← Cybersecurity Headlines
Cybersecurity Headlines
Megalodon infects GitHub repositories, Netherlands seizes 800 servers, Ghost CMS exploited for ClickFix attacks
00:06:59
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Tuesday, May 26, 2026. I'm Sarah Lane. Megalodon infects GitHub repositories researchers Safedep say a supply chain attack dubbed Megalodon infected more than 5,500 GitHub repositories after attackers pushed five 5,718 malicious automated commits in a six hour window on May 18. The commits inserted GitHub action workflows that stole CI secrets including Cloud credentials, SSH keys, API tokens and database strings, while planting dormant backdoors that could be triggered later through GitHub's API. The campaign surfaced after compromised versions of Tile Desk were published from a poisoned GitHub repository and adding to a growing wave of software supply chain attacks targeting developers. Netherlands seizes 800 servers over cyber attacks Dutch authorities have arrested two men and seized more than 800 servers tied to hosting providers Mir Hosting and work titans bv, accusing both of helping provide infrastructure used by Russian linked groups for cyber attacks, influence operations and and disinformation across the eu. The investigation centers on Stark Industries Solutions, a network previously linked to DDoS attacks and proxy services used in Russian cyber operations, whose infrastructure was allegedly transferred to the Dutch companies after earlier EU sanctions. Ghost CMS exploited for click fix attacks Researchers at Cheonxin xlab say attackers are actively exploiting a critical Ghost CM CMS HUA to hijack more than 700 websites and inject malicious JavaScript tied to click fix attacks. The bug was discovered by Anthropic using Claude and patched back in February, letting attackers steal a site's admin API key and then bulk modify published articles with malware loaders. Victims visiting compromised sites are funneled to fake captcha pages that trick them into running malicious commands, ultimately installing persistent malware. Nigel Farage's hack claimed to be without any merit Former UK cyber chief Kieran Martin says Nigel Farage, leader of Reform uk, has provided no evidence for his recent claim that Russia hacked him and leaked information behind a Guardian report on an undeclared 5 million pound donation from crypto billionaire Christopher Harborne. Martin called the allegation a serious national security claim without any merit unless backed by technical proof, and said Farage should report any evidence to the UK's National Cybersecurity Centre immediately. Huge thanks to our sponsor Guard Square. Your back end is only as secure as your front end. Research shows that client side compromise is now a primary driver of API risk with 63% of leaders detecting mobile app tampering or cloning last year. Don't leave your mobile app security to chance. Get multi layered protection for your entire mobile app ecosystem from the outside in. Learn more@guardsquare.com Fake streams, counterfeit Merch and Scams oh my. According to the Bitdefender Cybersecurity Grand Prix Fan Threat Index, cybercriminals have built a broad scam ecosystem around Formula One, targeting fans with fake streaming apps, counterfeit merchandise, bogus ticket offers and social media scams. This is all to steal personal and payment data, spread malware or monetize victims through ads and redirects with some fake streaming tools, even enrolling devices into botnets. Researchers say the pace and popularity of F1 make fans especially vulnerable. Mythos Class models headed to the public Anthropic says it plans to eventually release public versions of its Mythos bug finding once it can build stronger safeguards against misuse. For now, access remains limited under Project glasswing, though it is expanding to governments and some other partners. Anthropic says Mythos has scanned more than 1,000 open source projects and found more than 6,200 high or critical severity vulnerabilities, including a major flaw in Wolf ssl. But the volume of AI generated findings is also adding strain to security. Team Lazarus deploys Remote PE memory only RAT Researchers at Fox IT say the North Korea linked Lazarus group is using a stealthy memory only remote access trojan called Remote PE in attacks on financial and cryptocurrency firms. It's delivered through social engineering on Telegram and fake scheduling sites and loads entirely in memory, evades endpoint detection and leaves almost no forensic traces while giving attackers persistent access for surveillance, data theft or potential financial heists. Oncology Institute discloses breach the Oncology Institute, or toi, which delivers specialized cancer care through a network of clinics across five US States, says a previously disclosed cybersecurity incident at a third party software vendor exposed patient data across its systems. While the vendor was not named, the timeline points to Trizetto Provider Solutions, which earlier reported a breach affecting multiple healthcare customers and about 3.4 million people. The full scope of the impact and who was behind the attack? Still unclear. Cloud misconfigurations aren't a technical problem, they just show what your organization really cares about. CISOs are always told that time to value is paramount, but why does the business forget that when there's a security incident? That's what we'll be discussing on this week's CISO Series podcast. Look for the episode. If you like cloud misconfiguration so much, why don't you marry them wherever you get your podcasts? If you have some thoughts on the news from today or about our show in general, be sure to reach out to us feedbackisoseries.com we would love to hear from you. I am Sarah Lane, reporting for the CISO series. You stay safe out there everyone.
- [06:43]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.