Daily · 2026-05-22
⚡ Megalodon 5.5K Repos, 🔴 Google Chromium Leak, 🏭 Foxconn 8TB, 🕸️ First VPN Takedown
Megalodon campaign compromises 5,500+ GitHub repos in 6 hours. Google accidentally exposes unfixed Chromium Service Worker flaw enabling silent JS RCE. Foxconn ransomware leaks 8TB of NVIDIA/Apple IP. First VPN takedown seizes 33 servers across 27 countries. Prioritize auditing GitHub Actions workflows, restricting OAuth device-code flows, and patching Cisco/IoT devices.
The Megalodon automated campaign is the day's defining story. In a six-hour window it pushed 5,718 malicious commits to more than 5,500 GitHub repositories, injecting Actions workflows that harvest environment variables, cloud credentials, and OIDC tokens. The dormant variant stays quiet until fired via the API, so a clean build history is not evidence of safety, and every repository touched needs workflow review. Megalodon GitHub campaign
The Foxconn ransomware attack adds an industrial-scale target: the Nitrogen group claims 8 TB of data including engineering drawings and client information tied to NVIDIA and Apple supply chains. Foxconn confirmed impact at some North American facilities. The First VPN takedown is the enforcement counterpoint, with seized infrastructure and live traffic data pointing at follow-up prosecutions.
Google's accidental disclosure of an unfixed Chromium service worker flaw is a reminder that a bug marked fixed is not the same as a bug patched; the silent JavaScript execution works on current Chrome and Edge. Microsoft's reversal on Edge loading all saved passwords into process memory in cleartext at startup closes a credential-exposure hole that had been defended as by design.
Watchlist: audit GitHub Actions for unauthorized workflow files, prioritize Foxconn-adjacent supplier risk reviews, and confirm Edge is on build 148 or later.