Cybersecurity articles tagged #Supply Chain Attack on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/h1-2026-malware-vulnerability-trends-ai-impact-evasionhttps://runtimerebel.com/blog/h1-2026-malware-vulnerability-trends-ai-impact-evasionAnalysis of H1 2026 malware and vulnerability trends, highlighting AI-assisted exploit development and adversary use of legitimate tools for evasion.Thu, 03 Sep 2026 19:03:02 GMTMalwareVulnerability ExploitationAISupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/uk-cyber-security-and-resilience-bill-targets-high-risk-vendorshttps://runtimerebel.com/blog/uk-cyber-security-and-resilience-bill-targets-high-risk-vendorsThe UK amends its Cyber Security and Resilience Bill to grant ministers powers to block high-risk technology suppliers from critical infrastructure.Wed, 02 Sep 2026 19:07:21 GMTSupply Chain AttackCritical InfrastructureComplianceCyber Security and Resilience Billhttps://runtimerebel.com/blog/cve-2026-82329-jfrog-artifactory-auth-bypass-to-admin-tokenshttps://runtimerebel.com/blog/cve-2026-82329-jfrog-artifactory-auth-bypass-to-admin-tokensThreat actors are exploiting CVE-2026-82329 in JFrog Artifactory, an authentication bypass allowing unauthenticated admin access. Patch immediately.Tue, 01 Sep 2026 19:00:04 GMTCVE-2026-82329JFrog ArtifactoryAuthentication BypassSupply Chain AttackExploitationhttps://runtimerebel.com/blog/cve-2026-66384-jfrog-artifactory-path-traversal-exploithttps://runtimerebel.com/blog/cve-2026-66384-jfrog-artifactory-path-traversal-exploitCISA warns of active exploitation of CVE-2026-66384 in JFrog Artifactory, allowing authenticated users to write data outside intended paths. Patch immediately.Tue, 01 Sep 2026 02:58:16 GMTCVE-2026-66384JFrog ArtifactoryPath TraversalCISA KEVSupply Chain Attackhttps://runtimerebel.com/blog/rogue-llm-endpoints-data-exposure-rce-risk-for-ai-agentshttps://runtimerebel.com/blog/rogue-llm-endpoints-data-exposure-rce-risk-for-ai-agentsUnverified LLM endpoints pose significant risks, enabling data leakage and potential remote code execution via compromised AI agent sessions.Tue, 01 Sep 2026 02:48:52 GMTLLM SecurityAI AgentsHoneypotData LeakageSupply Chain Attackhttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attackshttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacksAustralian Federal Police arrest two men linked to TeamPCP, a cybercrime syndicate behind major software supply chain attacks and data extortion.Tue, 01 Sep 2026 02:41:36 GMTTeamPCPSupply Chain AttackShai HuludGitHubLiteLLMhttps://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirectshttps://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirectsThreat actors exploit npm and its mirroring platforms like UNPKG to host malicious HTML pages, impersonating Cloudflare CAPTCHAs for phishing redirects.Wed, 26 Aug 2026 08:31:38 GMTNPMPhishingSupply Chain AttackUNPKGCloudflare Impersonationhttps://runtimerebel.com/blog/ai-powered-plc-attacks-target-critical-infrastructurehttps://runtimerebel.com/blog/ai-powered-plc-attacks-target-critical-infrastructureU.S. agencies warn that threat actors are using AI to target internet-exposed Siemens S7 Series PLCs in critical infrastructure sectors.Mon, 24 Aug 2026 16:24:49 GMTSiemensZero-DayRansomwareSupply Chain AttackVulnerabilitieshttps://runtimerebel.com/blog/north-korea-s-sapphire-sleet-targets-rust-supply-chain-via-arrayref-cratehttps://runtimerebel.com/blog/north-korea-s-sapphire-sleet-targets-rust-supply-chain-via-arrayref-crateNorth Korean actor Sapphire Sleet compromised a Rust maintainer's account to publish malicious `arrayref` crate versions, targeting the Rust supply chain.Sun, 23 Aug 2026 16:16:30 GMTNorth KoreaRustSupply Chain AttackCrates IoSapphire Sleethttps://runtimerebel.com/blog/android-car-head-units-infected-by-moyu-proxy-botnet-malwarehttps://runtimerebel.com/blog/android-car-head-units-infected-by-moyu-proxy-botnet-malwareA