Target employees say leaked source code is real.

Three security briefings: Target employees confirmed leaked internal source code likely resulting from an infostealer infection on a workstation with broad internal access; CISA ordered agencies to mitigate or stop using Gogs due to an actively exploited path-traversal RCE (CVE-2025-8110) with >700 exposed instances; and Silent Push reported a long-running, large-scale Magecart JavaScript skimming campaign targeting checkout pages for major payment networks.