Dependencies, packages, build systems and hardware provenance.
November 2, 2026 · Azure's edge falls over, and a record crypto heistBinance disclosed an incident affecting about 6.3 billion dollars in assets, with close to 3 billion frozen on-chain by Tether, Circle and Arbitrum. On 1 November the FBI attributed the theft to North Korea's TraderTraitor group (also tracked as Jade Sleet and UNC4899). Reporting says the attackers compromised a DevOps engineer's laptop, reached a service container, pre-signed consecutive withdrawal authorizations, and moved the funds in about 20 minutes.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCloudflare detailed eight eMudhra intermediate CA certificates whose private keys were literal small integers (4, 56, 66 and others), letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare saw about 22,000 handshake attempts using the weak keys and a forged certificate dated under an hour after the public bug report. A week later, more than half of probes still accepted the chain.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA tampered copy of Anthropic's Claude Code extension, version 2.1.313, was published to the Cursor marketplace and stayed live about 11 hours on 29 October, reaching up to 5,000 developers. It collected username, Git email and public IP and attempted a reverse SSH tunnel and persistence across Windows, macOS and Linux. Anthropic said a malicious actor used access to the marketplace to publish a copy it did not build.
November 2, 2026 · Azure's edge falls over, and a record crypto heistHosting platform Northflank disclosed a breach on 30 October in which stored environment variables were decrypted and customers' AI API keys were stolen and misused. Northflank told customers to assume all stored environment variables were compromised and to rotate every key, database password, token and secret. It followed similar breaches at Railway earlier in the month.
November 2, 2026 · Azure's edge falls over, and a record crypto heistGitHub introduced a preview npm package firewall that inspects downloads at install time and blocks suspicious packages before they install, the same week as the Northflank and Claude Code extension supply-chain incidents.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCloudflare found eight eMudhra intermediate CA certificates whose private keys were catastrophically weak, letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare deployed mitigations on 19 and 20 October, and eMudhra later said it will exit the global TLS certificate business.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityA malicious LiteLLM 1.107.0 was published to PyPI on 21 October with a credential stealer and a persistent backdoor that polled GitHub for commands. Attackers used stolen GitHub CLI credentials to bypass branch protection and build from a lookalike repo before PyPI removed it. The same day, Railway disclosed unauthorized access to systems holding customer environment variables, some decrypted, and told customers to rotate everything.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityA maintainer's post announcing he had archived all his Ruby gem repositories drew about 526 points and 514 comments on Hacker News around 19 October, surfacing open-source sustainability concerns.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOpenCode disclosed that attackers accessed a legacy system being decommissioned, exposing third-party API keys for OpenAI, Anthropic and Google that users had saved in OpenCode Console workspaces. The company said about 1.4 percent of Console users were affected, and Anthropic revoked affected Claude API keys. The open-source CLI itself was not the breached component.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireLedger confirmed an unauthorized hardware implant inside Ledger X wallets distributed by a Malaysia-based reseller. The implants used a small microcontroller and an LTE eSIM to exfiltrate recovery seed phrases captured from display and button activity. Ledger called the affected volume limited and did not disclose theft totals.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA high-engagement GitHub issue filed on 12 October reports that the Codex CLI installs a persistent, self-updating background daemon by default, raising concerns about consent, auto-update behaviour and running an always-on process.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedA GitButler post arguing that Git 3.0's planned switch to SHA-256 as the default would break existing SHA-1 hash references for limited practical benefit drew 583 points and over 500 comments on 1 October.
