# The CyberSignal
> The CyberSignal delivers daily cybersecurity news — breaking breaches, ransomware, CVEs, and threat intelligence for security professionals.
Public Ghost content for AI and LLM tooling. Use `/llms-full.txt` for consolidated page and post context.
Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`).

## Pages
- [About The CyberSignal](https://www.thecybersignal.com/about.md) - The CyberSignal is an independent cybersecurity news publication for security professionals, IT leaders, and the people who have to make decisions about cyber risk before the next morning's coffee. We cover breaches, threats, vulnerabilities, and the policy and industry shifts that change what defe…
- [Contact](https://www.thecybersignal.com/contact.md) - Have a tip, story lead, press inquiry, or sponsorship question? We'd love to hear from you. General Inquiries For general questions about The CyberSignal, editorial feedback, or story tips, reach out directly: Email: nicholas@thecybersignal.com Sponsorship & Advertising Interested in reaching our a…
- [Corrections](https://www.thecybersignal.com/corrections.md) - The CyberSignal corrects errors promptly, transparently, and on the record. When we get something wrong, we update the original article, add a correction notice at the top of the piece, refresh the article's "last modified" timestamp, and log the correction here. Substantive corrections — to facts,…
- [Editorial Standards](https://www.thecybersignal.com/editorial-standards-2.md) - The CyberSignal publishes cybersecurity news and analysis for security professionals. These standards describe how we source, verify, and write our reporting, and how we hold ourselves accountable when we get something wrong. They apply to every article we publish. Our Approach We report on breache…
- [Password Strength Tester — How Long Would It Take to Crack Yours?](https://www.thecybersignal.com/password-strength-tester.md) - The CyberSignal's free, browser-based password strength tester. It runs Dropbox's zxcvbn model on whatever pattern you paste, flags the same weaknesses attacker dictionaries look for, and shows you the estimated crack time. Nothing leaves your browser. Below is the live tool. Don't paste your real…
- [Privacy Policy](https://www.thecybersignal.com/privacy-policy.md) - Last updated: April 22, 2026 The CyberSignal ("we," "us," or "our") operates thecybersignal.com. This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our site and the choices you have associated with that data. Information We Collect We c…

## Posts
- [Indicators of Compromise (IOCs): What They Are and How to Use Them](https://www.thecybersignal.com/indicators-of-compromise-iocs-what-they-are-and-how-to-use-them.md) - A complete guide to indicators of compromise (IOCs) — the major types, the IOC vs IOA distinction, the Pyramid of Pain, and how IOCs are shared via STIX/TAXII.
- [Researchers Document “LabubaRAT” Rust-Based Windows RAT Posing as NVIDIA Software](https://www.thecybersignal.com/labubarat-rust-windows-nvidia-impersonation-2026.md) - A Rust-based Windows remote-access tool with an NVIDIA-impersonation posture — defender research this week from Blackpoint Cyber, published with indicators of compromise for detection teams.
- [Microsoft Publishes Deep-Dive Analysis of AsyncAPI npm Supply-Chain Compromise](https://www.thecybersignal.com/microsoft-asyncapi-npm-supply-chain-deep-dive-2026.md) - Microsoft goes deep on the AsyncAPI npm compromise — a defender review for CI/CD workflows and @asyncapi dependencies this week.
- [23andMe Reaches $18 Million Multi-State Settlement Across 42 State Attorneys General](https://www.thecybersignal.com/23andme-18-million-multi-state-settlement-42-ags-2026.md) - A significant multi-state privacy settlement — regulatory-policy analysis coverage this week — as 23andMe agrees to pay $18 million to a coalition of 42 state attorneys general over the security failings behind its data breach.
- [Cursor "git.exe" Auto-Execute Vulnerability Detailed Across Multiple Vendor Publications](https://www.thecybersignal.com/cursor-git-exe-auto-execute-detail-2026.md) - More technical detail on the Cursor IDE auto-execute finding — defender review for Cursor-using teams this week.
- [Fortinet, Ivanti, and ServiceNow Publish Coordinated Patch Cycle (Critical ServiceNow AI-Platform RCE)](https://www.thecybersignal.com/fortinet-ivanti-servicenow-critical-patch-cycle-2026.md) - Three vendors, one patch cycle, one critical AI-platform RCE — defender verification across the Fortinet, Ivanti, and ServiceNow product lines this week.
- [Old Microsoft-Signed UEFI Shims Continue to Enable Secure Boot Bypass — Coordinated Vendor Response](https://www.thecybersignal.com/uefi-shims-secure-boot-vendor-response-2026.md) - The eleven old UEFI shims get revoked — defender posture and deployment tracking this week.
- [Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor](https://www.thecybersignal.com/daxin-taiwan-manufacturing-stupig-backdoor-2026.md) - A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.
- [Multi-Source Detail on White House ‘Gold Eagle’ AI Vulnerability Clearinghouse](https://www.thecybersignal.com/gold-eagle-ai-vulnerability-clearinghouse-detail-2026.md) - Fresh detail on the White House Gold Eagle program — federal-adjacent organizations align this week.
- [Cyberattack on Nichirei Logistics Disrupts KFC Japan and Cold-Chain Deliveries](https://www.thecybersignal.com/nichirei-logistics-kfc-japan-cold-chain-cyberattack-2026.md) - A cold-chain cyberattack ripples into KFC Japan and supermarket supplies — supply-chain sector-advisory coverage this week.
- [Qantas Discloses Data Breach Affecting 5.7 Million People Traced to Tech-Support Scam](https://www.thecybersignal.com/qantas-tech-support-scam-5-7-million-breach-2026.md) - A scale-significant airline-industry disclosure traced to a tech-support scam — sector-advisory coverage this week, based on early single-source reporting that Qantas has yet to fully detail.
- [Ukraine and CERT-UA Document Sandworm CAPTCHA-PowerShell Trick Targeting Ukrainian Users](https://www.thecybersignal.com/sandworm-captcha-powershell-ukraine-2026.md) - Another Sandworm-attributed technique lands from CERT-UA — end-user awareness and defender posture review this week for Ukraine-adjacent organizations.
- [F5 Publishes Patches for Multiple NGINX and BIG-IP Vulnerabilities](https://www.thecybersignal.com/f5-nginx-big-ip-multiple-patches-2026.md) - F5's July patch cycle continues — defender verification across NGINX and BIG-IP deployments this week.
