Daily · 2026-05-19
🔴 CISA GovCloud leak worst ever, 🎯 SEPPmail 7-CVE pre-auth RCE, ⚠️ Nx Console supply chain hijack, 🦞 Claw Chain OpenClaw CVSS 9.6, 📊 PostgreSQL 11-CVE update, 🎭 Gamaredon 12-wave Ukraine campaign
Critical: CISA contractor exposed AWS GovCloud keys + plaintext passwords on GitHub for 6 months — worst government leak in recent history. SEPPmail gateway pre-auth RCE gives full mail traffic access. Nx Console VS Code extension (2.2M users) hijacked in supply chain attack targeting developer secrets. OpenClaw 4-bug chain (CVSS 9.6) enables AI agent sandbox escape. Patch: PostgreSQL 11 CVEs, NGINX Rift active exploitation. Gamaredon continues 12-wave phishing against Ukraine. B1ack's Stash releases 4.6M stolen credit cards.
The CISA contractor leak is the day's defining story. A Nightwing contractor's public GitHub repository exposed highly privileged AWS GovCloud administrative credentials, plaintext passwords for internal systems, and CI/CD secrets for months, a disclosure GitGuardian called the worst leak it has witnessed. The exposure converts an agency credential leak into a state-actor persistence question, and it is the kind of finding every federal contractor should treat as a red-team test they failed. CISA GovCloud credential leak
The Nx Console supply chain compromise puts 2.2 million VS Code installations in the blast radius of a credential stealer published to the marketplace with a stolen contributor token. Removal within 11 minutes is fast, but anyone who opened a workspace with the infected version should rotate everything the payload touched. Nx Console extension hijack
SEPPmail's seven critical flaws include a pre-auth path to a Perl reverse shell and full mail traffic theft, and PostgreSQL's batch of 11 CVEs includes a stack overflow that may reach RCE. The Gamaredon campaign's twelve waves of WinRAR-based phishing against Ukrainian state targets show persistence in operational tempo.
Watchlist: GitHub token hygiene and secret scanning, extension provenance in the developer toolchain, SEPPmail appliance patching, and PostgreSQL upgrades across all supported branches.