IT News Roundup: Open Source Supply Chain Attacks, Record Patch Tuesday, and SpaceX's $60B Cursor Deal - June 27, 2026

The past week in technology has been dominated by supply chain security concerns, a record-breaking round of Microsoft patches, and one of the largest startup acquisitions ever announced. From CI/CD workflow vulnerabilities affecting major tech companies to OpenAI launching an AI-driven open-source bug-fixing program, the themes are clear: software infrastructure is under unprecedented scrutiny.

Cordyceps Flaw Exposes 300+ GitHub Repositories to Supply-Chain Attacks

Cybersecurity researchers at Novee Security have identified a new class of CI/CD workflow vulnerability dubbed Cordyceps, named after the parasitic fungus known for taking over its hosts. The flaw allows attackers to hijack automated build and deployment pipelines through malicious pull requests, potentially gaining full control of code repositories.

The issue has been found affecting more than 300 GitHub repositories belonging to some of the largest technology organizations worldwide, including Microsoft, Google, Apache, and others. Unlike a single software bug, Cordyceps represents a systemic class of insecure workflow compositions that can exist across any Git-based development pipeline.

The discovery underscores growing concerns about open-source supply chain security, coming just weeks after the Miasma worm — a variant of the Mini Shai-Hulud malware — compromised 73 Microsoft GitHub repositories primarily within Azure, disrupting CI/CD workflows globally. Organizations are urged to audit their workflow configurations and restrict permissions on automated pipeline triggers.

Source: The Hacker News

Microsoft Sets Record with 200+ Vulnerabilities in June Patch Tuesday

Microsoft released its largest-ever Patch Tuesday update on June 9, addressing 206 vulnerabilities across its entire product ecosystem — surpassing the previous record of 167 CVEs set earlier in the program's 23-year history. The update covered Windows 11, Windows Server, Microsoft Office, Exchange Server, .NET Framework, Azure services, Hyper-V, Remote Desktop Services, and HTTP.sys.

The release included fixes for six zero-day vulnerabilities: five that were publicly disclosed before a patch was available, and one actively being exploited in the wild. Notable among these are CVE-2026-45586 (elevation of privilege), CVE-2026-49160 (denial-of-service in HTTP.sys), and CVE-2026-42897 (server spoofing). The update also addressed 33 critical-severity flaws.

System administrators are advised to prioritize deployment of these patches immediately, particularly for systems exposed to the internet. Google also patched a Chrome zero-day being actively exploited during the same window, making this one of the most consequential 48-hour periods in recent cybersecurity history.

Sources: BleepingComputer, CyberSecurityNews

OpenAI Launches "Patch the Planet" to Secure Open Source Software

On June 22, OpenAI announced Patch the Planet, a new initiative under its Daybreak cybersecurity program designed to find and fix vulnerabilities in widely used open-source software. Built in partnership with Trail of Bits, HackerOne, and Calif, the program leverages OpenAI's GPT-5.5-Cyber model alongside expert human review.

Early results have been significant: the initiative has already identified 8 Linux kernel pointer-leak proof-of-concepts, 24 local privilege escalation exploits, over 10 exploitable Safari vulnerabilities, and a critical Firefox vulnerability (CVE-2026-8390) that was patched two days before Pwn2Own Berlin — causing five of six registered Firefox exploit entries to withdraw.

The companion Codex Security plugin has scanned over 30 million commits across 30,000 codebases and automatically fixed more than 500,000 vulnerabilities. The program targets major open-source projects including Python, Go, and cURL, marking one of the largest AI-assisted efforts to improve open-source security to date.

Sources: OpenAI, TechCrunch

SpaceX Acquires AI Coding Platform Cursor for $60 Billion

In one of the largest startup acquisitions in history, SpaceX announced a $60 billion all-stock deal to acquire Anysphere, the San Francisco-based company behind the popular AI coding assistant Cursor. The transaction comes just days after SpaceX's historic IPO on Nasdaq and is expected to close in Q3 2026.

The $60 billion valuation represents a 3.4% dilution at SpaceX's IPO price, making it one of the most expensive acquisitions of a venture-backed startup globally. The move signals SpaceX's intention to build an integrated AI software development capability in-house, competing directly with Anthropic and OpenAI in the developer tools space.

The acquisition has drawn attention for its scale and speed — from IPO to mega-acquisition in mere days — and raises questions about how a aerospace company plans to integrate and operate one of the most popular AI coding platforms. Industry observers note that Cursor's technology could accelerate SpaceX's own software development across rocket design, satellite operations, and Starlink infrastructure.

Sources: CNBC, Ars Technica

ShinyHunters Extortion Campaign Hits Kodak and Madison Square Garden

The cybercrime group ShinyHunters has continued its aggressive extortion campaign throughout June, targeting high-profile organizations including Eastman Kodak and Madison Square Garden Sports Corp. The group is running multiple parallel attack tracks rather than working sequentially on individual victims.

Kodak confirmed a data breach after ShinyHunters listed the company on its leak site on June 15, claiming to have stolen more than 2.2 million records including customer personally identifiable information and internal corporate files. The group threatened to publish the data by a June 18 deadline.

In a separate attack, ShinyHunters breached Madison Square Garden Sports Corp., exposing over 26 million records. After MSG missed a ransom deadline on June 15, the group published a 45 GB data dump just days after the New York Knicks captured their first NBA championship in 53 years. Customers have since filed lawsuits against MSG over the breach.

Sources: Malwarebytes, New York Times

Miasma Worm Compromises 73 Microsoft GitHub Repositories

A major open-source supply chain attack dubbed Miasma — a variant of the Mini Shai-Hulud worm — compromised 73 Microsoft GitHub repositories, primarily within Azure, disrupting CI/CD workflows worldwide. The June 5 campaign exposed a new attack path through AI developer tools.

The Miasma worm represents an evolution in how attackers target software supply chains, moving beyond traditional package-based attacks to directly compromise the development infrastructure itself. By targeting Microsoft's own repositories, the attackers demonstrated that even well-resourced organizations with mature security practices remain vulnerable to sophisticated supply chain threats.

This incident, combined with the Cordyceps vulnerability discovery, highlights a broader trend: CI/CD pipelines have become one of the most attractive targets for adversaries seeking maximum impact from minimal effort. Organizations should review their repository permissions, enforce branch protection rules, and implement code signing as defense-in-depth measures.

Source: Open Source For U

Two-Thirds of Open Source Community Unaware of EU Cyber Resilience Act

A leading open-source security body has warned of "stagnating awareness and structural unreadiness" in the community ahead of the European Union's Cyber Resilience Act (CRA) enforcement deadline. According to a survey published by Infosecurity Magazine, approximately two-thirds of open-source developers remain unaware of the regulation's requirements.

The CRA imposes mandatory cybersecurity requirements on digital products sold or distributed in the EU market, including software and firmware. The regulation has significant implications for open-source maintainers whose code is incorporated into commercial products, as downstream vendors may need to demonstrate compliance using upstream components.

The European Open Source Security Forum recently focused on turning CRA commitments into concrete action, but progress remains uneven. As enforcement deadlines approach, the gap between regulatory expectations and community readiness continues to widen, raising concerns about potential disruptions to open-source software distribution channels.

Source: Infosecurity Magazine