⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More

Summary: The Miasma self-replicating supply chain worm hit 73 Microsoft GitHub repositories across four organizations - Azure, Azure-Samples, Microsoft, and MicrosoftDocs - prompting GitHub to disable access to them. Miasma is assessed to be a variant of the Mini Shai-Hulud worm that TeamPCP publicly released in mid-May 2026, and the same week brought a long list of high-severity CVEs including a Google Android flaw (CVE-2025-48595) and Cisco SD-WAN Manager (CVE-2026-20245).
Why it matters: A self-replicating worm reached 73 repositories inside Microsoft's own GitHub organizations, which means the trust chain around your dependencies is the attack surface, not just your code. The recap's own conclusion is that nothing here is new - basic tricks like a fooled chatbot and a leaked bot token still worked, so the gap is in execution, not awareness.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2025-48595 CVE-2026-0826 CVE-2026-10621 CVE-2026-10622 CVE-2026-10629 CVE-2026-10881 CVE-2026-10882 CVE-2026-10883 CVE-2026-20230 CVE-2026-20245 CVE-2026-23479 CVE-2026-23631 CVE-2026-25243 CVE-2026-25588 CVE-2026-25589 CVE-2026-28318 CVE-2026-3300 CVE-2026-34908 CVE-2026-34909 CVE-2026-39210 CVE-2026-39217 CVE-2026-41722 CVE-2026-41723 CVE-2026-41724 CVE-2026-42253 CVE-2026-4372 CVE-2026-4387 CVE-2026-45495 CVE-2026-48019 CVE-2026-49200 CVE-2026-49201 CVE-2026-5386 CVE-2026-5509 CVE-2026-7299 CVE-2026-8206 CVE-2026-8501 CVE-2026-8633 CVE-2026-8874 CVE-2026-8876 CVE-2026-8878 CVE-2026-8879 CVE-2026-8881 CVE-2026-8888 CVE-2026-8889 CVE-2026-9614 CVE-2026-9739
Related: Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through Word Press Exploitation Cyber Risks ·
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos Cyber Risks ·