AI Agents Mining GitHub for OAuth Secrets
Microsoft confirms AI agents autonomously steal OAuth secrets from GitHub and compromise tenants. Chainalysis full credential dump and DigiCert identity-do.
IT, Networking & Security
IT, Networking & Security — tutorials, guides, and insights.
Latest Posts
Cold-Chain OT Attacks Hit Blood Banks - FBI CISA Alert
FBI and CISA warn of active cold-chain refrigeration attacks hitting a French blood bank. OpenSSH auth bypass CVE and ARTEX AI credential theft framework e.
Zyxel Zero-Day Survives Its Own Patch - CVE-2026-107441
CVE-2026-107441 Zyxel GS1900 zero-day still exploitable after October patch. Plus a $133M bank heist via supplier compromise and APT29 zero-click mobile ex.
cPGuard Supply-Chain Attack Backdoors Linux Hosts
cPGuard update server hijacked Nov 2 deploying backdoors on Linux hosts. Plus XCPE botnet takedown, Binance $6.3B attack chain, and LLMjacking at $1M/day.
Fake Interview to $6.3B Theft - NHI Lessons
North Korean operators stole $6.3B via fake interview and laptop secrets. Teams help-desk impersonation chains to AD CS abuse.
Ivanti Chain-Exploit Patched - CVE-2026-111357
Ivanti patches CVE-2026-111357 and CVE-2026-118527 zero-day chain exploited since October. Chinese APT weaponizes ARTEX AI framework against 200+ orgs.
AD CS Cert Theft via Teams - ESC1 and ESC8 Abuse
Microsoft documents Teams help-desk impersonation chaining to AD CS ESC1/ESC8 cert theft and DCSync. Plus AI agent breach at Chainalysis and mass API key t.
Ivanti VPN Zero-Day Chain - CVE-2026-111357 KEV
CVE-2026-111357 and CVE-2026-118527 Ivanti Connect Secure zero-days chained since Oct 1. C3RB3R ransomware hits NAS.
Binance $6.3B Breach - One DevOps Service Account
Binance's $6.3B crypto theft traced to a single compromised DevOps service account. Plus a trojanized AI coding agent and GhostAction's AWS OIDC targeting.
Cisco ASA/FTD Zero-Day CVE-2026-76418 on CISA KEV
CVE-2026-76418 crashes Cisco ASA/FTD firewalls under active exploit. KeyDrift malware steals SD-WAN keys. Binance loses $6.3B to North Korea.
Cisco ASA FTD VPN Zero-Day CVE-2026-76418 Exploited
CVE-2026-76418 crashes Cisco ASA/FTD VPN devices remotely. Plus Volt Typhoon SD-WAN zero-day and Brotli RCE across all major runtimes.
M365 Token Replay Hits 79 Orgs - MFA Bypassed
Microsoft 365 AitM campaign replays stolen tokens across 79 orgs. CVE-2026-80097 leaks Authenticator tokens. Gheist steals GitHub secrets at scale.
PHP2Shell Chains Root US Govt Firewalls - CVE-2026-101767
China-linked actors chain PHP2Shell to root US govt firewalls. Oracle EBS CVE-2026-101767 under active probing. Anthropic AI chains exploits autonomously.
HTTP2Shell Brotli RCE - CVE-2026-111497 CVSS 9.2
CVE-2026-111497 Brotli RCE hits Node.js, .NET, PHP, Python. PHP2Shell CVE-2026-109618 on CISA KEV with Thursday deadline. Gheist steals GitHub secrets.
Brotli RCE Hits Node.js, .NET, Python - Patch Now
Brotli compression library RCE affects Node.js, .NET, PowerShell, and Python. Gheist steals GitHub secrets via Actions.
M365 Token Replay Hits 79 Orgs - MFA Bypassed
M365 AitM token replay campaign breached 97 accounts across 79 orgs. Gheist steals GitHub secrets via Actions logs. AI agent hijacked by AGENTS.md file.
Storm-0940 AI Agent OAuth Breach - 3 Hours
Storm-0940 used ARTEX AI agent to breach ConnectWise OAuth in under 3 hours. Railway PaaS secrets exposed. VeloCloud zero-day patched.
VeloCloud Third Zero-Day - SD-WAN Under Siege
VeloCloud Orchestrator hit by third zero-day in four months. Storm-0940 used AI to breach 2,200 MSPs in 3 hours. PHP discloses second unpatched RCE.
Storm-0940 AI Attack Hits Hundreds in 3 Hours
Storm-0940 used agentic AI for a 3-hour supply chain breach via ConnectWise. Plus GitLab CVSS 10.0 RCE and PHP2Shell exploited pre-patch.
Critical PHP RCEs Leaked Pre-Patch - CVE-2026-109618
CVE-2026-109618 and CVE-2026-109619 PHP RCE details leaked before patch. Plus Tor exit node hijacking and eMudhra CA key compromise forces cert reissuance.