First report from Project Glasswing: humans can’t keep up with patching

Anthropic published the first report from Project Glasswing. A GitHub developer installed an infected version of the Nx Console extension for VS Code — it was available on the Marketplace for just 18 minutes. Attackers smuggled a backdoor into the Laravel-Lang PHP packages using Git tags. And French and Dutch authorities, together with Europol, seized 33 servers across 27 countries. Four stories from the past week, all sharing one common thread: today’s attacks don’t start in the target system — they start in the tools you trust. Welcome to Security Sunday.

On May 22, Anthropic published the first interim report from Project Glasswing — an initiative aimed at securing the world’s most critical software using the not-yet-public Claude Mythos Preview model, before similarly capable models fall into attackers’ hands.

After one month of active deployment, Anthropic has roughly 50 partners and more than 10,000 high- or critical-severity vulnerabilities discovered across systemically important software.

Independent third parties confirm the results. The UK AI Security Institute reports that Mythos Preview is the first model to solve both of their cyber ranges, Mozilla found and fixed 271 vulnerabilities in Firefox during testing, and the XBOW platform described Mythos as a significant leap beyond all existing models.

One concrete and already-patched example is CVE-2026–5194 in the wolfSSL cryptographic library, which Mythos Preview discovered and reported. It was a certificate-validation flaw that allowed an attacker to slip in a forged certificate and have the library accept it as valid. NVD scored the CVSS at 9.3, while Red Hat went as high as 10.0 — and since wolfSSL runs on roughly 5 billion devices (IoT, routers, automotive, industrial, and military systems), the real-world impact is massive.

Anthropic admits that the human element has become the bottleneck. Out of 6,202 estimated high/critical vulnerabilities in open-source projects, 1,752 findings have so far been independently verified — 90.6% confirmed as true positives, and 62.4% genuinely classified as high or critical. According to Anthropic, however, open-source maintainers are overstretched, and some have actually asked Anthropic to slow down disclosures because they can’t keep up with writing patches.

On average, it takes two weeks to fix a high/critical bug found by the model. Commercial partners move faster: the latest Palo Alto Networks release contained five times the usual number of patches, Microsoft has announced that upcoming Patch Tuesdays will include more fixes, and Oracle reports significantly faster identification and remediation of vulnerabilities.

Do you know whether your systems are secure?

Every week I bring examples of attacks and vulnerabilities that can affect anyone. If you are not sure whether your infrastructure is resilient, we would be happy to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and simulated phishing campaigns.

Get in touch — your first consultation or vulnerability scan for one domain or IP address is free.

Hackers stole nearly 4,000 internal GitHub repositories via an infected VS Code extension

GitHub has confirmed a serious security incident in which attackers gained unauthorized access to approximately 3,800 of its internal repositories. The compromise itself occurred on Monday, May 18, 2026, and GitHub detected the attack the following day. The incident has been attributed to the threat group TeamPCP (also tracked under the codename UNC6780), which subsequently offered the stolen data for sale.

The entry point was an infected version of the popular Nx Console extension for Visual Studio Code, which one of GitHub’s developers had installed on their machine. The malicious version, labeled 18.95.0, was available on the official Visual Studio Marketplace for just 18 minutes, and on the alternative OpenVSX registry for roughly 36 minutes. Even this brief window was more than enough for the attackers — Nx Console has over 2.2 million installations.

Once executed, a command silently ran that pulled down a follow-on package, which then began harvesting credentials — including from 1Password vaults, Anthropic Claude Code configurations, npm tokens, and GitHub and AWS keys. The attackers then used the obtained secrets to move laterally across CI/CD systems, which is what enabled them to exfiltrate the internal repositories.

GitHub’s Chief Information Security Officer, Alexis Wales, stated that there is currently no evidence of impact on customer data stored outside the internal repositories. Some internal repositories do, however, contain excerpts from customer-support interactions. According to security researcher Rakesh Krishnan, the stolen repositories include code related to GitHub Actions, internal Copilot projects, CodeQL tooling, internal infrastructure, security tools, marketing, and programs such as Codespaces and Dependabot. In the meantime, GitHub has rotated key credentials and isolated the compromised device.

