GitHub TeamPCP Breach Investigation

GitHub is investigating a claimed breach by threat actor TeamPCP affecting approximately 4,000 internal repositories. The attacker claims to have accessed sensitive GitHub infrastructure, raising concerns about the security of the platform's internal development assets. This incident highlights risks to major software development platforms and their internal code repositories.

Sources:

• https://thehackernews.com/2026/05/github-investigating-teampcp-claimed....

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters

Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data.

Sources:

• https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters...

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters

Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data.

Sources:

• https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters...

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters

Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data.

Sources:

• https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters...

🚨 British hacker just pleaded guilty to $10M+ crypto heist 🚨

Tylerb, a 24-year-old member of Scattered Spider, admitted to wire fraud and identity theft in US federal court. Here's the wild part: he didn't use fancy hacking tools. Instead, he sent fake IT texts (smishing), stole employee passwords, and his crew hit over a dozen major tech companies.

Scattered Spider's whole playbook is social engineering. SIM swaps, vishing calls, phishing texts. Low tech barrier, high success rate. Tylerb was...

🚨 OpenAI Got Hit in the TanStack Supply Chain Attack 🚨

Two OpenAI employee devices were compromised when attackers poisoned hundreds of npm and PyPI packages. Here's what went down.

TanStack is everywhere in JavaScript and Python projects. Attackers injected malicious code into the supply chain, and anyone who pulled those packages during the compromise window got exposed. OpenAI immediately rotated their code-signing certificates, which is a huge deal. Those certs prove your software is l...

👀 LinkedIn Was Quietly Inspecting Your Browser Like a Nosy Cop 👀

"BrowserGate," a report alleging LinkedIn quietly scanned users’ browsers for thousands of installed extensions and attached a hardware-style fingerprint to session activity without meaningful disclosure. LinkedIn says the probing is a security measure aimed at scraping tools, but the reporting and independent testing show the behavior is real, extensive, and a lot more invasive than most people would expect from the site where th...

Daily cybersecurity threat intelligence briefing for 2026-05-04. ...

My first story tracks a brutal trust failure inside one of the world’s most famous health research projects: data tied to all 500,000 UK Biobank volunteers was advertised for sale on Alibaba by sellers linked to research access abuse. The UK government said names and contact details were not included, but the whole selling point of de-identified health data is that it is not supposed to wind up on a Chinese marketplace like discount headphones. UK Biobank paused access, cut off the implicated in...

💥 GitHub Had an RCE Problem the Size of the Internet 💥

CVE-2026-3854, a critical GitHub flaw that let an authenticated user turn a normal `git push` into remote code execution on backend infrastructure. Wiz said the issue could expose millions of public and private repositories on affected GitHub.com storage nodes, while GitHub Enterprise Server instances faced full server compromise if left unpatched. So yes, one semicolon and a bad design assumption almost turned the world’s code locker into a...