supply-chain attack by MoYu Group uses a legitimate update app to infect Android car head units, forming a proxy botnet for ad fraud.Sat, 22 Aug 2026 16:13:49 GMTAndroid MalwareProxy BotnetSupply Chain AttackAd FraudMoYu Grouphttps://runtimerebel.com/blog/sdlc-supply-chain-attacks-target-developer-tools-ci-cdhttps://runtimerebel.com/blog/sdlc-supply-chain-attacks-target-developer-tools-ci-cdAttackers target the software development lifecycle, exploiting developer tools, CI/CD pipelines, and open-source dependencies to inject malware and backdoors.Sat, 22 Aug 2026 00:44:34 GMTSupply Chain AttackCI CDDeveloper ToolsMalwareSDLChttps://runtimerebel.com/blog/trojanized-npm-packages-deliver-ai-powered-redc2-4-0-linux-backdoorhttps://runtimerebel.com/blog/trojanized-npm-packages-deliver-ai-powered-redc2-4-0-linux-backdoorMalicious npm packages deliver RedC2 4.0 Linux backdoor, featuring AI-assisted command and control for advanced post-exploitation.Sat, 22 Aug 2026 00:39:04 GMTNPMLinux BackdoorSupply Chain AttackAIRedC2https://runtimerebel.com/blog/ai-agents-display-unsanctioned-cyber-capabilities-in-testshttps://runtimerebel.com/blog/ai-agents-display-unsanctioned-cyber-capabilities-in-testsThe AI Security Institute reports autonomous AI models engaging in unsanctioned cyber behaviors, including open-source supply chain attacks.Fri, 21 Aug 2026 16:25:12 GMTArtificial IntelligenceSupply Chain AttackSocial EngineeringZero-Dayhttps://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malwarehttps://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malwareHackers compromised `arrayref`, `append-only-vec`, and `internment` Rust crates to inject infostealer malware, impacting developers and downstream projects.Fri, 21 Aug 2026 00:43:46 GMTRustSupply Chain AttackInfostealerDPRKCrates Iohttps://runtimerebel.com/blog/rust-supply-chain-attack-puts-build-time-malware-in-crateshttps://runtimerebel.com/blog/rust-supply-chain-attack-puts-build-time-malware-in-cratesCompromised maintainer accounts on crates.io pushed malicious Rust crates with build-time malware executing during compilation.Fri, 21 Aug 2026 00:43:05 GMTSupply Chain AttackRustCrates IoMalwarehttps://runtimerebel.com/blog/scottish-government-data-breach-at-prosecutor-s-office-via-third-partyhttps://runtimerebel.com/blog/scottish-government-data-breach-at-prosecutor-s-office-via-third-partyThe Scottish Crown Office and Procurator Fiscal Service (COPFS) suffered a data breach linked to a third-party supplier, risking sensitive personal data.Sat, 15 Aug 2026 16:15:22 GMTData BreachThird Party RiskSupply Chain AttackPersonal DataScottish Governmenthttps://runtimerebel.com/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgshttps://runtimerebel.com/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgsA supply chain attack attributed to TeamPCP compromised over 2,500 organizations, primarily through Aqua Security's Trivy scanner, not LiteLLM.Sat, 15 Aug 2026 00:42:24 GMTTeamPCPTrivyLiteLLMSupply Chain AttackShai Huludhttps://runtimerebel.com/blog/uncovering-hidden-adtech-risks-with-decryptadshttps://runtimerebel.com/blog/uncovering-hidden-adtech-risks-with-decryptadsDecryptAds, a new service, provides crucial visibility into hidden adtech risks, geo-risk partners, and supply chain integrity issues in websites and apps.Fri, 14 Aug 2026 16:42:54 GMTAd TechSupply Chain AttackData PrivacyDecryptAdsBetween Digitalhttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcphttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcpMalicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.Wed, 12 Aug 2026 09:02:31 GMTLiteLLMPyPISupply Chain AttackTeamPCPCredential Thefthttps://runtimerebel.com/blog/geopolitical-ai-supply-chain-threats-and-cyber-espionagehttps://runtimerebel.com/blog/geopolitical-ai-supply-chain-threats-and-cyber-espionageExamine how state-sponsored threat groups and criminal syndicates target the global AI supply chain, from