Novee found a pattern of CI/CD vulnerabilities in GitHub Actions workflows that let any unauthenticated user hijack build pipelines, steal credentials, or push malicious code. They scanned 30,000 repositories and confirmed over 300 fully exploitable cases at Microsoft, Google, Apache, Cloudflare, and others. AI coding agents are accelerating the spread of these insecure YAML patterns, putting millions of projects at risk.

• Novee scanned 30,000 repos, flagged 654 with the vulnerable pattern, and confirmed 300+ fully exploitable chains—including at Microsoft, Google, Apache, and Cloudflare.
• Unauthenticated attackers with just a free GitHub account can trigger workflows via PRs or comments to hijack maintainer permissions, steal tokens, or push malicious code.
• Real exploits included stealing a non-expiring GitHub App key from Azure Sentinel, gaining GCP project owner access via Google's AI Agent Dev Kit, and executing arbitrary commands on Cloudflare's CI runners via a crafted branch name.
• AI coding agents are mass-replicating these insecure YAML patterns, and traditional scanners miss them because they treat workflows as config rather than executable code.

This daily digest covers a mass credential harvest via FortiBleed targeting FortiGate firewalls, new backdoors like ModeloRAT and Mistic tied to ransomware brokers, and critical data-exposure flaws in platforms such as Dify AI. It also highlights supply-chain risks in open-source CI/CD workflows, Anthropic’s Mythos model uncovering classified-system weaknesses, and industry moves on AI-driven SecOps and network-layer virtual patching.

• FortiBleed brute-forced 430,000+ FortiGate firewalls since February, harvesting over 110 million credentials across 24 protocols for resale
• Four critical Dify AI flaws (CVE-2026-41947 to -41950) let any console user read other tenants' chats, files, and internal APIs; patched in 1.14.2
• ModeloRAT and diskless Mistic backdoors tied to the Woodgnat access broker use signed pythonw.exe and DLL sideloading to evade detection
• Cordyceps research found 300 CI/CD exploit chains across 30,000 GitHub Actions workflows letting free-tier accounts steal tokens and taint builds at Microsoft, Google, Apache, and Cloudflare

This digest covers a range of InfoSec news, from a Salesforce data theft via a compromised Klue integration and a mass phishing campaign impersonating Boots, to the discovery of GlassWASM WebAssembly malware hidden in trojanized Open VSX extensions. It also highlights red-teaming honey pot detection, recent ASUS driver CVEs, a Dropping Elephant loader chain, and Homebrew 6.0’s new security features.

• Compromised Klue OAuth tokens let the Icarus extortion group siphon Salesforce data via ~1,000 API calls in 15-minute bursts over a full day
• Romanian phishers spoofed a Boots "free sample" campaign, hitting ~9 million customers via a hacked Bolivian government checkout page and a compromised UK mail server
• GlassWASM malware hides in trojanized Open VSX extensions (ExarGD.vsblack, noellee-doc/flint-debug), using a Solana wallet to fetch encrypted C2 addresses for second-stage payloads
• Homebrew 6.0 adds default Bubblewrap sandboxing on Linux, a tap-trust opt-in system, and an OSV-based `brew vulns` vulnerability scanner

Researchers found five malicious skills on ClawHub—OpenClaw’s AI skill marketplace—delivering macOS infostealers, evading scanners with file padding, and using novel agentic affiliate and front-running schemes. Despite VirusTotal and ClawScan integration, these skills slipped through until researchers reported and had them removed. ClawHub now works with NVIDIA and Palo Alto Networks to strengthen screening and analysis.

• Even after ClawHub added VirusTotal and ClawScan screening, five malicious skills still slipped through as of the April–May review, including macOS infostealers, a scanner-evading padded package, and two that manipulated the agent itself for financial gain (affiliate link injection and trade front-running).
• The "cluw" infostealer delivered via fake TradingView assistants passed ClawHub's automated audit (marked "Pass" or left unrated), showing the scanning pipeline's blind spots.
• Independent researchers found much broader contamination: Bitdefender flagged 17% of early skills as malicious, Koi Security identified 341 bad packages, and Trend Micro linked campaigns to the established Atomic macOS Stealer (AMOS).
• ClawHub only removed the five skills and banned accounts after external researcher notification, then brought in NVIDIA for code-behavior analysis on new submissions going forward.

