Socket (28 August 2026) reports that ten versions of npm package @7nohe/openapi-react-query-codegen were published that day after a comment-triggered GitHub Actions trusted-publishing workflow was abused. An untrusted GitHub account could comment a publish trigger on a pull request and ship fork code under the repository OIDC identity. Versions named by Socket and Step Security are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, plus two 0.0.0-sha prerelease tags. Stable releases ran obfuscated JavaScript 3FWCvzduYZg.js via binding.gyp and/or a preinstall hook. Socket describes Mini Shai-Hulud-consistent self-propagation. Install-time code targeted cloud credentials, package-registry credentials, GitHub Actions secrets and AI-agent configuration. All ten carried valid npm provenance. Pin known-good 0.5.3, 1.6.2, 2.2.0 or 3.0.2, isolate affected hosts, then rotate tokens. This Cyberstack does not attribute the package to TeamPCP; Socket and Step Security do not name that group.
JFrog's 28 August 2026 advisory rates CVE-2026-82329 Critical (CVSS 3.1 9.8): under default configuration, an unauthenticated attacker with network access may obtain administrative privileges on self-managed Artifactory. BleepingComputer reported on 2 September 2026 that researchers at watchTowr observed the flaw being exploited by "attackers minting themselves admin tokens"; BleepingComputer says an attacker forging their own admin tokens can enumerate users, groups and federated topologies, read artifacts, change security configurations and poison existing packages (source: BleepingComputer). Self-hosted patches: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20; JFrog says cloud was already fortified. Access tokens are independent credentials — upgrading the binary does not by itself revoke minted tokens, so rotate/revoke tokens and hunt anomalous admin activity after patching. CISA added CVE-2026-82329 to the KEV catalog on 2 September 2026. UPDATE 10–11 September 2026 (Wiz / THN): Wiz also saw CVE-2026-82329 abused in the wild alongside a separate 42018→42016 chain (15 Aug–8 Sep) that yields admin and drops Rust C2 / Groovy plugins. Correction (29 Oct 2026): exploitation details are now credited to BleepingComputer's linked report; removed details that only SecurityWeek gave (backdoor users, a small set of IPs, no mass scanning, a 'phantom' join key), internal cross-references and a duplicate JFrog link. (sources: JFrog; BleepingComputer)
JFrog security advisories (CVE-2026-82329, 28 Aug 2026)
Confiant (28 August 2026; figures as of 25 August) tracks HexMage, a Magecart cluster that injects a fake Google Tag Manager block into compromised storefronts (mostly WooCommerce), loads ethers.js, and reads a Sepolia testnet contract to obtain a disposable skimmer host (EtherHiding). Confiant observed 40+ impacted sites across at least 15 countries since about April 2026; 25 storefronts mapped, including Australian site protocoffee[.]com[.]au (a blockchain-free loader variant pointing at stylerightnoww[.]com). One owner wallet (0x88361C914Bb0942da9a1b7Bb396a7513C1917aee) had deployed 144 contracts by 21 July 2026. The skimmer overlays the payment form, harvests PAN/expiry/CVV, then restores the DOM so the purchase completes. Fake-GTM detection: the injected block never fetches googletagmanager[.]com/gtm.js. Cyber Security News carried the story on 31 August. Defanged names only on Cyberstack — not live links.