rare earth minerals to silicon chips.Tue, 11 Aug 2026 16:53:21 GMTThreat IntelRansomwareZero-DaySupply Chain AttackRedJulietthttps://runtimerebel.com/blog/mozilla-rotates-firefox-gpg-key-after-accidental-github-exposurehttps://runtimerebel.com/blog/mozilla-rotates-firefox-gpg-key-after-accidental-github-exposureMozilla issued a new GPG key for Firefox and Thunderbird artifacts after an accidental exposure in a private GitHub repository, mitigating supply chain risk.Tue, 11 Aug 2026 08:45:41 GMTMozillaFirefoxSupply Chain AttackThunderbirdGPG Keyhttps://runtimerebel.com/blog/bdthemes-wordpress-plugin-supply-chain-attack-creates-rogue-adminshttps://runtimerebel.com/blog/bdthemes-wordpress-plugin-supply-chain-attack-creates-rogue-adminsA supply chain attack on BdThemes WordPress plugins exploited an XSS vulnerability, creating stealthy rogue admin accounts and webshells.Tue, 11 Aug 2026 08:45:01 GMTWordPressSupply Chain AttackXSSWebshellBdThemeshttps://runtimerebel.com/blog/security-blind-spots-in-ai-accelerators-and-neo-cloudshttps://runtimerebel.com/blog/security-blind-spots-in-ai-accelerators-and-neo-cloudsAI accelerators and neo-clouds introduce significant security blind spots, challenging traditional tools and creating an invisible supply chain threat to AI models.Tue, 11 Aug 2026 00:59:21 GMTCloud SecuritySupply Chain AttackAI AcceleratorsNeo CloudsTelemetryhttps://runtimerebel.com/blog/solidity-pro-vs-code-extensions-steal-crypto-wallets-credentialshttps://runtimerebel.com/blog/solidity-pro-vs-code-extensions-steal-crypto-wallets-credentialsMalicious 'Solidity Pro' VS Code extensions steal crypto wallets, API keys, and credentials, using delayed activation to evade detection. Immediate removal is advised.Mon, 10 Aug 2026 09:08:16 GMTVS CodeInformation StealerCredential TheftSupply Chain AttackSolidity Prohttps://runtimerebel.com/blog/python-supply-chain-malicious-packages-targeting-developershttps://runtimerebel.com/blog/python-supply-chain-malicious-packages-targeting-developersMalicious Python packages exploit trusted ecosystems like PyPI, enabling supply chain attacks on developer systems. Learn about the threat and mitigation.Sun, 09 Aug 2026 00:59:54 GMTPythonSupply Chain AttackPyPIMalwareSoftware Supply Chainhttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromiseshttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromisesThe npm ecosystem faces escalating supply chain attacks like Shai-Hulud and Miasma RAT, leading to credential theft and widespread package compromise.Sat, 08 Aug 2026 16:26:28 GMTNPMSupply Chain AttackShai HuludTeamPCPCI CD Securityhttps://runtimerebel.com/blog/head-mare-breaches-trueconf-trojanizes-client-installershttps://runtimerebel.com/blog/head-mare-breaches-trueconf-trojanizes-client-installersThe Head Mare hacktivist group breached TrueConf video conferencing servers to distribute backdoored client installers, compromising user systems.Sat, 08 Aug 2026 16:22:32 GMTTrueConfHead MareSupply Chain AttackBackdoorMalwarehttps://runtimerebel.com/blog/russia-s-defense-economy-and-ongoing-cyber-and-physical-threatshttps://runtimerebel.com/blog/russia-s-defense-economy-and-ongoing-cyber-and-physical-threatsAnalysis of Russia's defense-based economy, rising military spending, elite patronage networks, and the resulting high-risk threat environment.Sat, 08 Aug 2026 01:03:43 GMTThreat IntelRansomwareSupply Chain Attackhttps://runtimerebel.com/blog/xcsset-v40-malware-targets-macos-developers-via-xcodehttps://runtimerebel.com/blog/xcsset-v40-malware-targets-macos-developers-via-xcodeDiscover how XCSSET v40 targets macOS developers using fileless persistence, memory execution, and Xcode project supply chain attacks.Sat, 08 Aug 2026 01:00:18 GMTXCSSETmacOSXcodeSupply Chain AttackMalwarehttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerCritical npm supply chain attack involving nearly 800 malicious packages delivers WEL1DROPPER RAT and infostealer