GitLab

Integrity Technology Group, a Chinese for-profit entity, is conducting multi-year cyber espionage targeting government, healthcare, and religious institutions using automated vulnerability scanning, credential harvesting, and specialized data exfiltration tools.

Prolific infostealer families like Lumma, RedLine, and Vidar are leveraging industrialized malware-as-a-service to exfiltrate session tokens and API keys, enabling bypass of MFA and unauthorized access to cloud, code, and AI environments.

Multiple vulnerabilities in GitLab allow remote attackers to achieve arbitrary code execution, escalate privileges, bypass security controls, and perform other malicious actions.

Threat actors are increasingly exploiting Version Control Systems for supply chain compromise, necessitating proactive audit log streaming and metadata configuration to overcome significant platform-specific visibility gaps.

GitLab is affected by multiple vulnerabilities that allow remote code execution, denial of service, data manipulation, and security control bypass.

GitLab contains multiple security vulnerabilities that allow attackers to perform cross-site scripting, bypass security constraints, escalate privileges, disclose sensitive information, or trigger denial-of-service conditions.

A detection rule identifies AWS access key IDs, Amazon Bedrock API keys, PEM private-key blocks, and GitHub/GitLab tokens within Amazon Bedrock model prompts or completions, indicating a critical credential exposure event through misconfiguration, data leakage, or prompt injection that necessitates immediate secret rotation and investigation.

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

Multiple vulnerabilities in GitLab allow a remote, authenticated attacker to execute arbitrary code, perform Cross-Site Scripting (XSS), manipulate data, or disclose sensitive information.

Hackers injected credential-stealing malware into newly published versions of the node-ipc npm package in a supply chain attack, collecting cloud credentials, SSH keys, CI/CD secrets, and other sensitive data, exfiltrating it through DNS TXT queries.