Meta experienced a security breach where hackers accessed some of its GitHub repositories using stolen employee credentials. Approximately 1,500 individuals, mostly Meta employees in the United States, had their personal data and business-related software code exposed. The personal data was mistakenly stored in the repositories against company policy, and much of it was synthetic or anonymized test data. Meta's internal systems were not breached, and the incident was not due to a vulnerability in Meta products. The company has taken steps to rotate secrets, enhance security controls, and prevent user data from being stored on GitHub in the future.
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
CVE-2026-109410 is a medium severity vulnerability in macrozheng mall version 1.0.3 dcaa93b. It involves an incorrect calculation in the OmsOrderServiceImpl.updateMoneyInfo function within the mall-admin/mall-portal component. The vulnerability can be exploited remotely but requires high privileges and user interaction. The vendor has not provided a patch or explanation, and the GitHub issue related to this vulnerability was deleted without comment.
CVE-2026-109407 is a low-severity race condition vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves the Coupon Redemption component's /order/generateOrder file, where manipulation of the couponId argument can trigger the race condition. Exploitation requires high complexity and is assessed as difficult. No official patch or remediation guidance is available, and the vendor has not provided explanation after deleting the related GitHub issue.
CVE-2026-109406 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves business logic errors in the OmsPortalOrderServiceImpl function within the /order/generateOrder component. The vulnerability arises from manipulation of the coupon_amount and pay_amount arguments, which can be exploited remotely. No official patch or remediation guidance is currently available, and the vendor has not provided further information, having deleted the related GitHub issue without explanation.
The npm package @chatest/baileys versions 4.4.0 and 4.4.1 includes a dependency on an unpinned GitHub repository (libsignal-node) that can execute arbitrary code during installation. The package is branded inconsistently, suggesting potential impersonation. Installing this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
GitHub has introduced a new feature that attaches a durable, authenticated pusher identity to every commit, separate from the author and committer metadata. This feature includes a new repository rule condition, "Committer must match pusher," which can block pushes where the committer metadata does not match a verified email address of the authenticated pusher. This enhancement improves auditability and helps detect suspicious pushes or compromised accounts. The feature is currently in limited public preview for GitHub Enterprise customers and is not enabled by default.
The luoxy-baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically subscribes the user's authenticated WhatsApp account to certain WhatsApp Channels (newsletters) chosen by the publisher. This auto-subscription occurs without explicit user consent, triggered 90 seconds after a WhatsApp connection is established. The list of channels to follow is partially hardcoded and partially fetched at runtime from a publisher-controlled GitHub URL, allowing dynamic modification of subscribed channels. The package does not exfiltrate credentials or install persistent backdoors, but it covertly inflates the publisher's channel subscriber counts. This behavior is enabled by default and undocumented except for a comparison table in the README. A user can opt out by setting a configuration flag to false.
The hridoy-ultimate npm package version 8.0.0 is an unofficial Facebook chat client containing malicious behaviors. It forwards user Facebook credentials and 2FA secrets to a hardcoded third-party server, exposing user accounts to full compromise. Additionally, it dynamically pulls and executes code from an unpinned GitHub repository during installation, allowing arbitrary code execution without integrity checks. A remote-control WebSocket client is present but opt-in and gated by configuration.
The orderly-plugin-liquidity-heatmap npm package is a malicious supply-chain threat that activates only within GitHub Actions CI environments. It exports a non-functional stub but runs a postinstall script that collects sensitive CI runner metadata, enumerates environment variables related to GitHub Actions, captures the presence and length of the GITHUB_TOKEN, and abuses the workflow's OIDC token to access GitHub identity services. The collected data is written into the repository workspace, potentially allowing unauthorized commits and force-pushes using persisted credentials. This behavior effectively compromises the CI pipeline and can lead to full system compromise on machines where the package is installed.
A vulnerability in the github.com/moby/sys/user package version 3.0 allows for a possible denial of service (DoS) due to unbounded parsing of user and group database files. This could lead to resource exhaustion when processing these files.
### Impact
Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server.
All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and earlier are not. The behavior was introduced in [9b27aeb1a4](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) (2024-01-09, [#15864](https://github.com/argoproj/argo-cd/pull/15864)), the change that added SOCKS5 proxy support for SSH Git URLs, and was first released in v2.11.0.
The repository must use SSH. `http`, `https`, and `socks5` proxy URLs all take this path when they are set on an SSH repository. An HTTPS Git repository uses the proxy as an HTTP proxy and does not build this command.
Anyone who can create or update a repository or a repository credential template can set the proxy. That includes a project-scoped repository permission, `argocd repo add --proxy`, and a repository Secret. A credential template applies its proxy to every matching SSH repository that does not have its own credentials. Argo CD runs the command when it tests the repository connection and on later fetches. The process can read other Git, Helm, and OCI credentials stored for the repo-server.
### Patches
A patch for this vulnerability has been released in the following Argo CD versions:
* v3.6.0-rc2
* v3.5.4
* v3.4.10
* v3.3.15
The fix stops passing the proxy host and port through a shell.
Argo CD 2.x and 3.0 through 3.2 are out of support and will not receive a patch. Upgrade to a patched 3.3 or newer release.
### Workarounds
There is no setting that keeps SSH repository proxies and removes the shell command.
