Identity is the control plane, and the control plane is an API. Files here follow permission paths rather than perimeters: what a role could do, what it did, and which log would have shown you.
The actions-cool/issues-helper and maintain-one-comment actions were disabled on 19 May after the Mini Shai-Hulud campaign put a credential stealer in their tags. On 16 September they came back, tags untouched. Every workflow pinned to a tag re-ran the payload on its next job until GitHub disabled them again on 25 September.
The key was the app’s, the data was the merchant’s, and the shopper had never heard of either. The party that knows how it was stolen has not spoken.
One key in the source code, permissions for everything, and the edge where every customer page is built. The platform itself was never entered.
A confirmed small intrusion and a possible large one, three days apart. The larger number is the one that will circulate.
A video call reaches the Android kernel on three Unisoc chipsets, and the vendor has not replied.
A communications company, reached the way its customers are reached. The claim was 623GB; the verified count is 1.6 million.
A CVSS 10.0 flaw in a reporting tool that stores the credentials for every warehouse behind it.
361 hosts in 47 countries, and 95% of them taken inside two days of the first exploitation.
About 75% of insider incidents involve nobody acting maliciously. Programmes built to detect grievance address a quarter of the problem.
Three documented routes into the same object. Closing one is not closing the campaign, and the map arrived after the territory.
Execution moved from install to import. The flag everyone added after the last campaign is still set, and no longer covers anything.
Rotating the stolen key is the fix. It is also what erases the proof anyone used it.
Hidden native binaries executing at install, in a trusted package name. Compiled code is opaque to the review most registries actually perform.
A name concatenated from three crews. Attribution language implies a roster, and a coalition brand quietly breaks that implication.
24 billion credential records from 36 sources in one indexed store. The thefts were old; the index is what makes them usable.
A legacy credential and stolen OAuth tokens reached Salesforce environments at ~24 customers. The tokens were used exactly as designed.
A missing authentication check on a table query endpoint. One defect, and a different blast radius inside every tenant.
A phone call, a consent screen, and a refresh token that outlives every password change. No exploit is involved at any step.
A credential-stealing worm in a major vendor’s npm namespace. The namespace is the trust signal, and it delivered the reviewer’s assumption too.
1.4 million addresses, and instructor payout methods. A card can be reissued; a bank account configured to receive money cannot.
Four different things drive the 263%, and only one is bad news. The count measures workload, not software quality.