Tag
News and blog posts tagged Supply Chain Security on AppSecNews.
News Cyber Attacks
Attackers used a compromised credential for the ConnectWise Cloud Backup app, formerly SkyKick, to sign in to customers' Microsoft 365 tenants. Huntress confirmed unauthorized sign-ins in 162 tenants, and ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Docker fixed CVE-2026-105445, a critical Docker Hub flaw that let a user push, pull or delete images as another user by abusing account-to-organization conversion. Docker says it found no evidence of exploitation and has deactivated the affected tokens.
Jaydeep Bhatt
News Cyber Attacks
On 8 October 2026, attackers used two compromised open-source maintainer accounts to push a fake "Security Audit" GitHub Actions workflow into 345 repositories. The workflow sends repository secrets, and credentials found anywhere in the git history, to an attacker-controlled server.
Jaydeep Bhatt