Compromised GitHub Actions Resume Spreading Mini Shai-Hulud Malware

Researchers say hackers tied to Russia's APT29 group compromised a widely used web analytics script so that it served exploits to visitors' iPhones and Android devices. The tampered script turned ordinary website traffic into a delivery channel for mobile exploits, the kind of supply-chain attack that can reach many sites at once. It matters because a nation-state actor is now using trusted third-party code to hit mobile targets at scale.

A critical vulnerability in Ruby on Rails lets attackers write arbitrary files to a server by uploading specially crafted images processed through ImageMagick. The flaw could enable code execution or server compromise, making patching urgent for affected Rails applications.

Researchers disclosed vulnerabilities in the Xen hypervisor that allow a malicious or compromised guest virtual machine to read and write the memory of other VMs running on the same host. Xen underpins many public cloud and hosting platforms, so a successful exploit could break the isolation tenants rely on and expose data across customers. Patches have been released and operators are urged to apply them promptly.

China-aligned hackers hijacked DNS requests tied to Sogou’s input method to deliver the DarkVigil backdoor, according to The Hacker News. The campaign matters because Sogou has a large user base, and DNS hijacking can silently redirect users to malicious infrastructure and compromise devices.

Google released patches for a critical Android vulnerability that could allow remote code execution without any user interaction. The flaw affects Android devices and could let attackers compromise systems remotely. Users should install available updates promptly to reduce exposure.