Phoenix Security

On June 1, 2026, 32 packages in the @redhat-cloud-services npm scope — totalling 116,991 weekly downloads — were backdoored by Miasma, a new Shai-Hulud variant that steals credentials across AWS, GCP, Azure, and Kubernetes through a preinstall hook. No CVE exists. Every malicious version passed npm Trusted Publishing validation using legitimate OIDC-issued tokens, leaving CVE...

AI now generates working exploits in 10–15 minutes. Verizon's DBIR confirms software vulnerabilities have overtaken stolen credentials as the top breach entry point. The NCSC and Bank of England have formally demanded automated, at-scale remediation. This analysis breaks down why traditional vulnerability management is broken, what the 2026 supply-chain attack catalogue tells...

TrapDoor is an active supply chain campaign hitting npm, PyPI, and Crates.io simultaneously — 34 malicious packages, 384 artifact versions, confirmed since May 19, 2026. The campaign steals SSH keys, AWS credentials, GitHub tokens, and crypto wallet keystores, while silently poisoning AI coding assistants through hidden zero-width Unicode injected into .cursorrules and CLAUDE...

An attacker with push access to the Laravel-Lang GitHub organization force-rewrote 700+ git tags across 4 Composer packages on May 22, 2026, injecting an RCE backdoor that fires on every PHP application boot. No CVE was assigned — version pinning offered zero protection. The attack stole CI/CD, cloud, and Kubernetes credentials in 3.16 seconds flat.

The post

MEGALODON_CI is an active zero-CVE campaign poisoning GitHub Actions workflow files across 3,500+ confirmed public repositories. Automated commits inject a base64-encoded credential harvester that exfiltrates AWS, GCP, and Azure secrets, OIDC tokens, SSH keys, and package registry credentials in a single runner execution. No CVE exists — every traditional scanner is blind to ...