Mini Shai-Hulud campaign hits 323 npm packages, GitHub Actions and VS Code tools.

ShinyHunters hit Canvas twice, exposing student data via XSS and identity compromise.

Teams warn the latest Shai-Hulud wave weaponizes trusted OIDC tokens to bypass package integrity checks.

SailPoint says GitHub repo breach exposed no customer data or production systems.

Nearly 9 in 10 security leaders struggle with identity sprawl as AI and NHIs expose governance gaps.

The Pheno plugin monitors active Phone Link connections to eavesdrop on texts and notifications.

Flaw in Entra ID AI agent role enabled privilege escalation and takeover.

The malicious extensions inject iframes to display phishing content and extract other data.