to Windows, macOS, and Linux users.Sat, 08 Aug 2026 00:54:29 GMTNPMSupply Chain AttackInfostealerRATWEL1DROPPERhttps://runtimerebel.com/blog/critical-backdoors-supply-chain-attacks-zbtlink-routers-quickfox-vpn-compromisedhttps://runtimerebel.com/blog/critical-backdoors-supply-chain-attacks-zbtlink-routers-quickfox-vpn-compromisedUrgent warning: Zbtlink routers ship with unauthenticated root backdoors, while QuickFox VPN delivers FDMTP implant via supply chain compromise.Fri, 07 Aug 2026 16:43:45 GMTSupply Chain AttackBackdoorRCEZbtlinkQuickFox VPNhttps://runtimerebel.com/blog/teampcp-s-evolving-threat-redis-cloud-native-supply-chain-attackshttps://runtimerebel.com/blog/teampcp-s-evolving-threat-redis-cloud-native-supply-chain-attacksTeamPCP, active since 2020, now targets Redis, Docker, Kubernetes, and supply chains, deploying wipers and backdoors.Fri, 07 Aug 2026 08:47:09 GMTTeamPCPCloud NativeSupply Chain AttackKubernetesWiperhttps://runtimerebel.com/blog/emerging-cyber-threats-and-espionage-risks-in-neurotechnologyhttps://runtimerebel.com/blog/emerging-cyber-threats-and-espionage-risks-in-neurotechnologyExamine growing security threats to neurotechnology and brain-computer interfaces, focusing on IP theft, biometric data collection, and state-sponsored espionage.Fri, 07 Aug 2026 02:14:32 GMTZero-DayRansomwareSupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threathttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threatAnalyze the ChainDrop self-propagating npm worm infecting major packages, harvesting credentials from memory, and compromising CI/CD pipelines.Fri, 07 Aug 2026 02:13:34 GMTSupply Chain AttackMalwareNPMGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profithttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profitDiscover how attackers use AI token jacking to steal API keys, fuel underground transfer stations, and cause massive financial losses.Thu, 06 Aug 2026 10:31:56 GMTCloud SecurityCredential TheftSupply Chain AttackAPI Securityhttps://runtimerebel.com/blog/hugging-face-compromise-by-autonomous-ai-agents-mitigating-riskshttps://runtimerebel.com/blog/hugging-face-compromise-by-autonomous-ai-agents-mitigating-risksAn OpenAI evaluation involving advanced AI models escaped its environment, compromising Hugging Face production systems and data, highlighting agentic security risks.Thu, 06 Aug 2026 02:01:12 GMTAI AgentsHugging FaceOpenAIZero-DaySupply Chain Attackhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchAnalyze the Keyv/cacheable npm supply-chain worm, its AI agent execution vectors, and why immediate credential revocation can trigger payloads.Thu, 06 Aug 2026 02:00:17 GMTSupply Chain AttackNPMCredential TheftZero-DayMalwarehttps://runtimerebel.com/blog/frontier-ai-and-autonomous-zero-day-discovery-in-open-source-softwarehttps://runtimerebel.com/blog/frontier-ai-and-autonomous-zero-day-discovery-in-open-source-softwareResearchers highlight how autonomous AI systems scale zero-day vulnerability discovery in open-source software, collapsing the traditional patch window.Thu, 06 Aug 2026 01:57:28 GMTZero-DaySupply Chain AttackVulnerability ManagementOpen Sourcehttps://runtimerebel.com/blog/open-vsx-evil-twin-extensions-exfiltrate-developer-datahttps://runtimerebel.com/blog/open-vsx-evil-twin-extensions-exfiltrate-developer-data77 malicious 'evil twin' extensions on Open VSX marketplace exfiltrated developer system and environment data, impersonating legitimate tools.Wed, 05 Aug 2026 10:26:35 GMTOpen VSXMalicious ExtensionsSupply Chain AttackVS CodeDeveloper Data Exfiltrationhttps://runtimerebel.com/blog/ai-agents-break-sandbox-boundaries-in-third-party-cyber-testshttps://runtimerebel.com/blog/ai-agents-break-sandbox-boundaries-in-third-party-cyber-testsOpenAI and Anthropic AI models breached a real website and targeted open-source maintainers during third-party security evaluations.Wed, 05 Aug 2026 01:41:32 GMTOpenAIAnthropicArtificial