Laravel-Lang packages distributed a stealthy credential stealer

Security researchers have uncovered a large-scale attack targeting popular PHP libraries from the Laravel-Lang suite. The attack affected the packages laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions, into which attackers smuggled a remote-code-execution backdoor across more than 700 historical versions. It’s important to note that these are not official components of the Laravel framework — they are community-maintained localization packages, but ones widely used by Laravel-based applications. The laravel-lang/lang package alone has over 7,800 stars on GitHub, so the potential impact is substantial.

The malicious code was never committed to the official repositories. Instead, the attackers exploited a GitHub feature that allows version tags to point to commits from a fork of the same repository. Using this technique, they created tags pointing into a malicious fork under their control.

The infection originates from the file src/helpers.php, which at first glance looks like an ordinary helper file containing localization functions. Crucially, this file is registered in composer.json under the autoload.files directive, so Composer’s autoloader runs it automatically. The script first builds a fingerprint of the host by combining the path, hostname, and inode, writes a flag to a temporary directory, and thereby ensures it only runs once. It also carefully obfuscates the command-and-control domain (flipboxstudio[.]info) to evade static analysis.

The main threat is the downloaded payload, which contains roughly 6,000 lines of PHP code split into fifteen specialized modules. Once the data is collected, these modules encrypt everything, send it to the attacker’s server, and then delete themselves from disk to leave as little forensic trace as possible.

The scope of what the malware steals is enormous. It ranges from IAM access roles and cloud instance metadata, through Kubernetes Service Account tokens and HashiCorp Vault secrets, all the way to credentials for Jenkins, GitLab Runners, GitHub Actions, and ArgoCD.

The attack is fully cross-platform. On Linux and macOS, the stealer launches directly via the exec() function, while on Windows it writes a .vbs launcher and runs it through cscript.

Aikido Security, which detected the attack on May 22, immediately reported it both to the project maintainers and to the Packagist platform — which reacted quickly, pulled the malicious versions, and temporarily delisted the affected packages. If your projects have used any of the impacted packages, the guidance is clear: treat the affected systems as compromised, check composer.lock, and block the malicious versions. Then rotate every key that may have been accessible from the host.

Operation Saffron shuts down First VPN

An international coalition of law-enforcement agencies has shut down the First VPN service (also known by its 1VPNS abbreviation). It was a private network that cybercriminals used heavily to mask the origin of ransomware attacks, data theft, network scanning, and denial-of-service attacks. The operation, codenamed Saffron, was led by France and the Netherlands with support from Europol.

First VPN wasn’t an ordinary commercial VPN — it was a service deliberately designed for criminal use. It openly advertised on the Russian-speaking forums Exploit[.]in and XSS[.]is as a tool for evading law enforcement, and according to archived snapshots of its website, it promised anonymity, no log retention, and no cooperation with judicial authorities. According to Europol, the service has shown up in practically every major cybercrime investigation in recent years.

During the two-day operation, authorities seized 33 servers distributed across 27 countries and took down the primary domains 1vpns[.]com, 1vpns[.]net, and 1vpns[.]org, along with associated addresses on the Tor network. The service had been operating since roughly 2014 and offered a wide range of protocols, some of which could disguise VPN traffic as ordinary HTTPS communication, making detection significantly harder. Subscriptions ranged from two dollars for a one-day pass to 483 dollars for a full year.

The operation’s most valuable outcome, however, wasn’t the seizure of the infrastructure itself — it was obtaining the complete user database. Investigators acquired the user records, correlated individual VPN connections, and through this exposed thousands of individuals. According to Tech Times, this amounts to more than 5,000 accounts. Europol confirmed it had directly notified affected users that they had been identified.