A self-propagating worm named ChainDrop tore through the npm registry on August 4, poisoning packages that huge parts of the software world depend on. It began by hijacking the GitHub account behind keyv, a caching library pulled in about 150 million times a week, then spread to sibling and downstream packages, reaching over 1,300 poisoned versions with billions of monthly downloads within hours. A preinstall script harvests credentials from developer and continuous integration environments, including AI agent tokens, cloud keys, and self-hosted CI secrets, then uses stolen npm publishing access to poison more packages. A descendant of the earlier Shai-Hulud worm, it even forged valid-looking build provenance.
cPanel patched a critical flaw that lets an ordinary hosting customer escalate to full database administrator access, running SQL as the database root user. Tracked as CVE-2026-58048 with a score of 9.4, the bug is significant on shared hosting, where many customers use one database server: administrator access there can expose or alter other tenants' data, and depending on the operating system and database configuration, cPanel warns it may extend to operating-system-level compromise. cPanel is one of the most widely deployed web hosting control panels, so the flaw affects a large number of shared and reseller hosting environments. Fixes shipped across several release tiers.
Pillar Security showed that Google's Agent Development Kit repository could be turned against itself through a poisoned pull request or issue. The public repository ran a low-privileged triage agent that responded to outside contributions, and a higher-privileged agent reserved for maintainers. Because the triage agent posted through a bot account that counted as a repository collaborator, a prompt injection could make it post a command that satisfied the privileged workflow's trust check, invoking the maintainer-level agent. That crossed into a job holding a long-lived access token, a Google API key, and a cloud service-account credential, enabling code execution on the runner and secret theft. Google deleted the affected workflows.
TP-Link patched 15 vulnerabilities in the zero-touch provisioning system of its Omada business networking line, which lets IT teams and managed service providers configure switches, access points, gateways, and routers remotely. Forescout's Vedere Labs, which presented the findings at Black Hat, reported hardcoded cryptographic keys and certificates, insecure credential transmission, weak certificate validation enabling interception, a race condition in cloud device adoption, and default credentials. Chained with two previously disclosed command-injection flaws, they let an attacker break the provisioning chain of trust and infiltrate networks. Eleven received CVEs, and some issues also affect TP-Link cameras and smart-home devices. Forescout found over 1,800 exposed controllers.
Manifold Security found 77 malicious extensions on Open VSX, the open marketplace that editors like VSCodium, Cursor, and Windsurf pull extensions from, impersonating legitimate developer tools. Detected between July 26 and August 1, all 77 were linked through a shared exfiltration domain and common code. Fifty-eight sent only basic system information, while the other 19 performed deeper reconnaissance, exfiltrating developer, Git repository, and continuous integration metadata. Manifold found no access to source code, credentials, tokens, or SSH material and did not determine the campaign's goal. The extensions were pulled from Open VSX by August 3, but must still be removed manually from affected machines.
Palo Alto Networks Unit 42 detailed a rebuilt version of XCSSET, macOS malware that spreads through Xcode developer projects. The actors compromise Git repositories and inject a downloader into ordinary files inside a project, so that when a developer builds the cloned project, a hidden loader runs under their own account with no permission prompt. It then infects every other Xcode project on the machine and propagates through shared code. Version 40 hides its logic in memory, generates polymorphic payloads, and adds a Chrome hijacker that drives the browser through its debugging protocol plus a component that trojanizes Telegram. Seventeen modules handle credential, keystroke, clipboard, and browser theft.
N-able is warning that attackers exploited an authentication bypass in N-central, the remote monitoring and management platform used by managed service providers and IT teams to administer customer endpoints. The flaw, CVE-2026-18556, allows unauthenticated administrative account takeover, and N-able's initial fix in one release proved incomplete: it found another way to exploit the same weakness, tracked as CVE-2026-18577, that widened the affected range. After taking over a server, attackers used its remote-control feature to reach managed endpoints and installed Cloudflare tunnels as services, which kept access alive even after the route through the N-central server was cut. Build 2026.3.1.7 is the first unaffected version.
Researchers at Zafran disclosed three flaws, collectively named FaceHugger, in Hugging Face's widely used Diffusers library that let a crafted model repository run arbitrary code on any machine that loads it. All three bypass trust_remote_code, the safeguard meant to stop unreviewed code from executing, by exploiting a timing gap: the trust check runs against the first of two separate download requests, so anything that makes the loader see custom code the check did not slips through. One variant abuses a default None.py filename, another a race condition, and a third cross-repository pipeline loading. Because Diffusers runs inside production pipelines, CI/CD, and container images, one poisoned model load can mean deep initial access.
A data-leak forum listing is advertising an alleged dataset from Polish convenience-store chain Żabka for 5,000 euros, claiming roughly 541,000 Jira issues, about 230,000 IT service-desk tickets, and source code from 89 GitLab repositories. The post names real internal systems, including the chain's point-of-sale platform and SAP environment, and more than 20 outside vendors. A reviewer of the sample archive found the counts internally consistent and noted that a single GitLab access token appears across all 89 repository dumps, pointing to reused credentials rather than a code flaw. Żabka has not confirmed the breach, and the seller's account has no trading history.
Palo Alto Networks Unit 42 described three techniques, collectively Pass-ta-key, in which malware already running on a compromised Windows PC abuses Google Password Manager's synced passkeys. None break the underlying cryptography; they target how Chrome stores device keys, re-enrolls a device, and whether a site verifies that a person was present. The techniques can silently obtain a valid login assertion without any unlock prompt, register an attacker-controlled verification key that defeats user-verification checks, or extract the secret that decrypts all of a user's synced passkeys for reuse elsewhere. Passkeys still resist phishing, but a fully compromised endpoint undermines the synced-passkey model.
TrustStrike Labs