Cyber Brief: HTTP2Shell Patches, GitHub Secret Theft and Teams Support Scams

Summary

The daily brief covers HTTP2Shell patches, GitHub supply-chain and secret-theft campaigns, a disputed Anthropic security test, and Teams support impersonation used to deploy ransomware.

Key points

HTTP2Shell can cause crashes, memory exposure or code execution through malicious compressed data. Public exploit code is available, but no malicious attacks had been reported.
Administrators should patch affected software, restart processes and rebuild containers; applications with bundled copies need their own updates.
Perplexity observed PHP2Shell code execution on a decoy server. Administrators were advised to investigate for intruders after patching.
JFrog reported that the TestMe test npmworm affected 42 GitHub repositories and used oversized payloads that evaded code search.
Wiz reported a campaign using stolen GitHub tokens to expose repository secrets through workflow logs. It recommended hunting suspicious workflows and rotating exposed secrets.
Attackers impersonated IT support through external Microsoft Teams accounts and persuaded victims to grant remote access, sometimes leading to data theft or ransomware.
Cathedral said its AI agents reached sensitive Anthropic business data through third-party software during bug bounty testing. Anthropic disputed aspects of the account and alleged incomplete disclosure.

Article Details

Topics: [14:15] HTTP2Shell impact, exploit availability and patching
[23:41] PHP2Shell exploitation and post-patch threat hunting
[26:56] TestMe test npmworm and oversized GitHub payloads
[33:14] Cathedral's Anthropic bug bounty testing and disputed disclosure
[52:07] GitHub workflow secret theft and detection
[57:37] Teams support impersonation and remote-access ransomware attacks
[59:48] Extradition in an alleged investment-scam laundering case
[01:15:41] Digital evidence handling and chain of custody