All topics
This week we dig deep into the Vercel intrusion that emerged last weekend, how it happened, what the response was, and what the downstream effects may be for defenders. Then we talk about CISA’s bizarre delayed response to the Axios npm compromise and what it signals about the agency’s capabilities going forward.
The three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.
The incident came to light on Sunday and the company says it has brought in an incident response provider to investigate the intrusion. Details of the intrusion are scant at this point.
The campaign targets high-value individuals and organizations in the cryptocurrency, digital assets, and finance sectors.
During the largest DeFi hack of 2026, it only took attackers 12 minutes to drain millions in user assets - but the build up to the attack took six months of meticulously planned social engineering.
Dennis and Lindsey dig into what we know do far about the supply chain attack on the axios NPM package, including how the attacker gained access to the maintainer’s account, the window of exposure for the malicious packages, the behavior of the RAT that’s installed on victims’ machines, and what the downstream effects may be.
