research hub

Security research,
plainly explained

New analyses every week — vulnerabilities, exploits, and the attack patterns that matter. What the bug is, who's exposed, what to do about it before Monday.

Megalodon: automated campaign backdoors 5,500+ GitHub repositories through CI workflow injection

May 22, 2026 Threat intel

Megalodon: automated campaign backdoors 5,500+ GitHub repositories through CI workflow injection

durabletask PyPI (TeamPCP/Mini Shai-Hulud): multi-cloud credential stealer with lateral movement and conditional wiper

May 19, 2026 Threat intel

durabletask PyPI (TeamPCP/Mini Shai-Hulud): multi-cloud credential stealer with lateral movement and conditional wiper

Mini Shai-Hulud @antv wave: 640 compromised npm package versions across 320+ charting and visualization packages

May 19, 2026 Threat intel

Mini Shai-Hulud @antv wave: 640 compromised npm package versions across 320+ charting and visualization packages

actions-cool/issues-helper GitHub Action compromised through tag poisoning: all tags point to credential-stealing imposter commit

May 18, 2026 Threat intel

actions-cool/issues-helper GitHub Action compromised through tag poisoning: all tags point to credential-stealing imposter commit

Nx Console VS Code extension (nrwl.angular-console v18.95.0): orphan commit staging, macOS LaunchAgent backdoor, Sigstore attestation forgery

May 18, 2026 Threat intel

Nx Console VS Code extension (nrwl.angular-console v18.95.0): orphan commit staging, macOS LaunchAgent backdoor, Sigstore attestation forgery

CVE-2026-42945: NGINX heap buffer overflow in rewrite + set directive chain enables RCE — 18-year-old bug class

May 14, 2026 Threat intel

CVE-2026-42945: NGINX heap buffer overflow in rewrite + set directive chain enables RCE — 18-year-old bug class