The GhostAction campaign has reportedly compromised around 1,900 GitHub accounts and targeted more than 30,000 repositories to steal CI/CD secrets, cloud credentials and API keys.
Next.js has released an emergency security update fixing critical remote code execution vulnerabilities and a denial of service issue affecting certain applications using caching and SVG processing features.
Microsoft has released fixes for 169 vulnerabilities including a SharePoint zero day under active exploitation, a high severity Windows Defender privilege escalation flaw, and a critical Windows IKE remote code execution issue impacting enterprise systems.
Microsoft releases security patches addressing 59 vulnerabilities across its products, including six zero day flaws actively exploited in real world attacks.