🔑 US cyber agency exposed its own cloud keys on GitHub

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔑 US cyber agency exposed its own cloud keys on GitHub

🔌 File-sharing firm tells customers to shut down servers now

📦 Poisoned developer tool steals cloud and crypto secrets

🔓 Hackers hijack Joomla sites via two file-upload flaws

Plus: 💡 4 strategies & tactics, 🎁 7 other news you might like, 🧰 4 tools, and 📚 5 papers.

🔑 US cyber agency exposed its own cloud keys on GitHub LINK

The US Cybersecurity and Infrastructure Security Agency confirmed a contractor leaked its privileged Amazon AWS GovCloud keys on a public GitHub repository in May, and released a forensic report Thursday detailing its response and fixes.

CISA said log analysis showed none of the leaked credentials were used outside the agency and no customer or mission data was exposed, after it took the repository offline and revoked the responsible person's access.

CISA rotated all of its secrets, resolved to use endpoint detection and response to monitor uploads to public repositories, built a GitHub incident playbook mid-incident, and moved to make reporting CISA-specific vulnerabilities easier for researchers.

🔌 File-sharing firm tells customers to shut down servers now LINK

Progress Software has told customers running ShareFile Storage Zone Controllers to immediately shut down their internet-facing Windows servers after detecting what it calls a credible external security threat targeting the on-premises component of ShareFile's hybrid deployment.

Progress has not disclosed the nature of the threat, who is behind it, whether any controller was compromised, or which version is affected, but it temporarily disabled cloud-side access and said it has no indication yet of unauthorized access to any accounts or data.

Only the hybrid Storage Zone Controller deployment is affected, not cloud-only ShareFile accounts; the same product was hit in 2023 via an unauthenticated remote code execution flaw, CVE-2023-24489, that CISA flagged as actively exploited while ShareFile still belonged to Citrix.

📦 Poisoned developer tool steals cloud and crypto secrets LINK

Attackers hijacked the Jscrambler npm package and pushed trojanized versions carrying a hidden cross-platform payload that steals cloud credentials, cryptocurrency wallet data, and developer secrets from developers, build pipelines, and CI/CD systems.

Socket detected the first malicious release, 8.14.0, within six minutes of its July 11, 2026 publication; early versions ran automatically during npm install, while later versions 8.18.0 and 8.20.0 dropped the install hook and self-executed on import.

Jscrambler confirmed the versions were published using a stolen npm publishing credential, revoked and rotated it, deprecated the malicious releases, and shipped a clean 8.22.0; organizations should remove affected versions and rotate exposed secrets.

🔓 Hackers hijack Joomla sites via two file-upload flaws LINK

Attackers are hijacking Joomla websites by abusing two file-upload weaknesses in the popular iCagenda and Balbooa extensions, uploading malicious PHP files that let them run their own code on the server.

The main flaw, CVE-2026-48939 in the iCagenda extension's "Submit an Event" feature (maximum severity, CVSS 10/10), has been exploited in automated attacks since June 15, 2026, and is fixed in iCagenda versions 4.0.8 and 3.9.15.

The companion Balbooa Forms flaw lets any anonymous visitor upload a file with no login or file-type check for unauthenticated remote code execution, patched in version 2.4.1, with admins urged to check the "images/baforms/uploads" and iCagenda attachments folders for unauthorized PHP files.

💡 Strategies & Tactics

> Hackers exploit critical auth bypass in Gitea Docker image: Gitea's default Docker image trusts login headers from any internet source, letting attackers impersonate admins without passwords, so users must upgrade immediately.

> Multiple U-Boot Vulnerabilities Enable Pre-Authentication Code Execution and Device DoS Attacks: Six flaws in the U-Boot bootloader let attackers run code or crash embedded devices before boot verification finishes, breaking trust for routers, servers, and data centers.

> New Ghostcommit Attack Hides Malicious Prompts in Images to Exploit AI Agents: Attackers hide malicious instructions inside PNG images that code-review tools ignore, tricking AI coding assistants into later leaking secret credentials as disguised number sequences.

> Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit: New Metasploit modules exploit a Flowise AI tool flaw that runs attacker code via a malicious file and a macOS privilege-escalation bug.

Other news you might like

• GigaWiper Combines Multiple Malware for System-Level SabotageLINK

• Exposed Server Unmasks Evilginx Operators Stealing Microsoft 365 Sessions and OAuth TokensLINK

• Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlaceLINK

• AI Found a Root Bug in Linux That Everyone Missed for 15 YearsLINK

• US and allies warn of Russian critical infrastructure attacksLINK

• Okta Warns of Vishing Attacks Targeting Microsoft 365 CustomersLINK

🧰 Trending tools

Kittysploit-framework: a Python-based exploitation framework featuring a V8 engine debugger, proxy interceptor, backdoor generator, and post-exploitation marketplace tools.LINK

humanbound: an open-source engine and CLI tool for adversarial testing of AI agents, runnable locally or via a cloud platform.LINK

lpe-toolkit: a Linux toolkit that detects your kernel, filters out patched exploits, and automatically runs privilege escalation attacks until gaining root.LINK

magpie: an AI agent framework for Apache projects that helps with issue triage, mentoring, drafting fixes, and developer pairing workflows.LINK

📚 Trending papers & reports

Smarter compute allocation inside language models lets a new method match the accuracy of doing twice the processing work, but at a lower computational cost, by focusing extra effort only where it is needed.LINK

Chatbot misalignment turns out to be far less alarming than reported, as the scary "sudden bad behavior" effect largely disappears once you account for simple differences in response length.LINK

Fact-checking knowledge graphs now works 9.4 percentage points more accurately using a smarter search system that also cuts the number of lookups from 3.24 to 1.63, making large-scale automated error detection far cheaper.LINK

Legal case search gets smarter by breaking court documents into meaningful sections and mapping relationships between legal concepts, finding more relevant precedents than tools that treat each document as one undivided block of text.LINK

Automated investor reports built by feeding company filings and economic data into a chatbot were tested with 9 individual investors across 9 companies over 4 weeks to see if the summaries were useful.LINK

Want to get the latest news differently? Find us on:

See you tomorrow for a new dose of ☕️ Cyberpresso!