Red Hat's official npm packages were poisoned with a self-spreading credential worm. Here is what happened.

Red Hat's official npm packages were poisoned this morning with a self-spreading credential worm.

This one broke today. On June 1, 2026, researchers at Wiz and Socket confirmed that over 30 official packages under the @redhat-cloud-services scope on npm — the Node Package Manager registry used by millions of developers — were compromised with a credential-stealing worm called Miasma.

Miasma is a new variant of Mini Shai-Hulud — a supply chain malware toolkit that was open-sourced by the threat group TeamPCP. The fact that the tooling is now publicly available means any threat actor can deploy it. Attribution is harder. The attack surface is wider.

Here is what makes Miasma different from a standard malicious package: it is a worm — meaning it spreads itself. Once installed on a developer machine, it enumerates repositories the victim's tokens can write to and republishes backdoored versions of those packages to infect downstream users. It also checks for endpoint protection from CrowdStrike, SentinelOne, and Carbon Black before executing, and establishes persistence by injecting hooks into development tools including VS Code projects.

The compromised packages were downloaded approximately 80,000 to 116,000 times per week. Most malicious versions have been revoked as of this afternoon, but the window was open.

Immediate action if your team uses these packages: If anyone on your development team installed any @redhat-cloud-services npm package version since June 1, treat all CI/CD secrets, cloud credentials, SSH keys, and npm tokens as compromised and rotate them immediately. Do not wait to confirm infection — rotate first.

Attackers are exploiting Microsoft Defender itself. Two zero-days, actively confirmed, CISA deadline tomorrow.

Microsoft Defender is the antivirus and endpoint protection software running on hundreds of millions of Windows devices globally — in enterprises, government agencies, hospitals, and small businesses. This week, CISA confirmed that two vulnerabilities in Defender itself are being actively exploited in the wild.

CVE-2026-41091 (CVSS 7.8) — Privilege Escalation. A flaw in the Microsoft Malware Protection Engine allows an attacker who already has low-level access to a Windows device to escalate their privileges to SYSTEM — the highest level of access on a Windows machine. From SYSTEM, an attacker can disable security controls, install persistent malware, and move laterally across the network.

CVE-2026-45498 (CVSS 4.0) — Denial of Service. This flaw can be used to crash or disable Microsoft Defender entirely, silencing the endpoint protection layer before a follow-on attack executes. A lower severity score does not mean lower operational impact — disabling the security tool is often the first step before deploying ransomware or exfiltrating data.

Both have been added to CISA's Known Exploited Vulnerabilities catalog. Federal agencies must remediate by June 3 — tomorrow. Both are patched in Microsoft Defender Antimalware Platform version 1.1.26040.8. Most Windows devices receive Defender updates automatically, but managed environments, offline systems, and servers with deferred updates need manual verification.

The bigger point: When the security tool is the target, the entire detection layer is at risk. Attackers who can disable Defender before executing their payload effectively go dark. This is why defense-in-depth — multiple overlapping layers of security rather than reliance on a single tool — is not a theoretical best practice. It is a practical operational requirement.

Palo Alto firewalls are being exploited in the wild. CISA ordered federal agencies to patch by today.

CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS — the operating system that runs Palo Alto firewalls, one of the most widely deployed enterprise network security platforms in the world. Successful exploitation allows an unauthenticated attacker to bypass security restrictions and establish a VPN connection directly into the internal network.

Palo Alto disclosed the flaw on May 13 with a medium-severity rating. Rapid7 then confirmed active exploitation across multiple customers starting May 17 — four days after disclosure. CISA immediately added it to the Known Exploited Vulnerabilities (KEV) catalog and ordered all Federal Civilian Executive Branch agencies to patch by June 1, 2026. Today.

Rapid7 documented two distinct exploitation waves — one beginning May 18 from infrastructure hosted by Vultr, a second on May 21 from a different hosting provider. In both cases, attackers used forged authentication override cookies to authenticate to GlobalProtect gateways and establish unauthorized VPN tunnels. Once inside, they had network-level access equivalent to any legitimate employee.

The speed issue: Four days from disclosure to active exploitation in the wild. This is the current operational tempo of threat actors monitoring CVE publications. The window between "patch available" and "actively exploited" is measured in days, not weeks. If your patching cycle operates on a monthly or quarterly schedule, you are structurally behind.

The flaw specifically affects firewalls where GlobalProtect portal or gateway has authentication override cookies enabled. If you manage Palo Alto infrastructure, confirm that configuration and patch immediately if you have not already.

GitHub was breached through a VS Code extension. 3,800 internal repositories were exfiltrated.

GitHub has confirmed a breach of its internal repositories. The entry point was not a vulnerability in GitHub itself — it was a malicious version of the Nx Console extension for Microsoft Visual Studio Code (VS Code), the most widely used code editor in the world. TeamPCP, the same threat group behind the Mini Shai-Hulud tooling used in the Red Hat attack above, is attributed with the compromise.

Approximately 3,800 internal GitHub repositories were exfiltrated. The scope of what those repositories contained has not been fully disclosed, but internal source code repositories at a company like GitHub could expose proprietary tooling, internal security controls, and infrastructure configurations that inform follow-on attacks.

This is the same attack pattern as the Trellix breach reported two weeks ago: compromise the development environment, not the production environment. A developer's machine, their code editor, their installed extensions — these are soft targets with enormous access. VS Code extensions run with the same privileges as the developer who installed them, with access to files, environment variables, and credentials stored locally.

The lesson for security teams: Developer endpoints are as high-value as servers and deserve the same scrutiny. Extension management policies, code signing requirements, and developer endpoint detection are not optional hardening measures in 2026 — they are the attack surface.

ShinyHunters just hit one of the largest telecoms in America. Charter refused to pay. Here is what happened.

If you have been following this newsletter, you know this group. ShinyHunters appeared in Issue #002 when they breached Rockstar Games through Anodot. They appeared in Issue #003 when they hit McGraw-Hill. This week they claimed Charter Communications — one of the largest telecommunications companies in the United States — and leaked 40 million records after Charter refused to pay.

The group claims the attack took place on April 1, 2026 through a voice phishing — vishing — campaign. Vishing is a social engineering attack conducted over the phone, where an attacker impersonates a trusted party to extract credentials or access. Charter has confirmed a data breach and is notifying customers. The leaked data reportedly includes names, addresses, account numbers, and other personally identifiable information from both consumer and business customers.

Forty million records from a single telecom breach is not a number to absorb casually. Telecommunications companies hold some of the most sensitive data in existence — account credentials, billing addresses, call records, and in many cases the phone numbers tied to multi-factor authentication (MFA) for financial accounts. When that data gets out, the downstream exposure for individual customers extends far beyond Charter itself.

The pattern worth naming: ShinyHunters has now been attributed to confirmed breaches of Rockstar Games, McGraw-Hill, Instructure/Canvas, and Charter Communications — all within a four-month window. The Huntress threat library confirmed the group remains active and operational as of this week, with law enforcement largely unable to neutralize its decentralized leadership structure. Arrests of affiliates in France last year did not slow the operation at all.

Why telecoms matter for everyone: If you or your clients use SMS-based MFA — meaning a code gets texted to your phone — a telecom breach of this scale is a SIM swapping risk multiplier. Attackers with account data can call a carrier, impersonate the customer, and redirect their phone number to an attacker-controlled device. From there, every account protected by that phone number is exposed. This is the argument for moving away from SMS-based MFA toward authenticator apps or hardware keys.