A Dangerous Worm Is Eating Its Way Through Software Packages

This Wired roundup summarizes several high-impact security stories: a misconfigured Department of Homeland Security data platform exposed sensitive intelligence to thousands; patched Microsoft Entra ID flaws that could have permitted near-universal Azure account access; and a novel self-replicating supply-chain worm called Shai-Hulud that has compromised hundreds (reports range 180–700+) of NPM packages and steals credentials to propagate. The article also covers large-scale SMS spam tools and rogue cell towers, reports on Western companies enabling Chinese surveillance systems, and arrests related to the Scattered Spider criminal group.