Daily · 2026-05-20
🔴 GitHub 3.8K Repos Breached, 💀 Shai-Hulud Hits 600+ Packages, ⚠️ YellowKey Mitigated, 🛡️ ChromaDB Max-Severity, 🎯 Fox Tempest Disrupted, 🔐 CISA Leak
GitHub confirms 3,800 internal repos breached via malicious VS Code extension; new Shai-Hulud wave compromises 639 npm packages in one hour; Microsoft issues YellowKey (CVE-2026-45585) mitigations for BitLocker zero-day; max-severity ChromaDB flaw (CVE-2026-45829) remains unpatched with 73% of exposed instances vulnerable; Microsoft disrupts Fox Tempest malware-signing service; CISA credential leak triggers congressional demands for answers.
The confirmed breach of roughly 3,800 GitHub internal repositories is the day's defining story. An employee's trojanized VS Code extension led to the exposure, TeamPCP is advertising the stolen code for sale, and GitHub's own assessment says the attacker's claims are directionally consistent. The incident converts a developer-tool compromise into an organization-wide code disclosure, which makes extension integrity a first-class security control. GitHub internal repo breach
ChromaDB's CVE-2026-45829 is a maximum-severity unpatched flaw in a vector database with 14 million monthly downloads; the authentication-ordering bug lets a crafted request execute a model fetched from Hugging Face before the server rejects it. Exposed instances are effectively open to arbitrary code execution, and the lack of a patch means exposure management is the only mitigation. ChromaDB CVE-2026-45829
The Shai-Hulud campaign returned with 639 malicious npm versions published in about an hour, now with valid Sigstore attestation via abused OIDC tokens. VoidStealer's debugger-based bypass of Chrome App-Bound Encryption removes the last major browser protection layer for infostealers, and the DirtyDecrypt PoC extends the Dirty Frag class of Linux kernel LPEs with a working exploit.
Watchlist: npm provenance checks, ChromaDB exposure audits, and review of which tools still rely on App-Bound Encryption as the only credential defense.