Supply Chain Hits, APT Exploits, and CISA Tooling Updates

News

CISA adds three known exploited vulnerabilities to catalog

CISA is adding three known, exploited vulnerabilities to their catalog. If you're building on or supporting enterprise software, this is a clear signal to check your patch queue and prioritize these specific flaws.

Threat

Gitloker attacks abuse GitHub notifications to push malicious OAuth apps

A new campaign is hijacking GitHub notification emails to push malicious OAuth apps. It's a low-effort phishing vector that targets developers where they're least expecting it: their inbox.

Supply Chain

Malicious npm packages infect over 3,200 machines

A new batch of malicious npm packages has infected over 3,200 machines. This highlights the persistent, low-friction risk of typosquatting and dependency confusion in the JS ecosystem.

APT

Chinese hackers exploit SAP NetWeaver flaw for cyber-espionage

Chinese state-sponsored hackers are actively exploiting a critical SAP NetWeaver flaw. This is a high-value target for espionage, and the exploitation is reportedly widespread and automated.

Tools

TruffleHog secrets scanner gets a new release

TruffleHog, the popular secrets scanner, has a new release. If you're using it in your CI/CD, it's worth checking the changelog for new detectors or performance improvements.

CISA's Malcolm network analysis tool drops v25.05.0

CISA's Malcolm network traffic analysis suite has a new version out (v25.05.0). It's a solid, free option for defenders who need better visibility into their network logs.