SAP Exploits, Supply Chain Hits, and Defender Tools Get Sharper

News

Chinese APTs Actively Exploiting Critical SAP NetWeaver Vulnerability

Chinese APTs are actively exploiting a critical authentication bypass in SAP NetWeaver (CVE-2025-31324) to deploy webshells and persist in networks. If you run SAP for business-critical functions, this is a patch-now situation.

Malicious npm Packages Infect Over 3,200 Machines in New Supply Chain Attack

A new supply chain attack is hitting the npm ecosystem, using malicious packages to infect over 3,200 machines with infostealers. This is a good reminder to audit your dependencies and lock your project files.

Gitloker Attacks Abuse GitHub Notifications to Push Malicious OAuth Apps

Attackers are abusing GitHub's notification system to push malicious OAuth apps to developers, hijacking accounts. It's a clever social engineering vector; double-check any notification that asks for OAuth authorization.

Tools

TruffleHog Updates Secrets Detection Engine

The latest drop from Truffle Security adds better scanning for common high-signal secrets in your codebase. It's a good nudge to re-run your CI secrets scanner or plug this into your pre-commit hooks.

CISA's Malcolm Tool Gets Major v25.05.0 Release

CISA's open-source network traffic analysis tool, Malcolm, just dropped v25.05.0. If you're building a detection pipeline for OT/ICS or need better visibility into your network flows, this is a solid tool to evaluate.

Events

CISA Drops Three More Vulnerabilities to its 'Must-Patch' Catalog

CISA just added three more exploited vulnerabilities to its "must-patch" catalog for federal agencies and critical infrastructure. The signal here is that these are under active exploitation in the wild, so treat them as high-priority for your own patching queue.