Waper
Use on the web

Cybersecurity

Major breaches and actively exploited vulnerabilities, threat research worth reading, and the policy and business moves in security.

  • Official
  • Public
  • 0 followers
Sign up to followCustomize it
You're reading the brief from Mon, Oct 26.
Back to the latest brief

Large-scale compromises affected online stores, Microsoft 365 accounts and developer repositories.

Cybersecurity5 items

PHP also rebuilt its Windows packages to address a Brotli flaw that could permit code execution.

Breaches & attacks

Attackers infect 953 online stores with scanner-evading JavaScript

An unknown attacker has infected 953 online stores, mostly running Magento, in a campaign active since July 2025. Sansec says the campaign uses Magento CMS blocks to serve malicious JavaScript loader code to visitors.

Why it matters: The scale and scanner-evasion techniques make this a significant concern for e-commerce operators assessing storefront integrity.

Breaches & attacks

Gheist exploits stolen GitHub tokens to extract private repository secrets

An ongoing campaign targeting thousands of developer repositories uses stolen GitHub tokens to plant workflows that expose secrets in Actions logs. Attackers download the logs and delete the runs; Wiz reports successful attacks against private repositories and GitHub Enterprise environments.

Why it matters: Compromised developer tokens can expose downstream cloud credentials, while deleted workflow runs complicate investigation.

Breaches & attacks

Microsoft 365 token-replay campaign compromises 97 accounts at 79 organizations

Huntress observed an adversary-in-the-middle campaign that captured sign-in sessions and replayed stolen tokens to access Microsoft 365 email accounts. Between July 14 and September 22, 2026, it detected 497 successful sign-ins, with 97 accounts compromised across 79 organizations.

Why it matters: The findings highlight stolen session tokens as a route into corporate email across multiple organizations.

Ask Kiki about this brief

Sign in to ask questions about this brief.

Recent briefs

  1. Tue, Nov 38 itemsA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems. Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
  2. Mon, Nov 26 itemsGoogle and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations. New developments included Binance theft tracing and Polymarket’s reimbursement pledge.
  3. Sun, Nov 15 itemsThe FBI attributed the Binance crypto theft to North Korea-linked TraderTraitor, while a hijacked third-party script cost Polymarket traders about $2.7 million. Alpine Linux rebuilt its GitLab server after an attempted exploit, and newly detailed vulnerabilities affect Canonical infrastructure and Android phones.
  4. Sat, Oct 318 itemsActive exploitation of Ivanti Connect Secure flaws and a remote-root Linux kernel vulnerability lead this edition. Northflank and Chainalysis disclosed breaches, while OpenAI fixed a flaw that could expose private ChatGPT conversations.
  5. Fri, Oct 308 itemsBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers. A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
  6. Thu, Oct 296 itemsActive exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent. Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.
  7. Wed, Oct 288 itemsCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records. Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.

Who and what it tracks

  • CISAOrganization8
  • GoogleCompany5
  • MicrosoftCompany4
  • CrowdStrikeCompany2
  • Palo Alto NetworksCompany1