Cybersecurity briefing, 2026-05-25

Rotating the leaked secret is not closing the incident if the workflow already minted cloud identity outside GitHub.

• Ghost SQLi Turns Sites Into Trusted Malware Launchpads
• Trusted Package Channels Became the Attack Vector
• Shared MachineKey Turns One LMS Bug Into Fleet Risk
• Server Seizures Miss THE.Hosting's Core Network
• Cross-Registry Package Attack Turns Ecosystems Into Trapdoors
• GitHub Actions Became a Secret-Stealing Conveyor Belt
• Phishing Services Now Steal Money in Real Time
• Szafir SDK Trusted Bad Signatures as Verified
• Wireshark 4.6.6 Also Updates the Capture Driver
• AI Finds More Flaws Than Teams Can Triage
• Kenik Camera Panels Can Read Server Files
• Authenticated Users Can Read OutSystems Audit History
• Memory-Only Lazarus RAT Hides Financial Intrusions

Recent editions

• Sunday, May 24, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 5 stories
• Saturday, May 23, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 14 stories
• Friday, May 22, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 18 stories
• Thursday, May 21, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 18 stories
• Wednesday, May 20, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 19 stories
• Tuesday, May 19, 2026: Critical Manufacturing Gear Exposed by PAN-OS Flaw · 20 stories
• Monday, May 18, 2026: React Server Components Face Hour-Scale Ransomware Risk · 13 stories