- [Researchers Document “ClickLock” macOS Stealer That Reportedly Kills Apps Until Victim Enters Password](https://www.thecybersignal.com/clicklock-macos-stealer-kill-loop-2026.md) - A novel macOS stealer technique with credential-and-crypto targeting — defender posture review for Mac-issuing organizations this week.
- [Zoom Publishes Critical Windows Vulnerability Patch (CVE-2026-53412, CVSS 9.8); Splunk Ships Companion Critical Patches](https://www.thecybersignal.com/zoom-cve-2026-53412-splunk-critical-patches-2026.md) - A CVSS 9.8 Zoom Windows flaw and companion Splunk patches — defender teams verify across enterprise deployments this week.
- [Two Scattered Spider Members Sentenced to Five-and-a-Half Years for £29 Million TfL Attack](https://www.thecybersignal.com/scattered-spider-tfl-jubair-flowers-sentencing-2026.md) - The biggest cybercrime conviction in UK history — Scattered Spider's TfL attackers face five-and-a-half years, and the £29M cost lands as a defender-team reminder this week.
- [US Unseals Indictment Charging Russian “Bulletproof” Web Hosts Over Cyberattacks That Netted $62 Million](https://www.thecybersignal.com/us-indictment-russian-bulletproof-web-hosts-62-million-2026.md) - A US indictment against Russian bulletproof hosting operators — law-enforcement continuation coverage this week.
- [CISA Urges Immediate Patching for Three Exploited SharePoint Vulnerabilities (Two Are Zero-Days)](https://www.thecybersignal.com/cisa-sharepoint-three-exploited-two-zero-days-2026.md) - CISA raises the SharePoint patch stakes — three actively exploited flaws, two of them zero-days, and defender teams accelerate verification this week.
- [CyberScoop Reports SonicWall SMA 1000 Zero-Days Were Reportedly Exploited Three Weeks Before Vendor Disclosure](https://www.thecybersignal.com/sonicwall-sma-zero-days-three-weeks-pre-disclosure-2026.md) - A three-week pre-disclosure exposure window for the SonicWall SMA zero-days — defender teams review the timeline this week.
- [Chaotic Eclipse / Nightmare-Eclipse Drops "LegacyHive" Windows Zero-Day PoC Hours After Patch Tuesday](https://www.thecybersignal.com/legacyhive-windows-zero-day-poc-chaotic-eclipse-2026.md) - A Windows User Profile Service PoC drops the same day as Patch Tuesday — the researcher's fourth CyberSignal-tracked disclosure this cycle, and a defender review for this week.
- [Compromised @asyncapi npm Packages Deliver Multi-Stage Botnet Loader](https://www.thecybersignal.com/asyncapi-npm-packages-multi-stage-botnet-2026.md) - Another JavaScript-ecosystem supply-chain compromise, confirmed by four vendors: four @asyncapi npm packages were observed distributing a multi-stage botnet loader, and all five malicious versions have since been pulled from npm — defender inventory work this week.
- [UK Government Updates National Risk Register with Catastrophic Cyber-Attack Warnings](https://www.thecybersignal.com/uk-national-risk-register-cyber-catastrophic-warnings-2026.md) - The UK Government adds catastrophic cyber warnings to its National Risk Register — UK-operating defenders align posture this week.
- [ICS Patch Tuesday: Siemens, Schneider Electric, and Rockwell Publish Dozens of Vulnerability Advisories](https://www.thecybersignal.com/ics-patch-tuesday-siemens-schneider-rockwell-2026.md) - A big ICS Patch Tuesday cycle — defender teams for industrial operators concentrate patch verification this week as Siemens, Schneider Electric, and Rockwell Automation publish dozens of advisories.
- [Google Chrome 150 and Mozilla Firefox 152 Ship Critical Patches; Public PoC Exists for Firefox Flaws](https://www.thecybersignal.com/chrome-150-firefox-152-critical-patches-2026.md) - A same-week Chrome and Firefox critical patch cycle lands with public exploit code reportedly circulating for the Firefox flaws — making browser-fleet verification the defender task of the week.
- [SonicWall SMA 1000 Zero-Days Detailed: CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (Admin Command Execution)](https://www.thecybersignal.com/sonicwall-sma-1000-cve-2026-15409-15410-detailed-2026.md) - SonicWall's SMA 1000 zero-days now have CVE-level detail — defender teams accelerate patch verification this week.
- [Progress Confirms Zero-Day Vulnerability Behind ShareFile Disruption and Ships Fix](https://www.thecybersignal.com/progress-sharefile-zero-day-confirmed-fix-shipped-2026.md) - Progress closes the ShareFile emergency with a confirmed zero-day and shipped fix — Storage Zones Controller customers apply and restore this week.
- [White House Details ‘Gold Eagle’ Clearinghouse for AI Cyber Threats](https://www.thecybersignal.com/white-house-gold-eagle-ai-cyber-threat-clearinghouse-2026.md) - A White House policy signal on AI cyber threats — federal-adjacent organizations align this week.
- [Iran Abused Mobile-Network Vulnerabilities to Locate US Military Personnel, TechCrunch Reports](https://www.thecybersignal.com/iran-mobile-network-us-military-location-report-2026.md) - A nation-state mobile-network-vulnerability disclosure with defense-sector implications — coverage this week.
- [148 npm Packages Disguised as Student Proxies Reportedly Turned Browsers Into a DDoS Botnet](https://www.thecybersignal.com/148-npm-packages-student-proxies-ddos-botnet-2026.md) - A large-scale JavaScript-ecosystem supply-chain compromise — defender inventory work this week.
- [Cursor IDE Auto-Executes Malicious Code in Poisoned Repositories, Researchers Say](https://www.thecybersignal.com/cursor-ide-auto-execute-poisoned-repositories-2026.md) - An AI-IDE supply-chain finding — defender review for organizations using Cursor this week.
- [Researchers Disclose Unpatched Claude for Chrome Flaw Tied to Gmail, Calendar Reads](https://www.thecybersignal.com/claude-for-chrome-unpatched-gmail-calendar-flaw-2026.md) - An AI-browser extension disclosure with cross-tenant data implications — defender review for Claude for Chrome deployments this week.