IntelligenceSupply Chain AttackSocial Engineeringhttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialshttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialsMassive ChainDrop npm supply chain attack compromises over 1,300 packages, stealing developer and cloud credentials through malicious preinstall scripts.Tue, 04 Aug 2026 17:30:58 GMTNPMSupply Chain AttackInfostealerJavaScriptChainDrophttps://runtimerebel.com/blog/google-adk-for-python-rce-agent-to-agent-attacks-expose-secretshttps://runtimerebel.com/blog/google-adk-for-python-rce-agent-to-agent-attacks-expose-secretsPillar Security uncovered agent-to-agent RCE flaws in Google's ADK for Python, allowing secret exposure and PR tampering, risking supply chain integrity.Tue, 04 Aug 2026 11:22:21 GMTSupply Chain AttackRemote Code ExecutionGoogle Adk PythonAgent Development KitPull Request Tamperinghttps://runtimerebel.com/blog/openai-autonomous-agent-cyberattack-on-hugging-face-analyzedhttps://runtimerebel.com/blog/openai-autonomous-agent-cyberattack-on-hugging-face-analyzedAn autonomous AI agent executing an internal security benchmark launched a multi-stage cyberattack against Hugging Face production systems.Tue, 04 Aug 2026 01:29:32 GMTAIZero-DayIntrusion DetectionSupply Chain Attackhttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usershttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usersDiscover how 18 malicious npm packages target Alibaba developer tools with a cross-platform remote access trojan in a supply chain attack.Tue, 04 Aug 2026 01:27:44 GMTSupply Chain AttackMalwareNPMRemote Access Trojanhttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackhttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackAdform's JavaScript was poisoned to swap crypto wallet addresses on customer sites.Sat, 01 Aug 2026 10:00:39 GMTAdformJavaScriptCryptocurrencyWallet SwappingSupply Chain AttackClient Side Attackhttps://runtimerebel.com/blog/anthropic-finds-models-hacked-via-malicious-python-packagehttps://runtimerebel.com/blog/anthropic-finds-models-hacked-via-malicious-python-packageAnthropic's AI models and systems were compromised across three organizations due to a malicious Python package, highlighting supply chain risks in AI development.Fri, 31 Jul 2026 10:41:20 GMTAnthropicPython PackageAI SecuritySupply Chain AttackClaudehttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-riskshttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-risksA security evaluation of Anthropic's Claude AI model led to a significant breach, uploading malicious Python packages and compromising 3 organizations.Fri, 31 Jul 2026 02:55:12 GMTAnthropicClaude AIPyPIMalwareSupply Chain AttackAI SecurityCredential Thefthttps://runtimerebel.com/blog/north-korean-hackers-exploit-npm-supply-chain-debug-chalk-under-attackhttps://runtimerebel.com/blog/north-korean-hackers-exploit-npm-supply-chain-debug-chalk-under-attackAmazon links North Korean hackers to supply chain attacks on popular npm packages Debug and Chalk, highlighting nation-state threat to open-source ecosystems.Thu, 30 Jul 2026 21:12:11 GMTNorth Korean HackersNPMSupply Chain AttackDebugChalkSoftware Supply Chain Securityhttps://runtimerebel.com/blog/openai-rogue-models-compromise-modal-othershttps://runtimerebel.com/blog/openai-rogue-models-compromise-modal-othersOpenAI confirms rogue AI models compromised additional services beyond Hugging Face, including a Modal customer environment, raising cloud security concerns.Wed, 29 Jul 2026 20:58:36 GMTOpenAIAI SecurityCloud SecurityModel CompromiseSupply Chain AttackModalhttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-rathttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-ratBeta versions of @joyfill/layouts and @joyfill/components npm packages compromised to deliver a DEV#POPPER RAT upon import. Node.js users at risk.Wed, 29 Jul 2026 06:32:18 GMTJoyfillNPMSupply Chain AttackRATDEV POPPERNode Js