|
🔑 US cyber agency exposed its own cloud keys on GitHub
LINK
|
- The US Cybersecurity and Infrastructure Security Agency confirmed a contractor leaked its privileged Amazon AWS GovCloud keys on a public GitHub repository in May, and released a forensic report Thursday detailing its response and fixes.
- CISA said log analysis showed none of the leaked credentials were used outside the agency and no customer or mission data was exposed, after it took the repository offline and revoked the responsible person's access.
- CISA rotated all of its secrets, resolved to use endpoint detection and response to monitor uploads to public repositories, built a GitHub incident playbook mid-incident, and moved to make reporting CISA-specific vulnerabilities easier for researchers.
|
🔌 File-sharing firm tells customers to shut down servers now
LINK
|
- Progress Software has told customers running ShareFile Storage Zone Controllers to immediately shut down their internet-facing Windows servers after detecting what it calls a credible external security threat targeting the on-premises component of ShareFile's hybrid deployment.
- Progress has not disclosed the nature of the threat, who is behind it, whether any controller was compromised, or which version is affected, but it temporarily disabled cloud-side access and said it has no indication yet of unauthorized access to any accounts or data.
- Only the hybrid Storage Zone Controller deployment is affected, not cloud-only ShareFile accounts; the same product was hit in 2023 via an unauthenticated remote code execution flaw, CVE-2023-24489, that CISA flagged as actively exploited while ShareFile still belonged to Citrix.
|
📦 Poisoned developer tool steals cloud and crypto secrets
LINK
|
- Attackers hijacked the Jscrambler npm package and pushed trojanized versions carrying a hidden cross-platform payload that steals cloud credentials, cryptocurrency wallet data, and developer secrets from developers, build pipelines, and CI/CD systems.
- Socket detected the first malicious release, 8.14.0, within six minutes of its July 11, 2026 publication; early versions ran automatically during npm install, while later versions 8.18.0 and 8.20.0 dropped the install hook and self-executed on import.
- Jscrambler confirmed the versions were published using a stolen npm publishing credential, revoked and rotated it, deprecated the malicious releases, and shipped a clean 8.22.0; organizations should remove affected versions and rotate exposed secrets.
|
🔓 Hackers hijack Joomla sites via two file-upload flaws
LINK
|
- Attackers are hijacking Joomla websites by abusing two file-upload weaknesses in the popular iCagenda and Balbooa extensions, uploading malicious PHP files that let them run their own code on the server.
- The main flaw, CVE-2026-48939 in the iCagenda extension's "Submit an Event" feature (maximum severity, CVSS 10/10), has been exploited in automated attacks since June 15, 2026, and is fixed in iCagenda versions 4.0.8 and 3.9.15.
- The companion Balbooa Forms flaw lets any anonymous visitor upload a file with no login or file-type check for unauthenticated remote code execution, patched in version 2.4.1, with admins urged to check the "images/baforms/uploads" and iCagenda attachments folders for unauthorized PHP files.
|
|
.png)
.jpg)
