Gitea, Zimbra Exploited; AI Dev Secrets Targeted in New Attacks

Jscrambler NPM Package Hijacked in Supply Chain Attack, Deploys Infostealer Targeting Cloud & AI Dev Secrets

Malicious 'jscrambler' NPM Package Versions Deploy Cross-Platform Infostealer in Sophisticated Supply Chain Attack

A supply chain attack hit the popular `jscrambler` npm package, with malicious versions published to the registry using a compromised maintainer credential. These versions contained a Rust-based infostealer designed to steal developer credentials from cloud services (AWS, Azure, GCP), cryptocurrency wallets, and a new class of AI coding tools like Claude and Cursor. The malware executed via `preinstall` hooks and later `require()`-time injection, demonstrating evolving evasion tactics. Jscrambler has since revoked the credential, deprecated the malicious versions, and urged users to upgrade to a clean version and rotate all secrets.

July 12, 2026

5 min read

supply chain attacknpmjscramblerinfostealerrust +2 more

Jscrambler NPM Package Hijacked in Supply Chain Attack, Deploys Infostealer Targeting Cloud & AI Dev Secrets

Australia Warns of Global Campaign Targeting Unpatched CMS Platforms with Webshells

HIGH

Australian Cyber Security Centre Issues Alert on Mass Exploitation of CMS Vulnerabilities

The Australian Cyber Security Centre (ACSC) has issued a high-priority alert about a large-scale global campaign exploiting at least 17 known vulnerabilities in popular Content Management Systems (CMS) like WordPress and Joomla, and their plugins. Attackers are actively scanning for and exploiting these unpatched flaws to deploy webshells, enabling persistent access for data theft, malware distribution, and further network compromise. The ACSC urges all organizations to patch their systems immediately and inspect for signs of compromise.

July 12, 2026

5 min read

acsccmswordpressjoomlawebshell +2 more

Australia Warns of Global Campaign Targeting Unpatched CMS Platforms with Webshells

Novel 'Ghostcommit' Attack Hides Malicious Prompts in PNG Files to Fool AI Agents

MEDIUM

'Ghostcommit' Attack Hides Prompts in Images to Trick AI Agents into Leaking Secrets

Researchers have unveiled 'Ghostcommit,' a novel proof-of-concept supply chain attack that embeds malicious prompt-injection instructions inside PNG image files. This technique bypasses text-based AI code reviewers, tricking automated AI coding agents into reading sensitive `.env` files and exfiltrating secrets by encoding them into the source code as seemingly harmless integer tuples. The attack highlights a critical blind spot in emerging AI-assisted development workflows.

July 12, 2026

6 min read

ghostcommitprompt injectionai securitysupply chain attackllm +1 more

Novel 'Ghostcommit' Attack Hides Malicious Prompts in PNG Files to Fool AI Agents

Critical Dell BIOS Flaw Allows Plaintext Password Recovery in Milliseconds

HIGH

Dell BIOS Flaw (CVE-2026-40639) Allows Instant Password Recovery from SPI Flash

A critical vulnerability, **CVE-2026-40639**, has been disclosed in the BIOS of numerous Dell client platforms, including Latitude, XPS, and Wyse devices. A weak XOR encryption scheme allows attackers with physical access to read the SPI flash chip and recover administrator and user passwords almost instantly, without any need for brute-forcing. The flaw stems from a broken encryption implementation that leaks the key. Dell has released patches for some affected models.

July 12, 2026

5 min read

cve-2026-40639dellbiosuefivulnerability +2 more

Critical Dell BIOS Flaw Allows Plaintext Password Recovery in Milliseconds

ECB Orders Banks to Submit AI Cyber-Defense Plans by October 31

INFORMATIONAL

European Central Bank Mandates AI Cyber Risk Action Plans from Banks

The European Central Bank (ECB) has ordered all major banks under its supervision to create and submit formal action plans detailing how they will mitigate cyber risks from advanced AI models. Citing the threat of AI-accelerated attacks that can discover and exploit vulnerabilities at machine speed, the directive gives banks until October 31, 2026, to deliver their strategies for hardening defenses, accelerating patch management, and enhancing threat monitoring.

