← Cybersecurity Headlines
Cybersecurity Headlines
GitHub VS Code extension breach, Shai-Hulud npm package compromise, Huawei/Luxembourg telecom link
00:07:37
Loading summary
Transcript4 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Thursday, May 21, 2026. I'm Sarah Lane. GitHub breach via VS code extension GitHub says around 3,800 internal repositories were breached after an employee installed a malicious Visual Studio code extension that compromised their device. The attacker, linked by researchers to the Team PCP group, accessed only internal repos with no evidence of customer data exposure otherwise. Team PCP claimed responsibility and allegedly tried to sell the stolen code for at least $50,000 and has a history of supply chain attacks across GitHub, PyPi, npm and docker shy hauludwave compromises. 600 npm packages, socket Endor Labs, Aikido Security and Microsoft all say a new Shai Hulud supply chain attack published more than 600 malicious npm packages, mainly targeting the ecosystem. Researchers found the malware steals developer and CICD credentials, self propagates using stolen NPM tokens, exfiltrates data through the encrypted session network, and then generates legitimate looking SIG store attestations to evade detection. Aikido also found persistent backdoors in VS code and CLAUDE code configs, while nearly 3,000 GitHub repos were automatically created to store stolen data. Huawei attack behind Luxembourg telecom crash the record Sources say a previously undisclosed Huawei router flawless, caused a July 2025 cyber attack that knocked Luxembourg's telecom network offline for more than three hours, disrupting landline, mobile and emergency communications nationwide, investigators said. Specially crafted traffic triggered Huawei routers to continuously reboot, though there was no evidence that Luxembourg was specifically targeted. Huawei has not publicly acknowledged the flaw, no CVE has been issued, and it remains unclear whether other operators are still vulnerable. Microsoft rolls out yellow key mitigations Microsoft released mitigations for a BitLocker bypass flaw known as Yellow Key, which lets attackers with physical access use a USB drive and reboot a Windows system into recovery mode to access encrypted data. The exploit abuses the Windows recovery environment by manipulating the FSTX auto recovery utility and deleting a key configuration file, causing Winre to launch a command shell with BitLocker already unlocked instead of the normal recovery interface. The exploit's creator claims the attack can still work even when BitLocker uses both TPM and PIN protection. Huge thanks to our sponsor ThreatLocker, ThreatLocker is extending zero trust beyond endpoint control with their recent release of zero trust network access and zero trust cloud access. Access isn't based on credentials alone. It requires the right user, the right device and the right conditions. Because as we've seen in recent large scale CRM breaches, stolen credentials and misconfigurations can expose massive amounts of data. With ThreatLocker, nothing is exposed and access is limited to exactly what's needed. Learn more and start your free trial today@threatlocker.com CSEL Grafana breach caused by Mist token rotation Grafana says its breach stemmed From a missed GitHub workflow token rotation after malicious Tanstack NPM packages infected with shy holod malware executed its CICD environment. The attacker stole workflow tokens via the infected dependency and used an unrotated token to access private repositories later, exfiltrating source code and some business contact information. Grafana says no customer production systems were impacted, code base was not altered and users don't need to take action. Fake Android apps silently charged users Symperium Researchers say a 10 month Android malware campaign called Premium Deception used nearly 250 fake apps impersonating brands like TikTok, Minecraft and Instagram threads to secretly enroll users in premium mobile billing services. The malware targeted users in Malaysia, Thailand, Romania and Croatia, abusing Google's SMS retriever API, hidden web views and carrier billing workflows to automate fraudulent subscriptions. Researchers also found Telegram based alerts, dynamic C2 infrastructure and tracking systems designed to optimize infections and evade detection. Microsoft Open Sources Rampart and Clarity Microsoft has open sourced two AI security tools called Rampart and Clarity to help developers test and secure AI agents during development. RuralPart is a PI test based framework for red teaming AI systems against issues like prompt injection, data exfiltration and behavioral regressions. Clarity acts as an AI assistant design review tool that helps teams identify risky assumptions before coding even starts. Microsoft says the tools are designed to turn AI safety testing into an ongoing engineering process rather than a one time review. Claude Sandbox Real and Dangerous Aonan Guan, a cloud and AI security researcher at Wise Labs, found two patched vulnerabilities in Anthropic's Claude Code sandbox that could allow network sandbox bypass and data exfiltration when combined with prompt injection. The flaws include a sock, S5 host name and null byte injection to expose credentials, GitHub tokens and cloud metadata, but were silently fixed. Anthropic says the issue was already patched before disclosure. Guan argues the lack of clear public notice leaves users unaware their sandbox boundary may have been ineffective for months remember to subscribe to the CISO series on YouTube. We've got new shorts videos posting every day and it's where we stream our Department of no show every Friday at 4 4pm Eastern Time. If you have thoughts on the news from today or about our show in general, be sure to reach out to us. Feedbacksoseries.com we really want to hear from you. I am Sarah Lane reporting for the CISO series. You stay safe and also classy out there.
- [07:21]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.
- [07:33]
B
It.