
HAIJA INTEL REPORT
Tweets / X
8 items






Regular sources
7 itemsFour Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks
The pace is not slowing down. Between May 18 and June 1, 2026, four distinct supply chain campaigns swept through npm, PyPI, Crates.io, GitHub Actions, and Composer.
Otto Support - Testing MCP Servers
MCP servers introduce a new attack surface, but the security fundamentals are familiar. In this final otto-support post, we use nmap, a Nuclei template, and MCP Inspecto…
One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user's GitHub token. "Just by cl…
VS Code zero-day lets hackers steal GitHub tokens in one click
A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by …
HTTP/2 Bomb affects Apache httpd, nginx, envoy, & pingora
Posted by Alan Coopersmith on Jun 02 https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb says: The blog tells the story of how it was found and provides technic…
Re: Linux kernel TLS ULP use-after-free in tls_sk_proto_close()
Posted by Emily Shepherd on Jun 03 This reads like AI. Given the original mistake in publicly submitting a PoC when you intended not to, I have to ask: is a human proper… | Posted by Jacob Bachmeyer on Jun 02 Looking at the kernel code in the report, I suspect that there is a pattern here: a lock that will be unconditionally taken is deferr… | Posted by Oleg Sevostyanov on Jun 03 Thank you for the comments. You are right about the reproducer. I mistakenly included it despite saying that I was not including it.…
Fwd: Go 1.26.4 and Go 1.25.11 are released
Posted by Alan Coopersmith on Jun 02 -------- Forwarded Message -------- https://go.dev/doc/security/policy>: * mime: quadratic...