- [Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity](https://www.thecybersignal.com/microsoft-salesforce-three-attack-paths-shinyhunters-2026.md) - Microsoft maps ShinyHunters' Salesforce activity — defender review for SaaS-heavy organizations this week.
- [UK Charges Five Over “Russian Coms” Fraud Platform Behind More Than a Million Scam Calls](https://www.thecybersignal.com/uk-russian-coms-fraud-five-charged-scam-calls-2026.md) - A UK fraud-platform prosecution at scale — law-enforcement coverage this week.
- [Pentagon Suspends CMMC Phase 2 Requirements for Defense Contractors](https://www.thecybersignal.com/pentagon-suspends-cmmc-phase-2-defense-contractor-2026.md) - A CMMC-framework pause from the Pentagon — defense-contractor compliance work re-scoped this week.
- [US Treasury Sanctions First VPN Service, Malware Cryptor Seller Over Ransomware Support](https://www.thecybersignal.com/us-treasury-sanctions-first-vpn-malware-cryptor-ransomware-2026.md) - A US Treasury sanctions package targeting VPN and cryptor infrastructure that reportedly supports ransomware — regulatory coverage this week.
- [Researchers Disclose RabbitMQ Flaws That Could Leak OAuth Secrets, Expose Cross-Tenant Queue Metadata](https://www.thecybersignal.com/rabbitmq-oauth-cross-tenant-metadata-vulnerabilities-2026.md) - A message-queue vulnerability with OAuth and multi-tenancy implications — defender review for RabbitMQ deployments this week.
- [VMware Patches Seven Severe Avi Load Balancer Vulnerabilities](https://www.thecybersignal.com/vmware-avi-load-balancer-seven-patches-2026.md) - A seven-flaw Avi Load Balancer patch cycle from VMware — defender verification this week.
- [iCagenda and Balbooa Forms Joomla Zero-Days Reportedly Exploited in the Wild](https://www.thecybersignal.com/icagenda-balbooa-forms-joomla-zero-day-exploitation-2026.md) - Two Joomla-extension zero-days under active attack — Joomla operators accelerate patch verification this week.
- [SonicWall SMA Appliances Under Active Zero-Day Attack via CVE-2026-15409 and CVE-2026-15410](https://www.thecybersignal.com/sonicwall-sma-cve-2026-15409-15410-zero-day-2026.md) - Two SonicWall SMA zero-days under active attack — immediate defender posture review this week.
- [Adobe Publishes Critical ColdFusion Patches as Its Vulnerability Thread Continues](https://www.thecybersignal.com/adobe-coldfusion-critical-patches-continuation-2026.md) - Adobe's ColdFusion patch cycle continues — defender verification across deployments this week.
- [SAP Patches CVSS 9.9 NetWeaver ABAP Flaw, Plus Approuter and Commerce Cloud](https://www.thecybersignal.com/sap-critical-patches-netweaver-approuter-commerce-cloud-2026.md) - A CVSS 9.9 NetWeaver ABAP flaw anchors SAP's critical patch cycle — defender verification across products this week.
- [Researchers Flag 11 Old Microsoft-Signed Linux UEFI Shims That Could Bypass Secure Boot](https://www.thecybersignal.com/microsoft-signed-linux-uefi-shims-secure-boot-bypass-2026.md) - Eleven old Microsoft-signed shims land as bypasses of Secure Boot — Linux-boot defender review this week.
- [Ars Technica Documents a Decade-Old Weakness in Microsoft's Secure Boot](https://www.thecybersignal.com/microsoft-secure-boot-decade-old-weakness-2026.md) - A decade-old Secure Boot revelation — lifecycle-security implications for defender teams this week.
- [Microsoft Patches SharePoint JWT Authentication-Bypass Flaw (CVE-2026-55040)](https://www.thecybersignal.com/microsoft-sharepoint-cve-2026-55040-jwt-auth-bypass-2026.md) - A SharePoint JWT auth bypass patched in July's Patch Tuesday — defender verification this week.
- [Microsoft Ships a Record 622-CVE Patch Tuesday With Two Zero-Days Under Active Attack](https://www.thecybersignal.com/microsoft-july-2026-patch-tuesday-622-cves-two-zero-days-2026.md) - Microsoft's July Patch Tuesday breaks its own record — 622 CVEs, two zero-days under active attack, and defender triage stakes rise this week.
- [“CrashStealer” macOS Malware Reportedly Uses a Notarized Dropper to Pass Gatekeeper](https://www.thecybersignal.com/crashstealer-macos-notarized-dropper-gatekeeper-2026.md) - A macOS notarization-abuse malware disclosure — defender review for Mac-issuing organizations this week.
- [Researchers Document “Forg365,” a Phishing-as-a-Service Platform Targeting Microsoft 365](https://www.thecybersignal.com/forg365-phaas-microsoft-365-device-code-aitm-2026.md) - A new named PhaaS platform targeting Microsoft 365 — defender teams review posture and OAuth-hygiene this week.
- [Researchers Disclose “MemGhost,” a Technique That Plants Persistent False Memories in AI Agents](https://www.thecybersignal.com/memghost-ai-agent-persistent-false-memory-2026.md) - Another AI-agent supply-chain finding — defender posture review for organizations deploying memory-enabled agents this week.
- [Ryuk Suspect Extradited From Ukraine Pleads Guilty to US Ransomware Charges](https://www.thecybersignal.com/ryuk-suspect-extradited-ukraine-guilty-plea-2026.md) - Another Ryuk-operator plea lands — the ransomware-operator prosecution pattern continues this week.
- [Australian Cyber Security Centre Warns of Global CMS Exploitation Campaign](https://www.thecybersignal.com/acsc-australia-global-cms-exploitation-advisory-2026.md) - An Australian government advisory on CMS exploitation — defender review across managed content platforms this week.
- [Progress ShareFile ‘External Security Threat’ Directive Continues Into the New Week](https://www.thecybersignal.com/progress-sharefile-external-security-threat-continuation-2026.md) - The Progress ShareFile emergency continues — defender teams stay in verification posture this week.
- [EU and UK Formally Attribute Poland Power-Grid Cyberattack to Russia's Turla](https://www.thecybersignal.com/eu-uk-poland-power-grid-turla-attribution-2026.md) - A formal EU/UK attribution against Russia's Turla for a Polish power-grid attack — critical-infrastructure defender posture stays elevated this week.
