Cybersecurity briefing — 2026-05-25

Rotating the leaked secret is not closing the incident if the workflow already minted cloud identity outside GitHub.

• Ghost SQLi Turns Sites Into Trusted Malware Launchpads
• Trusted Package Channels Became the Attack Vector
• Shared MachineKey Turns One LMS Bug Into Fleet Risk
• Hosting Firms Become Enforcement Targets in Influence Ops
• Cross-Registry Package Attack Turns Ecosystems Into Trapdoors
• GitHub Actions Became a Secret-Stealing Conveyor Belt
• Phishing Services Now Steal Money in Real Time
• Szafir SDK Trusted Bad Signatures as Verified
• Wireshark 4.6.6 Also Updates the Capture Driver
• AI Finds More Flaws Than Teams Can Triage
• Kenik Camera Panels Can Read Server Files
• Authenticated Users Can Read OutSystems Audit History
• Memory-Only Lazarus RAT Hides Financial Intrusions