SubcloakHeadlines

Cloak WatchSubcloak

Subcloak Headlines

Latest

  1. MediumConfirmedDocker

    Docker Hub flaw let converted accounts hand personal access tokens to another user

    A now-fixed Docker Hub flaw let a token act as someone else at the registry. Docker found no exploitation. Only users Docker emailed were exposed; check your tokens and revoke any you don't recognize.

  2. HighDevelopingmacOS

    OpenCode says its hosted Console was breached, exposing some users' AI provider keys

    OpenCode says 1.4% of Console users with linked Anthropic, OpenAI or Google accounts were hit. If you got its email, replace those keys, update your apps and check usage and billing. No email means not affected, it says.

  3. HighDevelopingOpen VSX

    Fake Solidity and Hardhat extensions on Open VSX install backdoor on Macs, Pluto says

    Pluto Security says fake Solidity tools on Open VSX drop a backdoor on Macs. If you installed any of four listed extensions, treat the machine as compromised, disconnect it and rotate credentials, wallet keys first.

  4. HighConfirmedGitHub Actions

    GhostAction wave plants secret-stealing fake security workflows in GitHub repositories

    Attackers with hijacked GitHub accounts pushed a fake security-audit workflow that sends secrets, including from git history, to a bare IP. Check your repos and account activity, then revoke the pushing credential and rotate secrets.

  5. CriticalConfirmednpm

    Tensorlake npm package version 0.5.144 hijacked to ship credential-stealing worm

    A poisoned tensorlake 0.5.144 ran malware at npm install. If you installed it, remove the token monitor first, then rotate npm, GitHub, SSH and cloud credentials. Version 0.5.143 is clean.

  6. HighConfirmedPHP

    PHP2Shell: two critical PHP engine flaws patched after disclosure leaked early

    Two unauthenticated remote code execution flaws in PHP are fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Update every PHP install and image, restart workers. Servers are at highest risk; most developer Macs less so.

  7. HighConfirmedmacOS

    Eight eMudhra intermediate CA keys exposed; browsers block them, other tools may not

    Weakly generated keys let anyone forge certificates. Browsers block the intermediates, but Mac command-line tools and runtimes may still trust them. Update them and rebuild Go programs.

  8. CriticalConfirmedPyPI

    LiteLLM 1.107.0 hijacked on PyPI and Docker, shipping a credential stealer

    A poisoned LiteLLM 1.107.0 was published to PyPI and Docker on 21 October. If it was installed anywhere Python ran, treat that environment as compromised, remove the payload files, pin 1.106.2 and rotate secrets.