- [US, UK and Allies Warn Russian State-Linked Actors Are Targeting Critical-Infrastructure Routers](https://www.thecybersignal.com/us-uk-allies-russian-router-critical-infrastructure-advisory-2026.md) - A multilateral cybersecurity advisory on Russian router-targeting activity lands on critical-infrastructure defender teams' desks — the guidance reissues warnings the same agencies have made before, and asks operators to review posture this week.
- [Accenture Confirms Data Breach After Hacker Lists Stolen Source Code and Cloud Keys for Sale](https://www.thecybersignal.com/accenture-data-breach-help-net-security-recap-2026.md) - A consulting-and-IT-services sector signal: Accenture has confirmed an intrusion after a threat actor advertised stolen source code and cloud credentials for sale, calling it an isolated, remediated matter even as the scale and any client impact remain unverified.
- [Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Operations](https://www.thecybersignal.com/armenian-national-vardanyan-ryuk-ransomware-guilty-plea-2026.md) - Another individual-conviction milestone against a ransomware operation — law-enforcement coverage this week.
- [Zimbra Urges Customers to Patch Critical Classic Web Client XSS Flaw](https://www.thecybersignal.com/zimbra-classic-web-client-critical-xss-2026.md) - A critical Zimbra webmail advisory — defender teams accelerate patch verification this week.
- ['Ghost Accounts' Abuse GitHub API in Mass Reconnaissance Campaign, SecurityWeek Reports](https://www.thecybersignal.com/ghost-accounts-github-api-mass-recon-2026.md) - A GitHub-organization reconnaissance campaign — defender posture and account-hygiene review this week.
- [SentinelOne Details Suspected China- and India-Aligned Espionage Against Pakistan's Balochistan Police](https://www.thecybersignal.com/sentinelone-balochistan-police-china-india-espionage-2026.md) - A dual-attribution espionage disclosure targeting one Pakistani police force — a rare cross-nation-state analytical beat.
- [jscrambler 8.14.0 npm Release Compromised to Drop a Rust Infostealer at Install](https://www.thecybersignal.com/jscrambler-npm-8-14-rust-infostealer-compromise-2026.md) - Another JavaScript-ecosystem SDK compromise — defender inventory work continues this week.
- [Coinspect Discloses “Ill Bloom” Wallet Recovery-Phrase Flaw Tied to Over $5 Million in Losses](https://www.thecybersignal.com/ill-bloom-crypto-wallet-recovery-phrase-vulnerability-2026.md) - A weak-randomness crypto-wallet finding — cryptocurrency-user awareness this week.
- [Unit 42 Details “The Gentlemen” Ransomware and the Affiliate Model Driving Its Growth](https://www.thecybersignal.com/unit-42-gentlemen-ransomware-affiliate-model-analysis-2026.md) - Another ransomware-affiliate-model profile lands on defenders’ desks — detection-engineering work this week.
- [CISA Publishes Forensic Report on May AWS GovCloud Credential Leak](https://www.thecybersignal.com/cisa-forensic-report-aws-govcloud-credential-leak-2026.md) - A candid CISA transparency report — defender takeaways on incident-playbook readiness this week.
- [European Parliament Advances "Chat Control 2.0," Clearing Big Tech to Scan Messages for CSAM](https://www.thecybersignal.com/eu-parliament-chat-control-2-csam-scanning-2026.md) - A pointed EU privacy-and-messaging shift — compliance implications for Big Tech and civil-society groups this week.
- [Binarly Discloses Six New U-Boot Bootloader Vulnerabilities in Routers, Cameras, and Server Chips](https://www.thecybersignal.com/binarly-six-uboot-bootloader-vulnerabilities-2026.md) - A six-flaw U-Boot disclosure with cross-vendor device implications — defender posture review this week.
- [Compromised Injective Labs GitHub Repo Used to Publish Wallet-Key-Stealing npm Package](https://www.thecybersignal.com/injective-labs-github-npm-wallet-key-compromise-2026.md) - Another JavaScript-ecosystem SDK compromise with cryptocurrency-user implications — defender inventory work this week.
- [Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Threat](https://www.thecybersignal.com/progress-sharefile-storage-zone-controllers-emergency-shutdown-2026.md) - An emergency vendor directive landed this week: Progress Software told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, citing a credible external security threat and temporarily disabling access to affected accounts out of an abundance of caution.
- [Third US Security Professional Sentenced to 70 Months for Aiding BlackCat Ransomware](https://www.thecybersignal.com/third-us-security-professional-ransomware-sentence-digitalmint-2026.md) - A pointed law-enforcement pattern — the third US security professional sentenced for aiding ransomware operations lands this week.
- [Microsoft Warns AI-Driven Vulnerability Discovery Will Mean Busier Patch Tuesdays](https://www.thecybersignal.com/microsoft-patch-tuesday-ai-cadence-guidance-2026.md) - Patch Tuesdays get busier as AI drives vulnerability discovery — defender-team cadence review this week.
- [Okta Warns of Vishing Campaign Targeting Microsoft 365 Customers](https://www.thecybersignal.com/okta-vishing-microsoft-365-warning-2026.md) - A vishing campaign against Microsoft 365 customers draws a vendor warning — defender review this week.
- [Researchers Disclose Unpatched "XRING" Flaw That Lets Remote Clients Crash HTTP/3 XQUIC Servers](https://www.thecybersignal.com/xring-xquic-http3-server-crash-research-2026.md) - An unpatched HTTP/3 QUIC-library finding — defender teams review protocol posture this week.
- [DHS Database Hacked, SecurityWeek Roundup Reports; Adobe, Canada Also Featured](https://www.thecybersignal.com/dhs-database-breach-securityweek-roundup-2026.md) - A federal-agency database breach lands in the weekly roundup — sector-advisory tracking this week.
- [Microsoft Details "GigaWiper," a Malware Family Combining Espionage and Destructive Capabilities](https://www.thecybersignal.com/gigawiper-microsoft-espionage-destructive-malware-2026.md) - A new destructive-plus-espionage malware family lands on defenders' desks — detection-engineering review this week.
- [European Commission Refers Ireland, Spain, France and the Netherlands to the CJEU Over NIS2 Delays](https://www.thecybersignal.com/eu-commission-cjeu-referral-nis2-implementation-2026.md) - A sharp regulatory-enforcement move from the European Commission — compliance stakes rise this week.
