Poison in the Code: Rust Supply Chain Attack, Entra ID Exploited & More
Friday, August 21, 2026 · 5-minute read
Google's security researchers caught three suspected Russian cyber espionage clusters — UNC6293, UNC7005, and UNC5976 — running targeted phishing campaigns across Europe and the US. Instead of breaking through the front door, these groups abuse legitimate Google sign-in flows and WhatsApp account-linking features to quietly slip into personal accounts. Targets include people working in academia, aerospace, defense, and government think tanks.
↗ The Hacker NewsA rogue ransomware affiliate is cold-calling victims of ransomware attacks — before the attacks even go public — pretending to be a recovery firm called "Ransom Busters." They claim they can get your files back and make stolen data disappear, for a fee. In reality, they're the same people who attacked you, running a double-dip scam. If you've been hit by ransomware and someone you didn't contact reaches out offering help, treat it as a red flag.
↗ BleepingComputerHackers broke into the account of a software developer and used it to push malicious updates to three popular Rust crates — arrayref, internment, and append-only-vec — which together have been downloaded over 245 million times. The malicious code ran automatically the moment any developer built a project that included these packages, with no extra steps required. The bad versions were caught and removed within about 90 minutes, but any developer who built software during that window may have had malware run on their machine.
↗ The Hacker NewsA serious bug in GitLab — the platform millions of software teams use to store and manage their code — is already being actively exploited, just days after it was publicly revealed. The flaw (CVE-2026-19478) lets an outsider with no account and no special access modify or completely wipe out public GitLab projects by sending a crafted request through a feature called GraphQL. Security firm watchTowr said they could reproduce the attack within minutes of reading the vulnerability report. If your organization runs its own GitLab server, it needs patching right now — GitLab's cloud-hosted service has already been updated automatically.
Attackers found a creative hiding spot: the short welcome message that FTP servers display when you connect to them. They're embedding hidden commands inside those banners to deliver two previously unknown remote access trojans called E4del and PINHOLE onto Windows machines. It's an unusual technique that flies under the radar of many standard security tools because the malicious instructions are buried inside what looks like routine server communication.
Microsoft's cloud identity service — Entra ID, which controls who can log into your company's apps and services — has a maximum-severity flaw that is already being exploited in the wild. The bug involves deserialization of untrusted data, meaning an attacker can send specially crafted data across the internet and get Microsoft's servers to execute their code. Microsoft has already patched it on the backend and says no action is required from customers — but the fact it was exploited before patching is a concern.
Status: Patched by Microsoft — no customer action required. Monitor for unusual sign-in activity in your Microsoft 365 environment.
Cisco patched nine security flaws in its Crosswork network management tools and Secure Workload software, and five of them scored a perfect 10 out of 10 on the severity scale. The worst bugs include an SQL injection flaw, a completely missing authentication check on a critical function, and a bug that lets outsiders control the file system. Any of these could let an attacker take full control of affected systems without needing a password. Cisco Crosswork version 7.2.1 and earlier are affected.
Status: Patched — update to Cisco Crosswork version 7.2.1-SP immediately. Contact your Cisco administrator.
This is the GitLab bug covered in Active Attacks above — worth calling out separately because of how fast it moved from disclosure to active exploitation. An unauthenticated attacker (meaning: anyone on the internet, no login needed) can use a malformed GraphQL request to modify or delete publicly accessible GitLab projects. GitLab versions 18.2 through 19.2.3 are affected across both Community and Enterprise editions.
Status: Patches available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. GitLab.com (cloud) already updated.
A new free service called DecryptAds (decryptads.com) lets anyone look up which ad companies and data brokers are collecting information on visitors to any website or app. Built by security researcher Zach Edwards and two co-founders, it works by automatically reading the public disclosure files that websites are required to publish about their advertising partners — then cross-referencing them to reveal the full picture. A search for ESPN.com, for example, turned up 143 ad partners and 19 data broker domains, including four adtech firms based in Russia, China, or the UAE. The tool also flags malvertising risks and highlights ad partners linked to countries considered security risks. It's free to use and requires no account.
↗ Krebs on SecurityImagine you're a baker who trusts a well-known flour supplier you've used for years. One day, someone steals the supplier's delivery truck and swaps out the flour for a poisoned batch — and because you trust the source, you don't check. That's essentially what happened to hundreds of thousands of software developers this week when attackers hijacked a trusted developer's account and weaponized their popular code packages.
The attacker gained access to the account behind three widely used software libraries in the Rust programming language: arrayref, internment, and append-only-vec. These three packages have been downloaded a combined 245 million times. On August 20, the attacker published new versions of all three that quietly pulled in a hidden, malicious dependency — a separate package whose build script downloaded and ran a remote payload the moment a developer compiled their project. No clicking, no opening attachments. Just building software as usual was enough to get infected.
The Rust Security Response Team caught the attack and pulled the malicious versions within 86 to 107 minutes — impressively fast. But that window is enough for serious damage. Any developer who compiled a project using these packages during that time may have had malware execute on their machine. The malware appears designed to steal information. There's no patched version to update to; developers need to roll back to the last safe version (arrayref 0.3.9 or earlier) and check their systems for signs of compromise.
This is a supply chain attack — and they're becoming more common because they're devastatingly efficient. Instead of attacking thousands of companies individually, you attack one trusted supplier and let the victims come to you. The software development world runs on shared, trusted packages, and that trust is now a target. Watch for more attacks like this, and expect the security community to push harder for software bills of materials and stronger account security for open-source maintainers.