🕵️ Unnamed attackers

The items that name it 5

• Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
  article2026-10-29It is written here as Unnamed attackers: Amazon says the first exploitation attempts began on Saturday, October 17, 2026, three days before PHP's pre-announcement on October 20, 2026.
• PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
  article2026-10-21It is written here as Unnamed attackers: Cloudflare CTO Dane Knecht reported early attacks emerging on October 21, 2026, nearly six hours before the patch shipped.
• The upgrade trap: when upgrading is the wrong answer to a CVE
  article2026-07-22It is written here as Unnamed attackers (npm maintainer account compromise).

  Compromised a maintainer account responsible for some of the most downloaded npm packages (chalk and debug), publishing malicious versions through the official channel that were auto-pulled by pipelines set to auto-update

• Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions
  article2026-06-18It is written here as Unnamed attackers (GitHub employee device compromise, May 2026).

  Attackers who compromised a GitHub employee device through a poisoned third-party VS Code extension, allowing exfiltration of roughly 3,800 GitHub-internal repositories.

• What a Fake Claude Download Says About Security Today
  writeup2026-04-09

  Operators of a malvertising campaign using a fake sponsored Google search result for 'Claude Code' to deliver credential-stealing malware targeting macOS keychain and Claude Code credentials.