* Do not grant repository create or update to untrusted users, including project-scoped repository access. See [RBAC resources](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-model-structure) and [project-scoped repositories](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters).
* Do not set a proxy on an SSH repository or on a credential template that matches SSH repositories. The proxy field is documented in [Configure repositories with proxy](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#configure-repositories-with-proxy). Credential templates are documented in [Credential templates](https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/#credential-templates). The `--proxy` flag is documented in [`argocd repo add`](https://argo-cd.readthedocs.io/en/stable/user-guide/commands/argocd_repo_add/).
An HTTPS Git repository with an HTTP proxy does not use this command. Review existing repository and credential-template Secrets for unexpected `proxy` values.
### Credits
The Argo CD team would like to thank @kamil-sawicki, @yuvalelarat, @cherez0ff, @McCaulay, @gehan-psbc, @ria-labs-security, @parameter-ai-security, and @zwindler for responsibly disclosing this issue according to our [security reporting guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).
### References
* Introducing commit: [9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) ([#15864](https://github.com/argoproj/argo-cd/pull/15864)), first released in v2.11.0
* [Configure repositories with proxy](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#configure-repositories-with-proxy)
### For more information
* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
## Summary
In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.
## Impact
This has two distinct effects in bundled-proxy deployments:
* **IP allowlist enforcement:** management API requests forwarded by the bundled proxy were identified as loopback and could pass the loopback exception even when the external source was not in the configured allowlist. Protected management operations still required valid credentials; this did not grant unauthenticated administrator access.
* **Login availability:** failed login attempts from different external sources were attributed to one loopback address. An unauthenticated attacker could therefore trigger the shared temporary login-ban threshold and deny password or OTP login to other users behind the proxy until the ban expired. Existing authenticated sessions were not invalidated.
## Remediation
Upgrade to Nginx UI 2.6.0 or later. The fix explicitly trusts only the intended bundled proxy, validates configured trusted proxies, uses the resolved client address consistently, and fails closed when an IP allowlist is enabled but the client address is invalid.
Fix commit: https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf
This report summarizes multiple cybersecurity incidents and emerging threats including AI-assisted bank breaches in South Korea, a poem-guided botnet called PoeLLM targeting AI and open-source services, a supply chain attack on the Tensorlake npm SDK, and the sentencing of the Empire Market co-founder. The PoeLLM malware uses a novel method of hiding its command-and-control server IP address encoded in a GitHub-hosted poem. The Tensorlake npm SDK was compromised to deliver a credential-stealing worm. Nvidia's DCGM Exporter had a high-severity denial-of-service vulnerability that has been patched. The South Korean bank breaches are under investigation with AI suspected to be involved. The Empire Market co-founder received a 40-year prison sentence for running a dark web marketplace. These events highlight evolving attack techniques and ongoing law enforcement actions.
A stack overflow vulnerability exists in the Coraza JSON body processor (github.com/corazawaf/coraza/v3) that can cause the entire host process to crash. This occurs due to an unbounded recursion in the gjson.Valid function when processing deeply nested JSON bodies that bypass argument and byte limits. An unauthenticated attacker can trigger this with a crafted JSON request body well within default and recommended size limits, causing a fatal stack overflow that terminates the process unconditionally.
The FakeGit malware campaign has resurfaced, distributing the SmartLoader malware through over 17,000 fake GitHub repositories. These repositories use convincing README files with download links to ZIP archives containing SmartLoader, which then delivers additional malware such as the StealC infostealer. The campaign leverages both throwaway and apparently legitimate developer accounts to maintain a large and persistent malicious repository fleet. Attempts to remove these repositories are ineffective due to the attackers' use of multiple backup copies and alternative download locations within GitHub. Users are advised to verify repository ownership and rely on official sources for software installations.
The npm package @galicia-toolkit/tag-manager versions 999.0.3, 999.0.5, and 999.0.6 is a malicious dependency-confusion squat that executes code during installation to exfiltrate sensitive environment variables and host information to an external attacker-controlled server. It collects credential-grade environment variables such as AWS and GitHub tokens, enumerates system details, and sends this data via HTTP and DNS channels. The package contains no legitimate functionality and is designed solely for credential theft. Any system with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @galicia-toolkit/spa-build-config versions 999.0.3, 999.0.5, and 999.0.6 contains malicious code in its postinstall script. This script collects sensitive host and credential data, including environment variables with AWS, GitHub, npm, and GitHub Actions tokens, and exfiltrates this information to an external server. The package is likely a dependency confusion attack targeting internal scopes. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
CVE-2026-105830 is a high-severity denial of service vulnerability in thephpleague commonmark library versions 2.0.0 up to but not including 2.10.2. The flaw exists in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() method, where an unauthenticated attacker can cause excessive CPU consumption by submitting specially crafted input. This triggers repeated full-buffer scans, leading to quadratic-time resource exhaustion in PHP workers.
The npm package @itsmee_aizat.id/baileys2 versions 2.0.0, 2.0.1, and 2.0.2 includes a runtime dependency on a GitHub repository (tenka-san/libsignal-node) controlled by an unrelated user. This dependency is fetched without integrity verification, allowing whoever controls that repository to execute arbitrary code on the installer's machine. The package loads this malicious code at runtime, leading to a full compromise of any computer where it is installed or running.