Today’s news covers compromised developer ecosystems, AI reality checks, boardroom blind spots, nation-state supply chain attacks, and a crypto flaw with an $88.6 million price tag.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
GitHub Breach Sparks Massive npm Supply Chain Attack |
A compromised GitHub maintainer account triggered a large supply chain attack. Using legitimate GitHub Actions workflows, attackers published malicious versions of widely used npm packages. |
Organizations using affected packages should treat development environments as potentially compromised and rotate credentials.
Identify affected package versions, rotate all potentially exposed credentials, review GitHub Actions and CI/CD activity for unauthorized changes, and rebuild compromised development environments from trusted images. |
AI Benchmark Scores Tell Half the Story |
New research presented at BSides 2026 suggests that traditional LLM benchmark scores reveal surprisingly little about how AI agents actually perform during offensive security tasks.
Research showed many AI agent failures stemmed from execution errors rather than knowledge gaps, with leading open-weight models nearly matching frontier closed models. The research showed AI agents rely more on pattern recognition than traditional penetration testing, making behavioral telemetry more insightful than benchmark scores.
Supplement AI benchmark results with behavioral testing before deploying the tools into production. |
Amazon Links npm Attacks to North Korea |
Amazon linked four npm supply chain attacks to North Korea's Sapphire Sleet, showing how compromised maintainer accounts can weaponize trusted software updates.
The yearlong campaign targeted developers behind widely used open-source packages rather than vulnerabilities in the code, allowing malicious updates to appear legitimate. These findings reinforce that software supply chain security requires protecting trusted maintainer accounts alongside scanning code.
Use DevSecOps tools to monitor dependencies while protecting maintainer accounts with phishing-resistant MFA, least privilege, and version pinning. |
|
|
|
Discover self-managing endpoints without compromise. Grounded in reliable data. Faster than threat actors. Driven by AI, controlled by you. Explore how your organization can achieve endpoint autonomy without compromise. |
|
|
|
Black Hat 2026: CISOs Face Board Communication Gap |
New research unveiled for Black Hat 2026 suggests the biggest barrier to effective board cyber risk reporting is governance, not communication skills.
Pulse Security's report found that 55% of organizations lack a defined cyber risk appetite, while most security leaders spend more than 10 hours preparing each board report. |
These findings suggest that stronger governance and business-focused reporting are essential to improving board understanding of organizational cyber risk. Define a formal cyber risk appetite and establish business-focused reporting metrics before the next board meeting so security discussions consistently support risk-based decision-making rather than just technical status updates. |
Coldcard Vulnerability Linked to $88.6M Bitcoin Theft |
Researchers say a Coldcard firmware flaw may have weakened Bitcoin wallet seeds, potentially enabling attacks linked to suspected thefts totaling $88.6 million.
Affected firmware used a deterministic pseudorandom number generator instead of the device's hardware random number generator, reducing seed entropy for some wallets. While not every suspected theft has been validated, affected users should generate a new seed after updating, as installing patched firmware alone does not eliminate the risk.
If you generated a Coldcard wallet on an affected firmware version, install the patched firmware, create a brand-new seed, verify it with a small test transaction, and migrate your funds as soon as possible. |
|
|
|
Are You Managing AI Risk? |
AI is accelerating innovation while expanding organizational risk, making disciplined governance, visibility, and security controls essential for effective AI risk management. |
How to strengthen AI risk management: |
- Maintain an inventory of AI applications and agents, classify approved data usage, and implement governance policies to reduce organizational AI risk.
-
Continuously monitor AI activity for suspicious behavior while requiring human review before high-risk outputs or automated actions affect production.
- Regularly test incident response plans for compromised models, prompt injection, and data leakage to improve resilience and accelerate recovery.
|
AI introduces new operational and security considerations, making governance, monitoring, and validated response procedures essential components of enterprise risk management. |
|
|
|
Security Tools You Can Use |
|
|
|
AI Pen Testing Check: Where's your team today? |
|
|
|
Yesterday's Pulse Check Results |
How concerned are you about AI accelerating cryptographic attacks? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
