A Worm Just Ate 73 Microsoft Repos

A self-replicating worm called Miasma has infected 73 repositories across four of Microsoft's GitHub organisations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — in what researchers are calling an active supply chain attack (an attack that poisons the tools developers use to build software, so the damage flows downstream to everyone who uses that software).

According to The Hacker News, the campaign is ongoing.

Here is why this matters to you even if you have never touched a line of code. Software you use every day — apps, cloud services, productivity tools — is built using components pulled from repositories like these. When a worm corrupts those components, malicious code can end up inside software that looks completely legitimate. You install an update. You never know.

What you should do:

1. If you use any Microsoft Azure-based services at work, flag this to your IT team today and ask if they have reviewed their software dependencies.
2. If you are a developer: audit any third-party packages you pulled from Microsoft GitHub repos in the last two weeks.
3. Everyone else: keep automatic updates on, but give it 48–72 hours after a major release before installing — this gives security teams time to catch anything poisoned.

A security startup ran an autonomous AI agent against FFmpeg — an open-source media library used in nearly everything that processes video, from browsers to video editors to streaming services — and it found 21 previously unknown zero-days (vulnerabilities that have never been reported or patched).

In the same week, Google shipped Chrome 149 with 429 bug fixes, a record number in a single release, according to The Hacker News.

The mechanism here matters. AI agents can now scan millions of lines of code for logical flaws far faster than human researchers. This is genuinely good news for defenders — but the same capability is available to attackers who reach it first. The race to find and patch before someone else finds and exploits is accelerating.

What Cisco Catalyst SD-WAN Manager is: A network management platform that lets organisations centrally control and monitor their wide-area network (the system connecting offices, branches, and cloud services together).

What it is: A high-severity authentication bypass (a flaw that lets an attacker skip the login process entirely) in Cisco's SD-WAN Manager. According to The Hacker News, attackers are already exploiting this in the wild. There is no patch available yet.

Who's at risk: Organisations running Cisco Catalyst SD-WAN Manager on-premises or via Cisco's cloud deployment. Home users are not directly exposed — this targets corporate network infrastructure.

CVSS: 7.8 — High. Patch this week. Since no patch exists yet, apply mitigations today.

Root cause: The flaw exists in how the software validates (checks) incoming authentication requests. A gap in the validation logic allows a specially crafted request to bypass credential checks entirely, granting access without a valid username or password.

Attack vector: An attacker sends a malformed authentication request to the SD-WAN Manager interface. The software, instead of rejecting it, processes it as legitimate. The attacker gains administrative access to the management plane (the control layer of the network) without needing any credentials. From there, they can reroute traffic, install backdoors (hidden access points), or pivot laterally (move through the network from one system to others) across the organisation's entire connected infrastructure.

Detection strategies:

1. Review SD-WAN Manager authentication logs for login events with no corresponding credential entry.
2. Look for unexpected administrative sessions originating from external or unfamiliar IP addresses.
3. Monitor for configuration changes made outside of normal change management windows.

Recommended actions:

1. Apply Cisco's published mitigations immediately — restrict access to the SD-WAN Manager interface to trusted IP addresses only.
2. Place the management interface behind a VPN (a private, encrypted network tunnel) if not already done.
3. Enable detailed audit logging and alert on any new admin session creation.

OpenAI — the company behind ChatGPT — has begun rolling out Lockdown Mode to eligible personal accounts. The feature restricts tools and integrations that could allow prompt injection attacks (where hidden instructions inside content you paste into ChatGPT hijack the conversation and leak your data to an attacker) from exfiltrating (stealing and sending out) your sensitive information.

If you paste work documents, client details, or anything confidential into ChatGPT, this is worth turning on today.

How to enable it: Go to ChatGPT Settings → Security → Lockdown Mode and toggle it on.

Read more at The Hacker News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA — the American government body responsible for national cybersecurity guidance) has added a high-severity denial-of-service (DoS) flaw in SolarWinds Serv-U (a multi-protocol file transfer server used by businesses to manage file sharing) to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the KEV means active exploitation has been confirmed.

U.S. federal agencies are required to patch by the deadline CISA sets. If your organisation follows CISA guidance — or simply values not being next — treat this as urgent.