A heap out-of-bounds write in FFmpeg’s MagicYUV decoder (CVE-2026-8461) lets attackers trigger denial-of-service or, if ASLR is disabled or chained with another bug, achieve remote code execution on Jellyfin, Nextcloud and other apps that use libavcodec. The issue affects video files in AVI, MKV and MOV formats and has been fixed in FFmpeg 8.1.2; users should update or block the decoder to stay safe.

• JFrog achieved full RCE on Jellyfin 10.11.9 just by dropping a malicious MagicYUV AVI file into its media library, triggered automatically by ffprobe scanning.
• The bug (CVE-2026-8461, severity 8.8) hits any app using libavcodec with MagicYUV enabled—Kodi, Emby, Nextcloud, PhotoPrism, OBS, GNOME/KDE/XFCE thumbnailers—making it a broad supply-chain risk across hundreds of projects.
• Exploitation requires ASLR to be disabled or chaining with another bug (e.g., an info-leak in FlashSV), but torrent-seeded files into watched folders can trigger it with zero user interaction.
• Fixed in FFmpeg 8.1.2 and adopted by Jellyfin, but Nextcloud isn't patching since its FFmpeg use falls outside core code, and Plex was never at risk due to its stripped-down decoder set.

JFrog’s new Claude Code plugin embeds security and governance directly into AI-assisted development. It checks dependencies, enforces policies, and routes all artifacts through Artifactory and Agent Guard so AI-generated code meets your organization’s supply chain rules in real time.

• JFrog's Claude Code plugin blocks unapproved/vulnerable npm, Maven, PyPI, and Go packages at suggestion time via Curation policy checks, before code ever downloads them.
• All artifacts route through Artifactory, preserving build provenance and access controls instead of relying on manual CI/CD review.
• Agent Guard restricts Claude Code to only vetted MCP servers, authenticated via OAuth or API keys.
• JFrog plans to extend the same model to GitHub Copilot, Cursor, and other coding agents, aiming for one unified record of artifacts and AI assets across tools.

Vercel confirmed that attackers gained access by exploiting a compromised Context.ai Google Workspace OAuth app, then pulled non-sensitive environment variables and escalated privileges. The hacker claims to be selling API keys, source code, deployment data and employee records; Vercel has tightened its dashboard controls, urged secret rotation and marked sensitive variables for encryption.

• Breach originated from a Vercel employee's Google Workspace being compromised via a third-party app (Context.ai), not a direct Vercel exploit.
• Only non-sensitive, unencrypted environment variables were exposed because they weren't marked "sensitive"; core products like Next.js and Turbopack were unaffected.
• A hacker claiming to be ShinyHunters is selling access keys, source code, database dumps, and employee data (580 records with names/emails), though the real ShinyHunters have denied involvement and BleepingComputer hasn't verified the leak.
• Vercel responded by adding a dashboard toggle to mark and encrypt sensitive variables and is urging customers to rotate secrets immediately.

This article covers highlights from a podcast conversation about recent advancements in AI models, particularly Google's new vision-capable LLMs. It discusses technical features like parameter efficiency and multi-modal capabilities, as well as ongoing challenges in running local models effectively.

• Google released Gemma 4 reasoning models (2B–31B params), with the E2B/E4B variants using Per-Layer Embeddings to boost on-device efficiency without growing total parameter count, and all versions handle text, images, and audio.
• Willison's hands-on testing found the smaller Gemma models worked well but the largest 31B model repeatedly errored out.
• A supply chain attack hit the Axios HTTP client via a malicious npm dependency, underscoring open-source package security risks.
• Willison argues efficient code will dominate AI deployment due to economic incentives, based on his experience running these models locally versus via Google's AI Studio API.