Threat briefs

A supply chain compromise of the trivy-action GitHub Action resulted in the insertion of a multi-stage credential stealer into CI/CD pipelines, executing before the legitimate scanner to steal secrets from GitHub Actions runners.

CrowdStrike introduces agentic MDR and SOC Transformation Services to enhance breach prevention through machine-speed execution and expert oversight, while SOC Transformation Services aim to modernize security operations by focusing on SIEM, data pipelines, workflows, talent models, and governance.

CrowdStrike's Charlotte AI AgentWorks facilitates the creation and orchestration of AI-driven security agents within the SOC, aiming to enhance analyst capabilities and automate security operations using AI.

CrowdStrike's Falcon Data Security helps organizations understand sensitive data, track its movement, and prevent data theft across endpoints, browsers, SaaS applications, cloud services, GenAI tools, and agentic workflows by leveraging advanced classification and real-time monitoring.

CrowdStrike's Charlotte AI AgentWorks facilitates the development and deployment of AI-driven security agents within the SOC, aiming to enhance analyst capabilities through automated and orchestrated responses to threats.

CrowdStrike is enhancing its Falcon platform to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing threats like prompt injection attacks, data leaks, and policy violations associated with personal AI agents and shadow AI adoption.

CrowdStrike Falcon Next-Gen SIEM is expanding to support third-party EDR solutions, starting with Microsoft Defender, enabling organizations to extend their AI-native SOC across their ecosystem by unifying detection, investigation, and response.

CrowdStrike's Charlotte AI AgentWorks and Agentic SOAR aim to revolutionize security operations by enabling the creation and orchestration of AI-powered agents, enhancing analyst capabilities and automating tasks to combat AI-accelerated adversaries.

CrowdStrike's Charlotte AI AgentWorks and Agentic SOAR aim to revolutionize security operations by enabling the creation and orchestration of AI-powered agents, enhancing analyst capabilities and automating tasks to combat AI-accelerated adversaries.

CrowdStrike's new CNAPP capabilities, including Application Explorer and Adversary Intelligence, enable security teams to prioritize cloud risks based on application context and known adversary behaviors, such as those of LABYRINTH CHOLLIMA and SCATTERED SPIDER, improving remediation efforts.

CrowdStrike's Agentic MDR combines machine-speed execution with expert oversight, leveraging deterministic automation and adaptive AI agents to enhance breach prevention and SOC modernization.

CrowdStrike Falcon AIDR now supports NVIDIA NeMo Guardrails as of release v0.20.0, providing enterprise-grade protection for AI agents by blocking prompt injection attacks, redacting sensitive data, and defanging malicious content.

The Tycoon2FA PhaaS platform, used for MFA bypass and email compromise, has demonstrated a resurgence in activity following a law enforcement takedown, indicating continued threat actor activity.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass multifactor authentication (MFA), has resurged to pre-takedown levels of activity following a disruption effort in March 2026, maintaining its original tactics, techniques, and procedures (TTPs) for credential harvesting and cloud compromise.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass multifactor authentication (MFA), has resurged to pre-takedown levels of activity following a disruption effort in March 2026, maintaining its original tactics, techniques, and procedures (TTPs) for credential harvesting and cloud compromise.

CrowdStrike Falcon is enhanced to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing emerging attack surfaces and visibility gaps.

The trivy-action GitHub Action was compromised via git tag repointing, where 76 of 77 release tags were retroactively poisoned, replacing the legitimate entry point with a credential stealer that ran silently before the real scanner, targeting GitHub Actions runners on Linux.

CrowdStrike's new CNAPP capabilities in Falcon Cloud Security focus on adversary-informed risk prioritization by correlating application-layer visibility with threat actor profiles and techniques, enabling security teams to understand cloud risk, prioritize remediation, and accelerate response.

CrowdStrike is expanding its Falcon Flex model to its services offering, providing flexible access to incident response, proactive security services, advisory, platform services, and training.

CrowdStrike Falcon AIDR now supports NVIDIA NeMo Guardrails (v0.20.0), providing enterprise-grade protection against attacks targeting AI agents by blocking prompt injection, redacting sensitive data, defanging malicious content, and moderating unwanted topics to ensure policy compliance and data safety.

CrowdStrike's announcement of Falcon Flex for Services, offering flexible consumption of cybersecurity services to improve incident response readiness, potentially impacting organizations needing rapid access to expertise during security incidents.

CrowdStrike's new CNAPP capabilities in Falcon Cloud Security address limitations in cloud risk assessment by providing application layer visibility, attacker-aligned risk prioritization based on threat actor profiles and observed techniques, and configuration change tracking to expedite remediation.

The trivy-action GitHub Action was compromised via git tag repointing, with 76 of 77 release tags poisoned to include a multi-stage credential stealer that executes before the legitimate scanner, impacting CI/CD pipelines.

CrowdStrike's agentic MDR combines automation, AI agents, and human oversight for rapid breach response, while SOC Transformation Services modernize security operations for an agentic SOC approach.

CrowdStrike Falcon Data Security is introduced to protect data across evolving environments by discovering, classifying, and defending sensitive data against risks like employee mistakes and credential-based data theft.

CrowdStrike Falcon Next-Gen SIEM now supports third-party EDR solutions, beginning with Microsoft Defender, enabling organizations to extend their AI-native SOC and unify detection across heterogeneous environments.

CrowdStrike introduces new capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing threats like prompt injection, data leaks, and policy violations.

The Oxygen Theme for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to 6.0.8, allowing unauthenticated attackers to make arbitrary web requests via the laborator_calc_route AJAX action.

CVE-2026-1679 describes a vulnerability in the eswifi socket offload driver where user-provided payloads are copied into a fixed buffer without proper size checking, leading to a buffer overflow and kernel memory corruption.

WeGIA web manager prior to version 3.6.7 is vulnerable to SQL injection via the `id_tag` parameter in the `deletar_tag.php` script due to unsanitized input and direct concatenation into SQL queries, potentially allowing attackers to read, modify, or delete data.