An OVHcloud CLI attack swapped GitHub release files with a secret-stealing binary. Learn which versions are hit in this supply chain attack.

Related Posts:

• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
• AdFection Spyware Attack Targets Al Jazeera Devices
• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

The post OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build appeared first on Daily CyberSecurity.

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

Related Posts:

• Google Updates Chrome VRP Rewards for Memory Flaws
• Google Play AI Apps Revolutionize Android Publishing
• Google Gemini 4 Argon Model Officially Launches

The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.

A GitLab critical vulnerability, CVE-2026-97229 (CVSS 10.0), allows unauthenticated arbitrary code execution. Upgrade to GitLab 19.4.2 now.

Related Posts:

• MariaDB Patches Nine Vulnerabilities Enabling Privilege Escalation and Code Execution
• NVIDIA DCGM Exporter Flaw CVE-2026-47483 Lets Attackers Crash GPU Monitoring
• AnyDesk RCE Vulnerability Details and PoC Exploit Code Publicly Disclosed

The post GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code appeared first on Daily CyberSecurity.

Four critical Argo CD vulnerabilities, including AppProject bypass CVE-2026-77459, threaten the repo-server and clusters. Upgrade to v3.5.4 now.

Related Posts:

• Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials
• wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516
• Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027

The post Argo CD Patches Four Critical CVSS 9.9 Flaws Affecting the Repo-Server and AppProject Controls appeared first on Daily CyberSecurity.

Progress DataDirect vulnerability CVE-2026-91140 enables command injection via crafted OpenAPI files in AI agents. Pull version 2.1 now.

Related Posts:

• CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
• Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
• ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3

The post Progress Fixes Critical Command Injection Flaw CVE-2026-91140 in DataDirect AI Model Generator Agents appeared first on Daily CyberSecurity.

PixelLeak: an AI agent screenshot leak put 13,000+ internal images from 300+ firms in public GitHub repos. See how it happened and how to check.

Related Posts:

• Meta Muse Secretly Used Humans for AI Phone Calls
• ShinyHunters Syndicate Alleges Major FBI Network Compromise
• Leaked GitHub App Private Keys Expose Critical Infrastructure

The post AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos appeared first on Daily CyberSecurity.

A High-severity Octopus Server vulnerability, CVE-2026-101169, lets users with edit rights run code via insecure deserialization. Upgrade now.

Related Posts:

• macOS SMB Kernel Flaw CVE-2026-84543: Details and PoC Exploit Released
• Exploited Citrix NetScaler Flaw CVE-2026-88771: Details and PoC Now Public
• Apache Karaf Vulnerabilities Let Low-Privilege Users Reach Admin and Code Execution

The post Octopus Server Flaw CVE-2026-101169 Allows Code Execution via Insecure Deserialization appeared first on Daily CyberSecurity.