Dozens of Red Hat published packages distributed via its official npm channel were found to include a backdoor. Users who pulled the affected versions are urged to investigate for compromise and remove the malicious packages.
3:49 PMArs Technica6 stories from 6 sources
Trusted software channels and AI support became attack surfaces
Day’s Recap
Supporting Articles
Attackers briefly took over and defaced high-profile Instagram accounts, including the Obama White House and the U.S. Space Force’s top enlisted leader, with pro-Iranian content. The intrusions followed Telegram-shared instructions for manipulating Meta’s AI support assistant into triggering password resets.
1:32 PMKrebs on SecurityIBM and Red Hat plan to invest $5 billion to build an enterprise clearinghouse focused on improving open source software security. Major banks are positioned as early adopters of the effort.
5:37 AMFinextra3:49 PMArs Technica
Dozens of Red Hat packages backdoored through its official NPM channel
Summary
Dozens of Red Hat published packages distributed via its official npm channel were found to include a backdoor. Users who pulled the affected versions are urged to investigate for compromise and remove the malicious packages.
Why it matters
Compromised packages in an official npm channel can silently infect thousands of deployments through normal dependency updates.
1:32 PMKrebs on Security
Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts
Summary
Attackers briefly took over and defaced high-profile Instagram accounts, including the Obama White House and the U.S. Space Force’s top enlisted leader, with pro-Iranian content. The intrusions followed Telegram-shared instructions for manipulating Meta’s AI support assistant into triggering password resets.
Why it matters
If AI support tools can be induced to reset credentials, they turn customer service into an automated account-takeover pipeline.
5:37 AMFinextra
IBM and Red Hat to create clearinghouse for open source software security
Summary
IBM and Red Hat plan to invest $5 billion to build an enterprise clearinghouse focused on improving open source software security. Major banks are positioned as early adopters of the effort.
Why it matters
A bank-led, vendor-backed clearinghouse could reset how regulated industries manage open source supply chain risk and set de facto security standards for the ecosystem.
Other Developments
A curated list of other prominent stories from this day.
A new paper argues that frontier AI is accelerating vulnerability discovery faster than organizations can patch, exposing accumulated software insecurity from decades of speed-first development. It calls for urgent changes to responsible disclosure and software assurance practices to keep remediation competitive with discovery.
12:49 PMSchneier on SecurityPlaza Home Mortgage disclosed a security incident that may have exposed personal information belonging to customers and employees. The company reported the breach publicly and indicated that data was accessed as part of the incident.
10:49 AMHousing WireAI increases the risk that employees will be manipulated into unsafe decisions, turning human judgment into a primary attack surface. It describes three overlapping threats driven by AI’s impact on cognition, including weaponized persuasion that personalizes influence attempts to the target.
7:00 AMMIT Sloan Management Review12:49 PMSchneier on Security
Vulnerability Disclosure in the Age of AI
Summary
A new paper argues that frontier AI is accelerating vulnerability discovery faster than organizations can patch, exposing accumulated software insecurity from decades of speed-first development. It calls for urgent changes to responsible disclosure and software assurance practices to keep remediation competitive with discovery.
Why it matters
When vulnerability discovery scales faster than remediation, the internet’s baseline risk rises even if attacker sophistication stays the same.
10:49 AMHousing Wire
Plaza Home Mortgage discloses data breach affecting customers, employees
Summary
Plaza Home Mortgage disclosed a security incident that may have exposed personal information belonging to customers and employees. The company reported the breach publicly and indicated that data was accessed as part of the incident.
Why it matters
Mortgage lenders sit on high-value identity data, and a breach can quickly turn into borrower fraud, compliance scrutiny, and partner churn.
7:00 AMMIT Sloan Management Review
A Three-Minute Protocol to Reduce AI Manipulation Risk
Summary
AI increases the risk that employees will be manipulated into unsafe decisions, turning human judgment into a primary attack surface. It describes three overlapping threats driven by AI’s impact on cognition, including weaponized persuasion that personalizes influence attempts to the target.
Why it matters
AI-enabled persuasion can bypass technical defenses by reliably steering human decisions, raising breach risk even in well-instrumented environments.
Make it yours
Build Your First Pass.
Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!