Microsoft Threat Intelligence (Security blog dated 28 August 2026; JSON-LD published 29 August) describes TerminalFix, a ClickFix variant that uses compromised websites and a fake Cloudflare CAPTCHA overlay to trick users into pasting a PowerShell command in Windows Terminal or PowerShell rather than the Run dialog. The command downloads a ZIP with a legitimate LockScreenContentServer.exe binary and a malicious dui70.dll for DLL sideloading. Later stages pull payloads hidden in PNG images, persist via Registry Run keys and scheduled tasks, run Active Directory reconnaissance, and deploy a Python reverse-tunnel implant that proxies TCP over an encrypted WebSocket. Microsoft says it did not observe the later hands-on-keyboard steps (privilege escalation, defence tampering, ransomware) in the analysed chain, but treats affected hosts as potential network pivot points. (sources: Microsoft; The Hacker News)
Hasbro has disclosed that attackers accessed the personal and financial information of an undisclosed number of employees, BleepingComputer reported on 28 August 2026. According to BleepingComputer, Hasbro filed data breach notification letters with the Massachusetts Attorney General's Office but did not disclose the total number of people affected or when the incident was detected. BleepingComputer quotes the letters: "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," and "Hasbro implemented containment and remediation measures, including disabling the compromised employee account, terminating unauthorized access, and deploying additional safeguards designed to help prevent a similar incident from occurring in the future." Citing the Massachusetts Attorney General's Office 2026 Data Breach Notification Report, BleepingComputer says the Social Security numbers, financial account information, credit/debit card numbers and driver's licence information of 436 Hasbro employees in Massachusetts were affected. Hasbro did not link this breach to the cyberattack that hit its systems on 28 March, according to BleepingComputer. Correction (28 Oct 2026): the Massachusetts letter and breach-list pages return HTTP 403 to Cyberstack, so their links, the letter number and the 'no customer impact' line were removed; the details above are credited to BleepingComputer, which quotes the letters. (source: BleepingComputer)
BleepingComputer — Toy-making giant Hasbro disclose data breach affecting employees (28 Aug 2026)
Patchstack (28 August 2026) and CVE-2026-82222 describe an unauthenticated PHP object injection chain in GiveWP through 4.16.7.1 that reaches remote code execution. On 4.16.5.1 and below a default install with one published donation form and an active gateway is enough. On 4.16.6–4.16.7.1 reachability narrows but a legacy give_forms post without formBuilderSettings (including draft/trashed) re-arms the chain. The plugin's give_action=user_register path ignores WordPress users_can_register, so an attacker can obtain an account even when registration is disabled. Patchstack rates CVSS 10.0. Vendor fixed in GiveWP 4.16.7.2 (27 August 2026), which breaks the chain at several layers and migrates serialized object payloads already in the database. Patch to 4.16.7.2 or later.
Cyber Daily's 28 August 2026 report quotes a Sharp Motor Group spokesperson confirming the Tweed Heads, NSW dealership is aware that its third-party IT provider has been involved in a cyber incident. The company said it is working with independent cyber specialists and relevant authorities, has notified the OAIC, and that staff and customer privacy remain the priority. Cyber Daily reports the Storm ransomware group listed Sharp Motor Group in a 23 August leak-site post and published sample files it claims were taken (including identity documents and financial material); those actor claims and any data-volume figures are not independently confirmed in the company statement and are not treated as verified facts on Cyberstack. Storm has also listed other Australian automotive and machinery firms this month; company responses for those other listings were not confirmed in the same report.
Cyber Daily (28 Aug 2026; quotes Sharp Motor Group)
McKesson's Form 8-K (dated 28 August 2026) says that on 25 August 2026 it discovered a cybersecurity incident affecting its information systems, that its investigation is in its early stages, and that information and updates are available at www.mckesson.com/cybersecurity. As of the filing date, McKesson had not determined that the incident is material or that it has had, or is reasonably likely to have, a material impact on the company, including its financial condition or results of operations. (source: McKesson Form 8-K) Correction (24 Oct 2026): removed a reference to an extortion group's unconfirmed claims about patient records and access methods; McKesson's notice and 8-K do not confirm them. (source: McKesson Form 8-K) Correction (29 Oct 2026): a bare link credit was replaced with a named credit. (source: McKesson Form 8-K) Correction (29 Oct 2026): McKesson's cybersecurity web page could not be read (the address redirects to an empty page), so the details that only that page gave have been removed: the 28 August customer notice, the involvement of third-party applications and data exfiltration, and the 29 August operations update. The card now rests on McKesson's Form 8-K, and the title has been changed to match. (source: McKesson Form 8-K)
WatchGuard PSIRT published a cluster of advisories on 27 August 2026 covering Fireware OS (iked / epm) and WatchGuard Dimension. Five issues are rated 9.3 on the vendor page: iked heap overflow CVE-2026-19313, iked stack overflow CVE-2026-19318 and iked type confusion CVE-2026-19315 (unauthenticated remote code execution via crafted traffic); epm stack overflow CVE-2026-13086 in the deprecated Mobile Security feature; and Dimension CVE-2026-78174, session-ID and CSRF token exposure that can let a low-privileged administrator take over a super-admin session. SecurityWeek (Ionut Arghire, 1 September) matches those five at CVSS 9.3. Patch to Fireware OS 2026.2.2, 12.12.2 or 12.5.20 and Dimension 2.3.1. WatchGuard also shipped additional high- and medium-severity fixes in the same wave (iked denial-of-service and Dimension SQL injection, CSRF, SSRF and related issues among them); this card does not list every CVE. The vendor is not aware of exploitation of these defects.