- [Palo Alto Networks Patches 13 Vulnerabilities in Coordinated Advisory](https://www.thecybersignal.com/palo-alto-networks-13-vulnerabilities-patch-2026.md) - A large-scale Palo Alto patch cycle — defender verification across product fleets this week.
- [UK Government Launches “Cyber Shield” Agentic-AI Defense Plan and Cyber Resilience Pledge](https://www.thecybersignal.com/uk-cyber-shield-agentic-ai-defense-pledge-2026.md) - A national-scale agentic-AI defense plan from the UK — defender teams and industry partners align this week.
- [Interpol Reports 5,800 Arrests Across 97 Countries in Global Cybercrime Crackdown](https://www.thecybersignal.com/interpol-cybercrime-crackdown-5800-arrests-97-countries-2026.md) - A scale-significant multi-country cybercrime disruption — law-enforcement coverage this week.
- [npm 12 Ships With Install Scripts Disabled by Default to Cut Supply-Chain Risk](https://www.thecybersignal.com/npm-12-install-scripts-disabled-default-2026.md) - A meaningful ecosystem-policy signal from npm after months of contributor-account compromises — defender developers review CI/CD posture this week.
- [Microsoft Patches RoguePlanet Defender Flaw That Could Grant SYSTEM Privileges](https://www.thecybersignal.com/microsoft-rogueplanet-defender-system-patch-2026.md) - The RoguePlanet Defender saga closes with Microsoft's patch — defender teams accelerate verification this week.
- [Researchers Disclose "GhostLock," a 15-Year-Old Linux Flaw Enabling Root and Container Escape](https://www.thecybersignal.com/ghostlock-linux-root-container-escape-15-year-old-2026.md) - Another long-standing Linux finding lands with defender-team implications across distributions and container platforms.
- [Researchers Disclose "HalluSquatting" Technique Targeting AI Coding Assistants](https://www.thecybersignal.com/hallusquatting-ai-coding-assistant-botnet-delivery-2026.md) - An AI-hallucination supply-chain finding with organization-wide implications — defender review this week.
- [Google Awards $250,000 Bounty for Linux KVM Guest-to-Host Escape](https://www.thecybersignal.com/google-250k-linux-kvm-guest-host-escape-bounty-2026.md) - A significant Google bounty award draws attention to a Linux virtualization finding — defender review continues this week.
- [Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and UniFi OS](https://www.thecybersignal.com/ubiquiti-unifi-critical-patches-multi-product-2026.md) - A multi-product UniFi patch cycle from Ubiquiti — defender verification across product fleets this week.
- [CISA Adds Four Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV Catalog](https://www.thecybersignal.com/cisa-kev-adobe-joomla-langflow-additions-2026.md) - Four KEV additions across three vendors — defender patch-verification work concentrates this week.
- [BeyondTrust Patches Critical Authentication-Bypass Flaws in Remote Support and PRA](https://www.thecybersignal.com/beyondtrust-remote-support-pra-auth-bypass-2026.md) - A critical vendor advisory across two remote-access products — defender teams accelerate patch verification this week.
- ["GitLost" Disclosure: Researchers Say GitHub Agentic Workflows Could Leak Private Repository Data](https://www.thecybersignal.com/gitlost-github-agentic-workflow-data-exposure-2026.md) - An agentic-workflow data-exposure disclosure with organization-wide DevSecOps implications — defender review this week.
- [Researchers Disclose Google Dialogflow CX "Rogue Agent" Flaw That Could Have Enabled AI Chatbot Data Theft](https://www.thecybersignal.com/rogue-agent-google-dialogflow-cx-vulnerability-2026.md) - An AI-agent identity disclosure with cloud-defender implications — Dialogflow CX posture review this week.
- [Maximum-Severity Adobe ColdFusion Flaw Now Actively Exploited, Infosecurity Magazine Reports](https://www.thecybersignal.com/adobe-coldfusion-maximum-severity-active-exploitation-2026.md) - A maximum-severity ColdFusion flaw under active attack — accelerated patch verification this week.
- [Suspected China-Linked Actors Exploit Roundcube Webmail Flaws in University Espionage Campaign](https://www.thecybersignal.com/china-linked-roundcube-universities-espionage-2026.md) - A higher-education-sector espionage disclosure — sector-advisory work for university IT teams this week.
- [Sysdig Documents "JadePuffer," Reportedly the First Fully Agentic-AI-Driven Ransomware Case](https://www.thecybersignal.com/jadepuffer-agentic-ai-ransomware-sysdig-2026.md) - The first documented agentic-AI ransomware analysis lands — cloud-defender teams review posture and the human-in-the-loop nuance this week.
- [France's ANSSI to Stop Certifying Non-Quantum-Safe Encryption](https://www.thecybersignal.com/france-non-quantum-safe-encryption-certification-end-2026.md) - A sharp French policy signal on quantum-safe encryption — international PQC migration accelerates this week.
- [16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86](https://www.thecybersignal.com/linux-kvm-16-year-old-guest-host-escape-2026.md) - A long-standing KVM finding lands with cloud-provider implications — defender posture review this week.
- [NetScaler CVE-2026-8451 Under Attack as Dark Reading Sharpens the CitrixBleed Comparison](https://www.thecybersignal.com/netscaler-cve-2026-8451-active-exploitation-continuation-2026.md) - The CitrixBleed-echo NetScaler flaw draws active attack coverage — defender teams accelerate patch verification this week.
- [AdaptHealth Discloses Cloud-Systems Compromise Affecting Patient Data](https://www.thecybersignal.com/adapthealth-cloud-compromise-patient-data-2026.md) - Another healthcare-sector cloud-compromise disclosure — sector-advisory work this week. AdaptHealth says attackers reached its cloud systems and accessed patient data, with social engineering reported as the initial-access route.
- [Pegasus Spyware Infected the Phone of an MEP Investigating Spyware, TechCrunch and WIRED Report](https://www.thecybersignal.com/eu-mep-pegasus-spyware-inquiry-disclosure-2026.md) - A pointed export-control-policy disclosure — the spyware-inquiry rapporteur becomes the target.
- [FBI and Google Disrupt NetNut Residential-Proxy Network Spanning Two Million Devices](https://www.thecybersignal.com/fbi-google-netnut-proxy-disruption-2026.md) - A scale-significant proxy-network takedown — law-enforcement coverage and defender awareness this week.
