed that a Mandiant analyst infiltrated TeamPCP, a hacking group accused of carrying out an unusually extensive series of software supply-chain attacks. The analyst spent months building trust with a TeamPCP member and gained access to an internal chat used by roughly a dozen people at the center of the operation. This access gave Google visibility into the group's activities and helped the company warn potential victims and disrupt further attacks. TeamPCP, which appears to have emerged online in late 2025, repeatedly compromised open-source software and developer accounts to distribute malware and obtain additional credentials. Its targets reportedly included tools and companies such as Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI. The campaign eventually affected more than a thousand companies and exposed credentials belonging to hundreds of thousands of users. The group also used a self-spreading worm called Mini Shai-Hulud to automate parts of the operation. Google says its undercover analyst discovered a server containing stolen usernames, passwords, and access tokens. Rather than contacting every affected organization individually, Google first worked with major service providers, including Amazon Web Services and Microsoft, to revoke compromised credentials and limit the hackers' ability to use them. Google also discovered an AI-assisted zero-day exploit being developed by someone in the group's circle. After testing the exploit, Google alerted the affected software developer, who patched the vulnerability. The investigation also benefited from a split between TeamPCP and the cybercriminal group ShinyHunters, which provided Google with chat logs. Separately, Google researchers traced digital clues linking a TeamPCP member to an email account and a Google Drive containing stolen material. The information was passed to the FBI and contributed to the investigation that preceded the arrests in Australia of Ruben Ian Thomson and Louis Michael Gaebler. Google says its undercover analyst did not participate in illegal hacking and only observed the group's activities while maintaining the cover.

accessible during the exposure windows read more about Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks