Aug 26, 2025
2 new incidents, 1 with updates.
Started
- ClosedPatched
Citrix NetScaler: NetScaler Memory Overflow Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service. Added to CISA KEV on 2025-08-26.
Citrix NetScalerClosed Aug 26, 2025
- ClosedPatched
s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed
Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.
nx and @nx/* npm packagesClosed Aug 29, 2025
Updated
- ClosedHighNo fix needed
Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.
Salesloft Drift integration (Salesforce, Google Workspace)Closed Sep 7, 2025
