Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On March 14, 2025, StepSecurity uncovered a compromise in the popular GitHub Action tj-actions/changed-files. Tens of thousands of repositories use this action to track file changes, and it is now known to have been tampered with, posing a risk to both public and private projects. A CVE has been created for this issue: CVE-2025-30066.

North Korea’s Lazarus Group is evolving its tactics again. The latest campaign, dubbed Operation Marstech Mayhem, introduces an advanced implant named “Marstech1.” This malware is designed to compromise software developers and cryptocurrency wallets through manipulated open-source repositories. Unlike previous Lazarus operations, this campaign employs obfuscation techniques that make detection significantly harder. Read the full report here.

Supply chain security is no longer just an IT issue, it’s a critical business concern. As recent high-profile breaches like the MOVEit vulnerability have shown, a single vulnerability in a vendor’s system can have a cascading effect, disrupting operations and damaging reputations across the entire supply chain. This shift in the threat landscape demands a new approach to cybersecurity that prioritizes collaboration, resilience, and a proactive defense strategy.

Cyber hackers always find ways to make their strategies more perfect in countermanding the security measures, and the XE Group is no exception. Hailing from Vietnam, initially famous for its credit card skimming operations, the cyber threat entity now engages itself in supply chain hacking. This sophistication and flexibility are proved by exploiting two newly identified zero-day vulnerabilities in VeraCore's warehouse management software.

Software supply chain security risks are mounting. As noted in Veracode’s State of Software Security (SoSS) report, organizations of all sizes are drowning in security debt, and a large portion of the critical debt can be attributed to third-party vulnerabilities.

Automatic Zero Trust protection. Bulk labeling of files. Easy-to-use tools. Here’s 3 ways to secure external collaboration without impeding workflows. Just as one broken link can disrupt a physical supply chain, it only takes one security gap to infect a digital supply chain. Digital supply chains are as vital to modern workflows as they are fallible to attack. From infected software to accidental third-party leaks, one single vendor can bring down the whole supply chain.

The majority of global organizations say they have been negatively impacted by a breach in their supply chain. In our latest survey, 81% of global organizations reported being negatively impacted by a third-party cyber breach.

Organizations rely heavily on external vendors and suppliers, creating complex supply chains vital for operations. However, this introduces a new dimension of risk: supply chain attacks.

Account takeover of a third-party service provider may put millions of airline users worldwide at risk.