The threats don’t slow down. |
Today’s news brings millions of exposed OnlyFans identities, a GitHub outage, MSP security risks, privacy concerns… and fake AI tools spreading credential-stealing malware.
Tell us what content you want to see on TechRepublic by taking this quick survey. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Millions of OnlyFans Identities Allegedly Exposed Online |
A cybercriminal claims to be selling a 340 million-record OnlyFans database, raising concerns about large-scale identity exposure affecting creators and subscribers.
Researchers found inconsistencies suggesting the alleged OnlyFans dataset may largely contain recycled breach data and scraped profiles. |
If legitimate, the data could enable phishing, doxxing, impersonation, and account takeover attempts by linking usernames, emails, and social accounts. Monitor for credential reuse, remove unnecessary public profile linkages, and use separate email addresses and MFA for sensitive or pseudonymous online accounts. |
GitHub Outage Breaks DevOps Pipelines |
Developers worldwide faced stalled deployments and failed automation workflows after GitHub suffered a major outage impacting GitHub Actions and GitHub Pages. GitHub authentication failures disrupted CI/CD pipelines and delayed deployments across enterprise and open-source environments. This incident has renewed discussions around operational resilience and single points of failure within DevOps ecosystems.
Organizations should maintain backup CI/CD workflows, self-hosted runners, and test incident response plans to reduce operational disruption during third-party platform outages. |
ConnectWise Flaw Exposes MSP Environments |
ConnectWise disclosed an Automate RMM vulnerability that could let attackers bypass integrity checks and execute malicious code.
The flaw affects on-premises ConnectWise Automate versions before 2026.5 and could enable attackers to compromise MSP and enterprise environments through malicious plugin or update activity. No exploitation has been reported and a patch has been released in the latest version.
Patch affected systems, isolate RMM infrastructure from production networks, and monitor for unusual plugin activity or unauthorized agent updates. |
|
|
|
Resilience Check: If a critical third-party platform failed tomorrow… |
|
|
|
Yesterday's Pulse Check Results |
Cybercrime Sentencing Check: Should bigger attacks mean bigger penalties? |
|
|
|
Security Tools You Can Use |
|
|
|
WhatsApp Storage Claims Raise Privacy Concerns |
Researchers claim some WhatsApp chat data on macOS and iOS may be stored in readable local database files, raising endpoint privacy concerns. While some researchers disputed claims of broad cross-app access, others warn that compromised devices, insecure backups, or operating system flaws could still expose readable local data. |
Their concern is less about WhatsApp’s end-to-end encryption in transit and more about how decrypted messages are stored locally on endpoint devices.
Organizations should enforce encrypted backups, strong device access controls, rapid OS patching, and mobile device management policies that limit sensitive messaging data exposure on corporate Apple devices. |
Fake AI Installers Spread Credential-Stealing Malware |
Threat actors are using SEO poisoning to impersonate Gemini CLI and Claude Code installers, tricking developers into running malicious PowerShell commands that deploy fileless infostealer malware.
The infostealer targets OAuth tokens, CI/CD credentials, VPN details, and session cookies from platforms like Slack and Microsoft Teams, while researchers identified more than 30 related malicious domains impersonating popular developer tools. The campaign remains active in the wild at the time of publication.
Monitor for suspicious PowerShell activity, enforce PowerShell Constrained Language Mode, and require phishing-resistant FIDO-based authentication for privileged developer accounts. |
|
|
|
AI is moving faster than security teams can keep up—59% say AI risks outpace their expertise. See how organisations are navigating this gap, and what early adopters are doing to stay ahead. |
|
|
|
Is AI Making Exploits Easier? |
AI and tools like Mythos are accelerating how vulnerabilities are discovered and weaponized, helping attackers find weaknesses and generate exploits faster than ever. |
How to reduce risk from AI-powered threats: |
- Use continuous vulnerability scanning, attack surface management, and penetration testing tools to identify exposed assets, misconfigurations, and exploitable weaknesses before attackers do.
- Accelerate patch management and monitor threat intelligence feeds to reduce exposure windows and stay ahead of emerging AI-assisted exploitation campaigns.
-
Deploy behavior-based EDR/XDR detection tools and train developers to recognize insecure AI-generated code and suspicious activity patterns that traditional defenses may miss.
|
As AI-driven attacks become more automated, organizations should focus on improving visibility, accelerating patch cycles, improving detection capabilities, and leveraging zero trust solutions. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
