Megalodon Supply-Chain Campaign Infects 5,500+ GitHub Repositories
Summary
The newsletter covers Megalodon’s reported compromise of more than 5,500 GitHub repositories to steal CI secrets and credentials, alongside supply-chain security findings and other security industry developments.
Key points
- Megalodon reportedly infected more than 5,500 GitHub repositories by injecting malicious GitHub Actions workflows through fake automated commits.
- The workflows were designed to steal CI secrets, keys, tokens, credentials, and other sensitive data from developer and build environments.
- The newsletter summarizes Wiz's 2026 SDLC security report, highlighting risks across dependencies, developer machines, build systems, CI/CD, identities, and cloud credentials.
- Socket raised $60 million at a $1 billion valuation as supply-chain security expands to areas including IDE and browser extensions, AI coding tools, and MCP servers.
- Zscaler is acquiring Symmetry Systems to add data discovery and AI-agent governance capabilities; the deal terms were not disclosed.
- Cyera acquired Genie Security for a reported $50 million, adding endpoint-focused data loss prevention for sensitive data exposure involving employee devices and AI tools.
- AWS Directory Service Data APIs support automating Microsoft AD user and group actions, including disabling accounts and resetting passwords.
Article Details
- Event Type
- Cybersecurity industry news covering a reported software supply-chain attack affecting more than 5,500 GitHub repositories, security-company earnings and acquisitions, funding, and product launches.
- Impact
- The reported Megalodon attack used fake automated commits to inject malicious GitHub Actions workflows and steal credentials, CI secrets, keys, and tokens from developer and build environments. The article also reports Zscaler shares fell after softer forward guidance, alongside acquisitions and funding intended to expand security offerings.
Threat Actors
Malware
ChainDropShai-Hulud, Mini Shai-Hulud, TeamPCP, malicious npm packages, poisoned developer tooling, and stolen secrets all point in the same direction. The path from dev to prod is now one of the most useful routes for attackers,MegalodonShai-Hulud, TeamPCP, Megalodon, and poisoned packages make the timing feel very real.Shai-HuludShai-Hulud, TeamPCP, Megalodon, and poisoned packages make the timing feel very real.
Vendors
7AI🧑🚒 7AI launches agentic MDR — Autonomous investigations with 7AI security engineers, pushing MDR from analyst assist toward agent-led SecOps.Amazon Web Services🔐 AWS automates AD response — New Directory Service APIs let teams automate Microsoft AD user and group actions, including GuardDuty-to-Step Functions workflows that disable risky users.BugcrowdBugcrowd launches RL environments for AI vuln huntingCyera🧞 Cyera buys Genie Security — Cyera acquires a six-month-old Israeli startup for about $50M, adding endpoint-focused DLP for sensitive data leakage across employee devices, AI tools, and autonomous agents.Socket🔌 Socket raises $60M — Supply chain security startup hits a $1B valuation as the category expands from bad packages to IDE extensions, browser extensions, AI tools, and MCP servers.TerraTerra adds continuous network exploitation validationWiz🐳 Wiz’s 2026 report puts numbers on supply chain risk— Code, dev tools, automation, and AI are turning software delivery into one big trust problem.Zscaler📉 Zscaler gets punished after a strong quarter — Zscaler posted $850.5M in Q3 revenue, up 25% YoY, and $3.525B in ARR, also up 25% YoY, but the stock sold off after softer forward guidance.
Products
GitHub Actions🦈 Megalodon hits GitHub — 5,500+ repos were infected via fake automated commits that injected GitHub Actions workflows to steal CI secrets, keys, tokens, and credentials.PLAID ELITE7AI launched PLAID ELITE, a fully managed agentic security operations service that pairs autonomous investigations with human oversight from 7AI security engineers. The service is positioned as AI-native MDR: agents