Threat Watch– active
All incidents
More on Threat Watch
More Google incidents
- hs-framework (npm): malicious package installs remote tarball from attacker-controlled GCS bucket, executing arbitrary code on install Critical · Supply chain
- GitHub Actions injection campaign targets 61 public repos (incl. Trivy, MLflow) via hidden HTML comments High · Supply chain
- Skyw4lker: device code phishing campaign targeting U.S. organizations via Microsoft 365 token theft High · Breach
- Dependency-confusion npm malware: @drone-js-ext & @fmr-ap153177/@futurae-public stubs beacon hosts / pull off-registry tarballs Critical · Supply chain
- IO::Compress::Brotli (Perl): bundled Brotli decoder out-of-bounds write on untrusted input (CVE-2026-115936) Critical · Supply chain
- APT41 BlackX UEFI bootkit bypasses Secure Boot via unrevoked Baton Drop certificate (CVE-2022-21894) High · Patch now
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.