- [Medtronic Warns Pacemaker Patients Health Data May Have Been Exposed in Cyber Incident](https://www.thecybersignal.com/medtronic-pacemaker-health-data-exposure-2026.md) - A medical-device-manufacturer disclosure with sector-advisory implications — patient notification in focus this week.
- [Google Threat Intelligence Group Details Continued Disruption of Malicious Residential-Proxy Networks](https://www.thecybersignal.com/google-threat-intel-residential-proxy-disruption-2026.md) - Vendor-driven proxy-network disruption continues — defender teams review perimeter-detection posture this week.
- [FortiBleed-Linked Actors Reportedly Collaborating With INC and Lynx Ransomware Operations](https://www.thecybersignal.com/fortibleed-actors-inc-lynx-ransomware-collaboration-2026.md) - Threat-cluster convergence between FortiBleed and two ransomware families — defender teams stay in credential-verification posture this week.
- [US Government Confirms New Breach Affecting Federal Systems in Sector-Advisory Disclosure](https://www.thecybersignal.com/us-government-federal-systems-breach-disclosure-2026.md) - Another federal-agency disclosure — sector-advisory tracking for federal-adjacent defenders this week.
- [Kaspersky Details Umbrij, a New ToddyCat Tool Targeting Corporate Gmail via OAuth Tokens](https://www.thecybersignal.com/toddycat-umbrij-oauth-gmail-kaspersky-2026.md) - An APT-tooling disclosure with corporate-Gmail implications — defender teams review OAuth-token hygiene this week.
- [Microsoft and Trend Micro Document Blockchain-Abuse Phishing Against EU and Asia Hospitality](https://www.thecybersignal.com/hospitality-sector-blockchain-abuse-phishing-multi-vendor-2026.md) - Two vendor-documented hospitality-sector phishing campaigns land the same week — sector-advisory work for hotel-industry defenders this week.
- [Adversa AI Research — “GuardFall” Shell Injection Bypasses 10 of 11 Open-Source AI Coding Agents](https://www.thecybersignal.com/guardfall-ai-coding-agents-shell-injection-research-2026.md) - An AI-coding-agent bypass with cross-vendor implications — defender posture-review work for organizations running open-source agents this week.
- ["BioShocking" Research Tricks AI Browsers Into Leaking User Credentials](https://www.thecybersignal.com/bioshocking-ai-browser-credential-exposure-2026.md) - A multi-vendor AI-browser research disclosure — defender posture-review work for organizations deploying agentic browsers this week.
- [House Passes Kids Internet and Digital Safety (KIDS) Act 267-117; Senate Approval Unlikely](https://www.thecybersignal.com/house-kids-internet-digital-safety-act-267-117-2026.md) - A bipartisan House vote on child-safety platform obligations — Senate outlook and industry response in focus this week.
- [OMB Director Vought Signals Openness to Re-Staffing CISA](https://www.thecybersignal.com/omb-vought-cisa-restaffing-signal-2026.md) - A policy-signal shift on CISA staffing — federal-adjacent defender teams and industry partners watch for follow-through this week.
- [Progress Publishes Advisory for Critical Kemp LoadMaster Flaw CVE-2026-8037](https://www.thecybersignal.com/progress-kemp-loadmaster-cve-2026-8037-2026.md) - A pre-authenticated critical vulnerability in a widely-deployed load balancer — patch verification for defender teams this week.
- [Huntress Documents 81M+ Azure CLI Password-Spray Attempts Against 78 Microsoft Accounts](https://www.thecybersignal.com/huntress-azure-cli-password-spray-78-accounts-2026.md) - A scale-significant Azure CLI credential-attack campaign — defender teams stay in account-hardening posture this week.
- [Microsoft Publishes Quantum-Safe Guidance as the Risk Timeline Shifts](https://www.thecybersignal.com/microsoft-accelerating-quantum-safe-timeline-2026.md) - Microsoft's PQC guidance lands alongside the accelerated federal deadline — vendor roadmap alignment this week.
- [CIA's Ratcliffe Frames Advanced AI as ‘Akin to Digital Nuclear Weapons’](https://www.thecybersignal.com/cia-ratcliffe-ai-digital-nuclear-weapons-2026.md) - A senior US-intelligence framing lands mid-cycle — how AI-cyber policy hardens in focus this week.
- [Citrix Patches Six NetScaler Flaws, Including CVE-2026-8451 With Echoes of CitrixBleed](https://www.thecybersignal.com/citrix-netscaler-cve-2026-8451-citrixbleed-echo-2026.md) - Six NetScaler flaws, one with echoes of CitrixBleed — defender teams stay in patch-verification posture this week.
- [Microsoft Warns Poisoned MCP Tool Descriptions Can Turn AI Agents Into Data-Leak Channels](https://www.thecybersignal.com/microsoft-mcp-tool-poisoning-ai-agents-research-2026.md) - A fresh vendor-research disclosure at the intersection of AI agents and supply-chain risk — Microsoft says poisoned tool descriptions can quietly redirect what an agent does, and pairs the research with defender guidance for teams shipping agentic AI this week.
- [Microsoft Defender Flaw CVE-2026-33825, 'BlueHammer,' Tied to Ransomware Activity](https://www.thecybersignal.com/bluehammer-microsoft-defender-cve-2026-33825-ransomware-2026.md) - Another Defender zero-day for defender teams to verify — patch cycle plus KEV watch this week.
- [Nissan Oracle PeopleSoft Campaign Reportedly Targeted 100 Organizations](https://www.thecybersignal.com/nissan-oracle-peoplesoft-campaign-100-organizations-2026.md) - One confirmed victim, a reported 99 more not yet named — Oracle PeopleSoft customers stay in patch-verification posture this week.
- [Researchers Disclose AirDrop and Quick Share Flaws Affecting Five Billion Devices](https://www.thecybersignal.com/airdrop-quick-share-five-billion-devices-research-2026.md) - Two researchers mapped the proximity-sharing protocols behind AirDrop and Quick Share and found six flaws spanning five billion Apple and Android devices, with vendor fixes only partly shipped.
- [Researchers Disclose 282 iOS AI Apps Leaking API Keys in Network Traffic](https://www.thecybersignal.com/282-ios-ai-apps-api-key-leak-research-2026.md) - A scale-significant AI-app privacy disclosure with developer accountability implications: Wake Forest researchers found 282 of 444 iOS AI apps exposing usable LLM credentials in their own network traffic, and most stayed open months after notification.
