Massive Supply Chain Attacks Rock GitHub & Laravel; CISA Contractor Leaks GovCloud Keys

Grafana Labs confirmed theft of source code and internal data by 'CoinbaseCartel' extortion group. This breach was a direct consequence of the TanStack supply chain attack. Attackers exploited a single workflow token, stolen via the malicious TanStack npm package, which was missed during Grafana's credential rotation. This incident demonstrates the severe, cascading impact of supply chain compromises and the critical need for thorough remediation. The stolen code could be weaponized, increasing systemic risk.

New details reveal the NYC Health + Hospitals data breach, affecting 1.8 million individuals, stemmed from a compromise at an unnamed third-party vendor. Attackers maintained network access from November 2025 to February 2026, indicating a significant dwell time. Crucially, the exposed data now includes highly sensitive biometric information such as fingerprints and palm prints, in addition to medical records, diagnoses, Social Security numbers, and financial details. The inclusion of immutable biometric data significantly escalates the long-term risk of identity theft for affected individuals, as this information cannot be changed or revoked, posing a permanent threat.

New research from ESET confirms Webworm's expanded targeting to specific government entities in Belgium, Italy, Poland, Spain, and South Africa. The GraphWorm backdoor is now detailed to leverage OneDrive as a dead-drop for C2 and exfiltration, with compromised AWS S3 buckets also used for data exfiltration. ESET successfully decrypted over 400 Discord webhook messages from EchoCreep, providing deeper insights into its operation. The update also includes more specific hunting hints, such as URL patterns for Discord webhooks and Microsoft Graph API, and process names to monitor for anomalous activity.

This update provides a more detailed technical analysis of the 'Underminr' vulnerability, outlining the reconnaissance, setup, exploitation, and bypass steps. It maps the technique to several MITRE ATT&CK techniques, including T1071.001, T1090.002, T1573.002, and T1572. New hunting hints are introduced, such as looking for JA3/JA3S hash mismatches and uncommon User-Agents for specific domains. The article further emphasizes that the ultimate mitigation responsibility lies with CDN providers to reconfigure their routing logic, while organizations should focus on TLS inspection and egress filtering.

The NGINX Rift vulnerability (CVE-2026-42945) continues to be actively exploited, with new analysis emphasizing its critical impact on NGINX instances used as API gateways. Additional detection methods include vulnerability scanning and deploying WAF/IPS with specific signatures. For mitigation, disabling the `ngx_http_rewrite_module` entirely is suggested if rewrite functionality is not essential, alongside existing patching recommendations. The threat of DoS and RCE remains high, urging immediate action.