OpenAI is rotating potentially compromised macOS code-signing certificates following a supply chain attack that injected malicious code through a compromised Axios package into its GitHub Actions workflow.
The attack leveraged a malicious version of the Axios HTTP library to execute unauthorized code during OpenAI's build process. The compromised package was pulled into the company's CI/CD pipeline, potentially exposing code-signing credentials used to validate macOS applications.
Code-signing certificates are critical security infrastructure—they authenticate software as legitimate and prevent tampering. If attackers obtained these credentials, they could sign malicious macOS applications that would appear trusted to users and systems.
OpenAI's response involved rotating the affected certificates to prevent their continued misuse. The incident highlights persistent vulnerabilities in software supply chains, where attackers can compromise popular open-source dependencies to reach high-profile targets.
The attack underscores the importance of hardening CI/CD security, including limiting credential access, monitoring dependency updates, and implementing strict code review practices. OpenAI has not disclosed whether any signed malicious code was distributed before the certificates were revoked.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.
McKesson, a major healthcare and pharmaceutical distributor, confirmed a cybersecurity incident involving unauthorized access to third-party applications. Extortion group ShinyHunters claims responsibility for stealing 284 million patient data records.
Fraudsters are exploiting Microsoft Teams and similar enterprise chat apps to deceive Chinese users into sending large sums of money. The trend has sparked a wave of complaints across the region.