- [SimpleHelp CVE-2026-48558 Exploited to Deliver TaskWeaver and Djinn Stealer](https://www.thecybersignal.com/simplehelp-cve-2026-48558-taskweaver-djinn-stealer-2026.md) - A critical remote monitoring and management vulnerability is under active exploitation to deliver an infostealer that hunts cloud and AI development credentials — and it is now on CISA's KEV list.
- [Oracle E-Business Suite Payments Flaw CVE-2026-46817 Under Active Exploitation](https://www.thecybersignal.com/oracle-ebs-payments-cve-2026-46817-active-exploitation-2026.md) - Another Oracle product line under active exploitation — high-priority patch verification this week.
- [Aflac Japan Discloses Data Breach Affecting 4.38 Million People](https://www.thecybersignal.com/aflac-japan-data-breach-4-38-million-2026.md) - Another scale-significant Japanese-sector disclosure: Aflac Life Insurance Japan says intruders sat in its policyholder portal for ten days and exfiltrated the personal data of roughly 4.38 million customers and agents.
- [Nissan Discloses Employee Data Breach Linked to Oracle PeopleSoft Zero-Day](https://www.thecybersignal.com/nissan-oracle-peoplesoft-employee-data-breach-2026.md) - A high-profile Oracle PeopleSoft customer disclosure: Nissan says current and former employees' data was exposed via CVE-2026-35273, with sector-advisory implications for the broader Oracle exploitation cycle.
- [Microsoft Removes 119 Edge Extensions That Hid Malicious Content in Images and Fonts](https://www.thecybersignal.com/microsoft-edge-119-malicious-extensions-removal-2026.md) - Browser-extension enforcement action at scale from Microsoft. The company pulled 119 Edge add-ons that concealed payloads inside image and font files, with a combined install base reported at up to 2.6 million, and suspended the developer accounts behind them.
- [Researchers Disclose Amazon Q Developer VS Code Flaw Affecting Cloud Credentials](https://www.thecybersignal.com/amazon-q-developer-vs-code-mcp-cloud-credential-research-2026.md) - A coding-AI-assistant flaw with cloud-credential implications — defender posture review for the week.
- [OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards](https://www.thecybersignal.com/openai-gpt-5-6-sol-restricted-access-cyber-safeguards-2026.md) - Another defender-positive AI model preview from OpenAI, this time gated to a small group of vetted partners at the US government's request and shipped with the company's most robust cyber-safety stack to date.
- [US Posts $10 Million Reward Over Russian-Intelligence Signal and WhatsApp Phishing](https://www.thecybersignal.com/us-10-million-reward-russian-signal-whatsapp-2026.md) - A coordinated US law-enforcement push against a Russian-intelligence messaging-app campaign pairs a Rewards for Justice bounty with an FBI advisory on Signal backup-recovery-key theft.
- [Apple Patches 30+ iOS, macOS, and Safari Flaws, Including AI-Discovered WebKit Bugs](https://www.thecybersignal.com/apple-30-plus-ios-macos-safari-patches-ai-webkit-2026.md) - Apple shipped an early, large patch cycle across iOS, macOS, and Safari — including four WebKit bugs surfaced by AI tools from OpenAI and Anthropic. For defenders, this is a device-verification week.
- [UK and Insurer Reporting Pegs Jaguar Land Rover Incident at $2.5 Billion](https://www.thecybersignal.com/jaguar-land-rover-jlr-russian-attribution-2-5-billion-2026.md) - Fresh reporting around the Jaguar Land Rover cyber incident pegs the toll near $2.5 billion and points to Russian-linked actors — a scale-significant automotive-manufacturing disclosure whose figure source and attribution both warrant careful reading.
- [Insurance Regulator Body NAIC Confirms Breach Linked to Oracle PeopleSoft Flaw](https://www.thecybersignal.com/us-federal-insurance-oracle-data-breach-2026.md) - Another insurance-sector confirmation in the Oracle PeopleSoft vulnerability cycle: the body that supports US state insurance regulators says attackers reached its environment through CVE-2026-35273, exposing statutory financial and credit-rating data.
- [One Million Passport Records Reported Leaked Online From Cannabis-Club App](https://www.thecybersignal.com/one-million-passport-records-leak-2026.md) - Identity-data exposures continue at scale. A cannabis-club membership platform reportedly left nearly a million passports and ID photos reachable on the open internet with no password — a consumer-notification story for the week.
- [Researchers Disclose "Miasma" Supply-Chain Wave Across 20+ npm Packages and GitHub Actions](https://www.thecybersignal.com/miasma-npm-github-actions-supply-chain-2026.md) - Another JavaScript-ecosystem supply-chain disclosure puts developer-secret rotation and GitHub Actions auditing back at the top of the defender to-do list — this time as a fresh wave of the ongoing Miasma cluster.
- [Researchers Publish "pedit COW" Linux Disclosure (CVE-2026-46331)](https://www.thecybersignal.com/pedit-cow-linux-research-disclosure-2026.md) - Researchers detailed pedit COW, CVE-2026-46331, a Linux kernel privilege-escalation flaw in the act_pedit traffic-control action — a second Linux disclosure in the same weekend as DirtyClone, with distribution patch tracking continuing.
- [CISA Adds Exploited PTC Windchill RCE Flaw CVE-2026-12569 to KEV Catalog](https://www.thecybersignal.com/cisa-ptc-windchill-rce-kev-addition-2026.md) - CISA's KEV addition raises the priority for PTC Windchill defenders, who now face an actively exploited remote code execution flaw, continuing web-shell activity, and a tight federal remediation deadline.
- [Ukraine and CERT-UA Document Russian Intelligence Phishing of Messaging Credentials](https://www.thecybersignal.com/ukraine-cert-ua-russian-intelligence-messaging-credentials-2026.md) - A Russian-intelligence campaign against messaging-app credentials, documented by Ukraine, uses fake support texts to coax Signal and WhatsApp users into surrendering the codes that unlock their accounts.
