Massive 'TrapDoor' Supply Chain Attack Hits Open-Source; GitHub & Grafana Breached; Critical Drupal RCE Exploited
Summary
This cybersecurity brief for May 26, 2026, covers a critical period marked by sophisticated supply chain attacks and significant data breaches. The headline event is the 'TrapDoor' campaign, a multi-faceted attack targeting npm, PyPI, and Crates.io to steal developer credentials and crypto wallets. The software development ecosystem was further shaken by source code breaches at both GitHub and Grafana Labs. Concurrently, a critical, actively exploited SQL injection vulnerability (CVE-2026-9082) in Drupal core put countless websites at risk. Other major events include a data breach at 7-Eleven claimed by ShinyHunters and a new 12-hour patching mandate from India's CERT-In in response to AI-driven threats.
Today New Articles
TrapDoor Supply Chain Attack Hits npm, PyPI, Crates.io, Stealing Crypto & Dev Secrets
A highly sophisticated, multi-repository supply chain attack dubbed 'TrapDoor' has compromised over 34 packages across npm, PyPI, and Crates.io. The campaign, which began on May 22, 2026, targets developers in the cryptocurrency, DeFi, and AI sectors. The malw...
7-Eleven Confirms Franchisee Data Breach After ShinyHunters Claim
Convenience store giant 7-Eleven has confirmed a data breach impacting its franchisee application systems after the ShinyHunters cybercrime group claimed responsibility. The breach, discovered in April 2026, exposed the personal information of over 185,000 pro...
Microsoft Patches High-Severity SharePoint RCE Vulnerability (CVE-2026-45659)
Microsoft has released patches for a high-severity remote code execution (RCE) vulnerability, CVE-2026-45659, affecting multiple versions of SharePoint Server. The flaw, rated with a CVSS score of 8.8, is caused by insecure deserialization of untrusted data. I...
India's CERT-In Mandates 12-Hour Patching for Critical Flaws in Response to AI-Driven Attacks
The Indian Computer Emergency Response Team (CERT-In) has released a new 38-page blueprint that mandates organizations to patch critical vulnerabilities in internet-facing systems within 12 hours of detection, where feasible. This aggressive timeline is a dire...
DragonForce Ransomware Group Claims Attacks on Dutch Waste Firm and US Businesses
The DragonForce ransomware group has claimed responsibility for a cyberattack on Saver NV, a Dutch waste management company, on May 25, 2026. The group is threatening to leak the company's data if a ransom is not paid. On the same day, DragonForce added two US...
Bomco Data Breach Exposes SSNs, Financial, and Health Data of Over 800 Individuals
Bomco Inc., a Massachusetts-based aerospace manufacturer, has disclosed a data breach that occurred in June 2025. The breach, which took nearly a year to fully investigate and report, resulted in an unauthorized actor accessing files containing names, Social S...
GitHub Confirms Source Code Breach Via Compromised Employee Device and Malicious VS Code Extension
GitHub, the world's largest code hosting platform, has confirmed it suffered a data breach that resulted in the theft of internal source code. The attackers gained access by compromising an employee's device with a weaponized Visual Studio Code extension. An e...
Article Updates
Iranian APT 'Screening Serpens' Intensifies Espionage with New RATs Targeting US, Israel, and UAE
Update:The Iranian APT, also known as Nimbus Manticore, has evolved its tactics by employing SEO poisoning to distribute a new backdoor named 'MiniFast'. This marks their first observed use of SEO poisoning, creating fake software download pages (e.g., for Oracle SQL...
‘Megalodon’ Campaign Hits 5,500+ GitHub Repos in Automated CI/CD Supply Chain Attack
Update:The new article provides a hypothetical example of the malicious GitHub Actions workflow used for secret exfiltration, showing how attackers collect and send sensitive data to their servers. It also details additional mitigation strategies, such as using OpenI...
Grafana Labs Source Code Stolen by 'CoinbaseCartel' in TanStack Supply Chain Attack Fallout
Update:Following the recent source code theft, Grafana Labs has provided an update on the incident. The company confirmed that its investigation found no customer data was exposed and its services remained undisrupted. Furthermore, Grafana Labs publicly announced its...
Update:The critical SQL injection vulnerability, CVE-2026-9082, continues to be actively exploited in the wild. Following CISA's earlier alert, the Cyber Security Agency of Singapore (CSA) has now also issued an advisory confirming widespread exploitation, emphasizin...