Weekly Threat & Lab Roundup: Microsoft Defender Zero-Days, Qualcomm BootROM Write-What-Where, Fox Tempest Malware Signing Service, and GitHub Supply Chain Siege
This week the theme is trust erosion — in the tools that protect us, the chips that boot our devices, the certificates that vouch for software, and the platforms that host our code. Microsoft Defender, the very security product meant to protect Windows endpoints, has two actively exploited zero-days: one that grants SYSTEM and another that kills antimalware. Qualcomm’s BootROM — the immutable root of trust in billions of devices — has a write-what-where condition that turns a phone repair into a persistence attack. Fox Tempest operated a malware-signing-as-a-service that generated over a thousand fraudulent code-signing certificates, enabling ransomware operators to dress their payloads in legitimate Microsoft signatures. And GitHub is under coordinated assault from multiple directions: Megalodon hijacks repositories through malicious workflows, TeamPCP poisons VSCode extensions, and Socket discovers malicious postinstall hooks across 700+ repositories. Meanwhile in the lab, OpenClaw got a feature-heavy upgrade, Obsidian CLI integration landed, the package tracker got a rewrite, and the homelab held steady with new Proxmox snapshots. ...