iTnews (28 August 2026), citing an NSW Police statement, reports that a 30-year-old telecommunications employee was arrested at a police station in Sydney's west and charged over allegedly accessing customer data through his employment and selling it to criminal groups. Police allege the information was then used to commit fraud against multiple victims. Charges listed in that report are 12 counts of deal with identity info to commit an indictable offence, 12 counts of unauthorised function with intent to commit a serious offence, and 10 counts of agent corruptly receive benefit (34 offences). The arrest followed a Queensland Police referral. iTnews does not name the employer. The National Tribune reprint of the police release dates the arrest about 9.30am on Thursday 27 August 2026, refused bail to Liverpool Local Court the same day. These are allegations before a court.
Palo Alto Networks advisory CVE-2026-0251 (published 13 May 2026, updated 27 August 2026 after a public PoC): multiple local privilege-escalation bugs in the GlobalProtect app (CWE-426 untrusted search path) let a local user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run commands with administrative privileges. iOS, Android, Chrome OS and the GlobalProtect UWP app are not affected. No special configuration is required. Vendor CVSS-BT is 7.1 (CVSS 4.0); the same advisory lists CVSS-B 8.5. Exploit maturity is POC. Palo Alto Networks says it is not aware of malicious exploitation.
The US Bureau of Alcohol, Tobacco, Firearms and Explosives said in a press release, as reported by BleepingComputer (27 August), that a standalone system was breached in what it described as a 'major incident', which it is investigating with the Justice Department. BleepingComputer quotes ATF as saying the impacted system operates separately from the ATF enterprise network, that there is no indication the incident has affected the enterprise network, the ATF eForms system or any other ATF system, that on discovery ATF immediately terminated connections to the affected environment and initiated incident-response and forensic activities, and that it is coordinating closely with the Justice Department to investigate; BleepingComputer adds that ATF said the incident did not affect the agency's operations. BleepingComputer reported that Qilin added ATF to its data leak portal on 26 August without saying whether it had stolen files or demanded a ransom, and that ATF published its press release the same day. Actor claims are not treated as verified facts on Cyberstack. UPDATE (25 Oct 2026): ATF said on X on 31 August that it is aware of claims about the possible publication of data allegedly obtained in the incident, which involved a standalone system used in connection with CALEA; that it is working with the Justice Department and other federal partners to assess the claims; that the affected system was separate from ATF's enterprise network; and that it has not confirmed the authenticity, nature or scope of the materials. (source: ATF on X) Correction (26 Oct 2026): ATF's press release cannot be read by Cyberstack, so its text is now credited to BleepingComputer, which quotes it; an earlier correction saying the release was readable and was the primary source was wrong. Details that BleepingComputer does not report (the release's printed date, the designation of the event by senior Department officials, completed notifications and a statement about ATF's missions) and an unlinked SecurityWeek credit have been removed. The card date has moved from 28 to 27 August 2026, the date of BleepingComputer's report. Earlier, on 25 Oct, we removed SecurityWeek's description of the Qilin post and credited the listing to BleepingComputer. (source: BleepingComputer) Correction (28 Oct 2026): BleepingComputer's report and ATF's X post show times with no time zone, so the card now gives their dates only (27 and 31 August) and drops the Perth and US-time conversions; the card date stays 27 August. (sources: BleepingComputer; ATF on X)
BleepingComputer — ATF confirms "major incident" after recent Qilin breach claims (27 Aug 2026; quotes ATF press release)
