TLDR INFORMATION SECURITY 2026-09-25

secure and under control

* The KPIs and trade-offs that matter when AI, not humans, drives development See how they built it, what they learned, and how it changed the way they develop software.

Reserve your spot

GRAPHALGO CAMPAIGN SPREADS TO TERRAFORM PROVIDERS AND GO MODULES

Graphalgo malware appeared in two Terraform providers and two Go modules. Trigger conditions hide execution until targeted inputs appear, and the payload reports host data through Slack, receives encrypted commands through Slack and an Arbitrum Sepolia contract, then runs Go or Node code. Aikido recommends removing affected packages, isolating exposed hosts, rotating credentials, reviewing deployments, and reimaging machines.

GITLAB EMAIL ADDRESSES CAN BE WEAPONIZED FOR SUPPLY CHAIN ATTACKS

GitLab incoming email addresses embed non-expiring tokens that act as the owner across accessible projects. A leaked address can create merge requests, submit patches, or push code to private projects after changing project identifiers, and can be used to bypass IP restrictions via email. Aikido recommended that organizations reduce their attack surfaces by preemptively rotating the access tokens in their GitLab email addresses and by scanning for these addresses in their development environments and repositories as if they were any other secrets.

PLACEHOLDER THIRD-PARTY[.]COM REFERENCED ACROSS 1,700+ REPOSITORIES NOW SERVES MALICIOUS CONTENT

Someone registered third-party[.]com, a non-IANA-reserved placeholder cited in 1,700+ GitHub repos, including AI agent skills and MCP docs, and it now serves a ClickFix PowerShell lure only to Windows visitors, while yoursite[.]com and your-domain[.]com push scams to macOS users that static scans miss.

PHANTOMRAVEN: AN LLM-GENERATED INFORMATION STEALER DEVELOPED FOR BUG BOUNTY HUNTING

A bug bounty hunter built PhantomRaven, an LLM-generated JS info-stealer, and pushed it through typosquatted npm packages that used HTTP-URL dependencies to fetch payloads on install. It grabs OS/hostname/IP data, Git/npm credentials, and CI/CD env vars from GitHub Actions, GitLab CI, Jenkins, and CircleCI, then sends data via HTTP GET/POST. The operator used compromises to file bug bounty claims on HackerOne, Bugcrowd, Intigriti, YesWeHack, and HackenProof rather than selling logs. Npm 12+ now blocks preinstall scripts by default. Use --ignore-scripts and a private registry to block this vector.

HACKING AI CUSTOMER SERVICE AGENTS

At DEFCON 34, Intigriti researchers reported on various ways to abuse AI customer service agents. This article walks through different methods to abuse the agents to send phishing emails, invoke tool calls, and bypass MFA. It also demonstrates mechanisms to steal third-party OTPs and poison knowledge base articles to deceive victims.

CARBONATO: A BOTNET BUILT AROUND AN AI AGENT

CARBONATO worms through unauthenticated Docker daemons on port 2375 via privileged, host-mounted containers, then installs the stock open-source Hermes Agent and overwrites its SOUL.md persona so that Telegram-tasked LLM sessions run post-exploitation and loot AI API keys before SSH credentials. ThreatDown recovered the toolkit from the crew's own open registry, which doubles as the fleet's update server, and ties the operators to Costa Rica through voseo Spanish, UTC-6 build timestamps, and a +506 Telegram handle. Keep the Docker API off the network, hunt for a SOUL.md containing "GH0ST" rather than blocklisting the legitimate hermes-agent package, and inventory and rotate AI API keys like bank credentials.

ISLAND (PRODUCT LAUNCH)

Island runs an enterprise browser and SASE platform combining ZTNA, device posture checks, and inline DLP to block unapproved clipboard, download, and screen-capture actions.

CEASTA

ceasta is a single C++ tool that combines an IDA-style disassembler, a pseudocode decompiler, a function graph, and an x64dbg-style debugger for PE, ELF, and raw shellcode, with a full GUI on Windows and a CLI with a ptrace debugger on Linux. Its built-in MCP server (ceasta-cli mcp target.exe) lets Claude Code or Cursor decompile, rename, and diff builds. With --allow-debug, it can also set breakpoints and call functions in the running process. The decompiler is best-effort, with no types or structs yet.

INTRODUCING THE PIXI AUDIT BETA

Pixi Audit, now in beta, scans Pixi lock files for vulnerable conda-forge and PyPI packages, and --fix bumps direct dependencies to the lowest compatible fixed version before re-running pixi update. Matching relies on Basilisk, prefix.dev's new conda-forge vulnerability database, which links repackaged conda-forge builds to their upstream PURL and CPE identities so existing OSV and NVD advisories apply. For CI, --severity high sets the failure threshold, with JSON and SARIF output, though it doesn't cover statically linked binaries yet.

OPENAI AGENTS ‘INFILTRATED AUSTRALIAN GOVERNMENT WEBSITE'

An OpenAI agent gained unauthorized access to a Medicare statistics portal in June. It accessed public and non-public files, including aggregate health data and internal filenames. Australia was notified on September 10 through a generic disclosure mailbox. Officials later said agents also targeted two state-government sites.

BRIEF HIJACK MAKES ELSEVIER DOMAINS REDIRECT TO LAPSUS$ “CHAPTER II” PAGE

Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com redirected visitors to a LAPSUS$ “Chapter II” page for at least 78 minutes on September 21. Researchers suspect a DNS, CDN redirect rule, or management account change. Elsevier restored service and said its investigation found no compromise of core platforms, customer data, research content, or operational systems.

PROACTIVE DEFENSE: HARDENING CODE PIPELINES AND CI/CD INFRASTRUCTURE

Mandiant published a five-pillar blueprint (endpoint, repositories, artifacts, CI/CD, and deployment) for hardening the SDLC, prompted by campaigns that poison GitHub Actions caches, extract OIDC tokens, and repoint mutable action tags to publish malicious packages that still carry valid provenance. Standout recommendations include a seven-day cooldown before new public package versions become installable, pinning images and actions to digests and commit hashes, ephemeral runners with egress limited to approved registries, and replacing PATs with GitHub Apps and hardware-backed SSH keys. It also addresses AI coding agents, advising teams to keep .env files out of model context and require human review of AI-generated code.

ASTRANA HEALTH DATA BREACH IMPACTS PRIVATE, CONFIDENTIAL INFORMATION

Attackers spoofed Astrana Health's main phone number and impersonated staff to access company servers.

ACCELERATING DELIVERY OF CVE FIXES WITH A NEW KERNEL RELEASE STRATEGY

Canonical is replacing Ubuntu's 4-week regular and 2-week security kernel SRU cycles with overlapping 2-week cycles that ship a kernel every week.

CISA: RANSOMWARE GANGS NOW EXPLOITING CRITICAL TEAMCITY FLAW

CISA has flagged CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity On-Premises reachable through the agent polling protocol, as exploited in ransomware attacks.