Supply Chain Attack
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19. The vendor says that it detected the compromise and stopped […]
Alpine Linux rebuilds GitLab after attempted RCE attack
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux’s development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to […]
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout. The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce […]
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. The supply-chain attack affected all PyPI wheels (.whl installation packages) for LiteLLM version 1.107.0, impacting Windows, Linux, and macOS systems. LiteLLM is an open-source Python SDK and AI gateway that enables applications to […]
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool. OVHcloud offers the CLI tool as an alternative for […]
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website carried malware that planted hidden backdoors in a supply-chain attack last week. According to the vendor, a limited number of users who downloaded version 3.0.123 of the plugin between October 15 at 20:02 UTC and October 16 at 07:12 UTC received […]
Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents. The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send […]
Ledger confirms spy chip implant behind wallet crypto thefts
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users’ cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the […]
BigCommerce alerts merchants of data breach linked to Ribon apps
Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. The cloud-based Software-as-a-Service (SaaS) ecommerce platform confirmed the credential compromise on September 17 and immediately removed the apps to protect its customers. UK-based online spirits vendor Master […]
Brevo supply-chain attack injected ClickFix scripts on customer sites
Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. The customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at […]