Supply Chain Registries Hit the Big Red Button: RubyGems Freeze, npm Adoption Risk, and Windows Defender Gaps

News

RubyGems Suspends New Sign-Ups After Account Hijacking Wave

After the Axios npm and TanStack incidents, RubyGems is the first major registry to hit the pause button on new accounts entirely. This is a defensive signal worth watching—when registries start locking down, it means the attack surface has crossed a threshold they consider unacceptable.

OpenAI Confirms Exposure in Shai-Hulud Supply Chain Incident

When OpenAI gets hit by the same supply chain worm that hit the Axios ecosystem, it underscores how even sophisticated orgs depend on the same fragile npm/ruby dependency trees as everyone else.

Mini Shai-Hulud Worm Spreads Through Compromised Packages

The worm variant is mutating. If you haven't audited your lockfiles and pinned dependencies in the last week, now's the time. Automated SBOM diffing is the only real leverage here.

Vulnerabilities

GreenPlasma Windows Defender Bypass PoC Still Unpatched

YellowKey got patched, but GreenPlasma remains wide open with a working exploit. If you're running Windows Defender as your primary EDR, this is a gap you can't ignore right now.

BitLocker Bypass PoC Lets Attackers Read Encrypted Drives

Full disk encryption is supposed to be your last line of defense. A public PoC that bypasses BitLocker undermines endpoint security posture for every org that relies on it for compliance.

Analysis

Microsoft Dissects Kazuar P2P Botnet Architecture

Turla's Kazuar upgrade to peer-to-peer is a real operational shift—it means takedown is harder and C2 resilience goes way up. Worth reading the C2 architecture breakdown if you're building detection rules.