July 12, 2026

4 min read

ecbbankingfinanceregulationpolicy +2 more

ECB Orders Banks to Submit AI Cyber-Defense Plans by October 31

'The Gentlemen' Ransomware Group Claims Attack on Czech Energy Firm Energon

HIGH

The Gentlemen Ransomware Group Targets Czech Energy Provider Energon

The ransomware group known as 'The Gentlemen' has claimed responsibility for a cyberattack on Energon, a major energy services and sustainable technology company in the Czech Republic. The group listed the firm on its data leak site on July 10, 2026, threatening to publish stolen data as part of a double extortion scheme. This attack is part of a wider campaign by the group, which was reportedly the most active ransomware operation on July 11, with 19 new victims claimed globally.

July 12, 2026

5 min read

the gentlemenransomwareenergondata breachdouble extortion +2 more

'The Gentlemen' Ransomware Group Claims Attack on Czech Energy Firm Energon

CISA Adds Two Actively Exploited Joomla Plugin Flaws to KEV Catalog

HIGH

CISA Adds Joomla and iCagenda File Upload Flaws to Known Exploited Vulnerabilities Catalog

On July 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities affecting Joomla components to its Known Exploited Vulnerabilities (KEV) catalog, signaling they are under active exploitation. The flaws, CVE-2026-48939 in the iCagenda extension and CVE-2026-56291 in Balbooa Forms, are both unrestricted file upload vulnerabilities that can lead to arbitrary code execution. Federal agencies are now required to patch these flaws by a set deadline.

July 12, 2026

4 min read

cisakevjoomlavulnerabilitycve-2026-48939 +2 more

CISA Adds Two Actively Exploited Joomla Plugin Flaws to KEV Catalog

Canada Deploys National Cybersecurity Sensors to Protect Northern Governments

INFORMATIONAL

Canadian Government Deploys Cybersecurity Sensors in Northern Territories

Canada's Communications Security Establishment (CSE) is now operating cybersecurity sensors across the IT systems of all three of its northern territories—Yukon, Northwest Territories, and Nunavut. The deployment, completed in 2024, aims to block malicious activity from cybercriminals and foreign governments following several high-profile ransomware and intrusion incidents that have impacted the region.

July 12, 2026

4 min read

canadacsegovernmentcybersecuritythreat detection +2 more

Canada Deploys National Cybersecurity Sensors to Protect Northern Governments

New Multi-Stage Trojan Targets Visual Studio Projects in Supply Chain Attack

HIGH

New Trojan Weaponizes Visual Studio Projects for Software Supply Chain Attacks

A new multi-stage Trojan is targeting software developers by embedding itself within Microsoft Visual Studio projects. According to reports from July 11, 2026, the malware turns the development workflow itself into a vector for a software supply chain attack. By compromising the project files, the Trojan can inject malicious code into legitimate applications during the build process, turning the final software into a delivery mechanism for further attacks on downstream users.

July 12, 2026

5 min read

trojanmalwarevisual studiosupply chain attackdevsecops +1 more

New Multi-Stage Trojan Targets Visual Studio Projects in Supply Chain Attack

Multiple Critical Vulnerabilities in U-Boot Weaken Secure Boot on Millions of Devices

CRITICAL

Critical U-Boot Vulnerabilities Threaten Secure Boot on Millions of Embedded Devices

Security researchers have disclosed six vulnerabilities in the widely used Das U-Boot bootloader, some of which are critical and could allow attackers to bypass Secure Boot and execute arbitrary code before the main operating system loads. The flaws, which include code execution and denial-of-service issues, affect a vast range of embedded devices, including routers, IoT hardware, and single-board computers, potentially undermining the foundational trust of these systems.

July 12, 2026

4 min read

u-bootbootloadersecure bootvulnerabilityiot +2 more

Multiple Critical Vulnerabilities in U-Boot Weaken Secure Boot on Millions of Devices

Gitea, Zimbra Exploited; AI Dev Secrets Targeted in New Attacks