OpenAI is rotating potentially compromised macOS code-signing certificates following a supply chain attack that injected malicious code through a compromised Axios package into its GitHub Actions workflow.
The attack leveraged a malicious version of the Axios HTTP library to execute unauthorized code during OpenAI's build process. The compromised package was pulled into the company's CI/CD pipeline, potentially exposing code-signing credentials used to validate macOS applications.
Code-signing certificates are critical security infrastructure—they authenticate software as legitimate and prevent tampering. If attackers obtained these credentials, they could sign malicious macOS applications that would appear trusted to users and systems.
OpenAI's response involved rotating the affected certificates to prevent their continued misuse. The incident highlights persistent vulnerabilities in software supply chains, where attackers can compromise popular open-source dependencies to reach high-profile targets.
The attack underscores the importance of hardening CI/CD security, including limiting credential access, monitoring dependency updates, and implementing strict code review practices. OpenAI has not disclosed whether any signed malicious code was distributed before the certificates were revoked.
The Clop ransomware gang created a specialized Java web shell targeting PTC Windchill and FlexPLM servers. The malware includes built-in capabilities to decrypt credentials, enumerate repositories, and exfiltrate files.
France's tax authority plans to use artificial intelligence tools to identify vulnerabilities in its systems following a cyberattack that compromised personal data of hundreds of thousands of taxpayers.
Passkeys offer stronger protection than passwords, even when paired with password managers. The shift addresses fundamental vulnerabilities in traditional authentication.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware groups are actively exploiting a high-severity Windows Task Host vulnerability. The flaw was previously flagged as under active exploitation in April.