durabletask (Microsoft's Python Durable Task client) compromised by TeamPCP | same Mini Shai-Hulud payload as last week's TanStack wave

The Python Durable Task client by Microsoft, known as durabletask, has reportedly been compromised by a threat actor named TeamPCP. The compromise involves the deployment of the Mini Shai-Hulud malware payload, which was also observed in a recent attack wave targeting TanStack. The information originates from a Reddit post in the NetSec community with minimal technical details and no confirmed exploits in the wild. No affected versions or patch information are provided, and the vendor has not issued an advisory. The severity is assessed as medium based on the available data.

• reddit.com/r/netsec/comments/1tjvryy/durabletask_microsofts_python_durable_task_client/ (opens in a new tab)

• Rockstar Games has now been compromised several different ways since 2018, and none of them were a zero-dayAnalysis2026-10-06
• php2bitcoin x brotli2coin: live hacking streamNews2026-10-30
• Stopping Remote Code Execution with Sandboxes, CVE-2026-115995: Rust ZipMediumVulnerability2026-10-29
• XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077)MediumVulnerability2026-10-29
• New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accountsNews2026-10-27