- [Researchers Publish "DirtyClone" Linux Kernel Disclosure (CVE-2026-43503)](https://www.thecybersignal.com/dirtyclone-linux-kernel-research-disclosure-2026.md) - Another Linux kernel research disclosure — distribution patch tracking work for the week. JFrog published a working exploit for DirtyClone, a local privilege escalation to root in the kernel networking stack, fixed upstream in late May.
- [FCC Adopts New Cybersecurity Rules for Emergency Systems and Undersea Cables](https://www.thecybersignal.com/fcc-cybersecurity-rules-emergency-undersea-cables-2026.md) - New FCC cybersecurity rules land for emergency systems and undersea-cable operators, mandating baseline cyber hygiene for alert equipment and a first-in-decades overhaul of submarine-cable licensing and security.
- [Polymarket Discloses $3.1M User-Fund Theft After Vendor Compromise](https://www.thecybersignal.com/polymarket-user-fund-theft-account-compromise-2026.md) - A high-profile prediction-market disclosure of user-fund theft: a compromised third-party vendor injected a malicious script into Polymarket's frontend, draining roughly $3.1 million from eleven user wallets, with the platform pledging full refunds.
- [Google Publishes Analysis of Turla's New STOCKSTAY Backdoor in Ukraine Espionage](https://www.thecybersignal.com/google-mandiant-turla-stockstay-backdoor-ukraine-2026.md) - Another Russia-linked backdoor lands on defenders' desks for review. Google Threat Intelligence Group and Mandiant have detailed STOCKSTAY, a .NET implant Turla has deployed against Ukrainian government and military networks since at least 2022.
- [Cisco Unified CM Flaw CVE-2026-20230 Exploited Within 24 Hours of Disclosure](https://www.thecybersignal.com/cisco-unified-cm-cve-2026-20230-24-hour-exploitation-2026.md) - Time-to-patch matters: a public proof-of-concept for Cisco Unified CM's CVE-2026-20230 was weaponized in under 24 hours, dropping webshells on internet-exposed call-control servers and earning a place on CISA's KEV catalog.
- [Cellebrite Tooling Documented on Jailed Activist's iPhone After Stated Russia Cutoff](https://www.thecybersignal.com/cellebrite-russia-activist-iphone-after-cutoff-2026.md) - Cellebrite's stated sales-restriction practice gets fresh scrutiny via human-rights documentation, after researchers tied its forensic tooling to a jailed Russian activist's iPhone months after the company said it had pulled out.
- [CISA Publishes New SASE Adoption Guide for Federal Agencies](https://www.thecybersignal.com/cisa-sase-zero-trust-federal-guidance-2026.md) - New federal SASE guidance from CISA — defender roadmaps align this week. The agency's latest “Journey to Zero Trust” release tells civilian agencies how to retire legacy internet gateways for a cloud-delivered, zero-trust edge.
- [Researchers Disclose macOS Flaw Allowing Standard Users to Disable EDR and MDM](https://www.thecybersignal.com/macos-edr-mdm-standard-user-disable-research-2026.md) - A macOS endpoint-protection bypass with defender posture-review implications. XM Cyber researchers showed that a standard, non-admin user can silently unload EDR and MDM agents on macOS, abusing legitimate XPC behavior rather than a single patchable bug.
- [Operation Endgame Coordinators Describe Multi-Year "Assembly Line" Disruption](https://www.thecybersignal.com/operation-endgame-assembly-line-retrospective-2026.md) - A retrospective frame on the most consequential law-enforcement effort against cybercrime infrastructure, as Operation Endgame's coordinators recast a string of 2026 takedowns as one sustained assault on the criminal supply chain.
- [Australia Discloses Nation-State Activity Against Critical Infrastructure](https://www.thecybersignal.com/australia-critical-infrastructure-nation-state-disclosure-2026.md) - Australian government and intelligence officials disclosed nation-state activity against the country's critical infrastructure that, they assessed, could enable disruption at a time of the actor's choosing — landing amid a wave of Five-Eyes warnings.
- [Cisco SD-WAN Zero-Day Exploitation Continues; Catalyst Customers Urged to Verify Patches](https://www.thecybersignal.com/cisco-sd-wan-zero-day-continued-exploitation-cve-2026-20245-2026.md) - The Catalyst SD-WAN saga continues — defender verification posture stays active. Reporting around CVE-2026-20245 keeps tracking the root-level CLI flaw as customers confirm fixed builds across their deployments.
- [Tata Electronics Confirms Cyberattack After Reported Data Leak](https://www.thecybersignal.com/tata-electronics-cyberattack-disclosure-2026.md) - An Indian industrial-sector confirmation — sector-advisory work for the week. Tata Electronics says a recent incident hit some of its systems while an extortion group leaks data it claims to have stolen, putting manufacturing and supply-chain risk back in focus.
- [Microsoft Files Racketeering Suit Linking Amadey and StealC Operators via AI](https://www.thecybersignal.com/microsoft-racketeering-suit-amadey-stealc-ai-analysis-2026.md) - Microsoft's civil legal tooling now leans on AI-link analysis — a notable methodology disclosure in a public filing that frames two separate malware operations as a single racketeering conspiracy.
- [Researchers Disclose "OpenClaw" Skill-Marketplace Risks for AI Coding Agents](https://www.thecybersignal.com/openclaw-skill-marketplace-malicious-skills-research-2026.md) - AI-coding-agent skill marketplaces are an emerging supply-chain surface — defenders have inventory work this week.
- [CISA Adds Critical Ubiquiti and Lantronix Vulnerabilities to KEV Catalog](https://www.thecybersignal.com/cisa-kev-ubiquiti-lantronix-additions-2026.md) - Two vendors, four exploited flaws, one short federal deadline — CISA's latest KEV additions hand defender teams a concentrated patch-verification job across UniFi OS and Lantronix edge-server fleets this week.
- [Researchers Disclose "Cordyceps" CI/CD Flaws Affecting 300+ GitHub Repositories](https://www.thecybersignal.com/cordyceps-cicd-github-300-repos-disclosure-2026.md) - Supply-chain audit work for organizations using GitHub-hosted CI/CD: a research firm found a recurring pull-request handling and workflow-permission pattern that left 300-plus repositories open to attacker-controlled code execution.

## Optional
- [RSS Feed](https://www.thecybersignal.com/rss/)
- [Sitemap](https://www.thecybersignal.com/sitemap.xml)
- [Full content of pages and posts](https://www.thecybersignal.com/llms-full.txt)