🧯 The Staff Safety Desk

Sunday, September 27, 2026

6 stories

Generated with AI from public sources. Verify before relying on for decisions.

🎧 Listen to this briefing or subscribe as a podcast →

Malicious Python logging hooks and webhook proxy exhaustion lead today's briefing. We are tracking a new supply chain worm targeting development credentials, structural rate-limit flaws in OpenClaw, and the continued fallout from unpinned GitHub Actions tags.

GitHub Actions & Supply Chain

MemTensor Supply Chain Compromise Exposes Credentials via Sckit Malware Payload

Malicious releases of the MemOS AI framework—specifically npm package `@memtensor/memos-cloud-openclaw-plugin` (0.1.21, 0.1.23, 0.1.25) and PyPI package `MemoryOS` (2.0.34)—harbor a credential-harvesting payload named sckit. Rather than running during package installation, the malware activates during application startup via overridden logging functions, scanning home directories for GitHub, AWS, PyPI, and Slack credentials to exfiltrate to `skyleen.fr`.

Runtime-activated supply chain payloads evade standard install-time SAST checks, making immediate token revocation and process-level egress boundaries essential for background workers.

Verified across 1 sources: DEV Community

Resurrected GitHub Actions Expose Workflows via Unpinned Mutable Release Tags

Yesterday we covered the brief reinstatement of compromised actions-cool repositories; the specific affected actions were `actions-cool/issues-helper` and `actions-cool/maintain-one-comment`. Workflows referencing these via floating version tags like `@v1` resumed pulling obfuscated credential-stealing payloads until the repositories were re-disabled on September 25.

Platform suspensions offer no protection if upstream release tags remain dirty upon un-suspension, underscoring why build workflows must pin actions to full-length commit SHAs.

Verified across 2 sources: BleepingComputer · GuruTests

Web App Security Literacy

OpenClaw SMS Webhook Rate Limit Bypass Exposes Twilio Callbacks to DoS (CVE-2026-100571)

OpenClaw versions 2026.6.6 through 2026.8.0 evaluate invalid-request rate limits for SMS webhooks before executing Twilio cryptographic signature verification, while identifying clients solely by raw proxy socket addresses. In reverse-proxy setups, unauthenticated actors can send junk POSTs to fill the rate-limit bucket, causing legitimate incoming Twilio callbacks to receive HTTP 429 errors and drop SMS traffic.

Evaluating rate limits prior to cryptographic signature verification allows unauthenticated callers to exhaust shared proxy buckets and induce denial-of-service states on critical webhooks.

Verified across 1 sources: Control Assurance

In-Process Webhook Delivery Limits Fail Across Multi-Replica Deployments

An architecture audit of Trident's `webhook_concurrency.go` revealed that single-flight webhook delivery invariants relied on an in-memory Go map. When the API service scales across multiple container replicas, independent instances process matching subscriptions from Redis Streams simultaneously, resulting in duplicate external HTTP POST calls to target endpoints.

In-memory state guards completely collapse under horizontal scaling, requiring distributed locks or database-enforced unique constraints to prevent double-fulfillment.

Verified across 1 sources: GitHub

Django & Python Ecosystem

Hard-Coded Django Secret Key Fallback Enables JWT Forgery in Production Containers

A security disclosure in the AI Story repository revealed that its Docker Compose environment omitted `DJANGO_SECRET_KEY`, forcing Django to default to `django-insecure-dev-key-change-in-production`. Because Simple JWT used this fallback as its HS256 signing secret, remote attackers could craft arbitrarily elevated access tokens to access authenticated endpoints.

Framework defaults that fall back to static secret strings turn missing environment variables into complete authentication bypasses unless application startup explicitly fails on weak keys.

Verified across 1 sources: GitHub

Regulated Portal And DAO Governance

Optimistic Oracle Governance Exploits Drain $9.4M from Neutron Protocol

A governance exploit on September 22 drained $9.4 million from Neutron-controlled contracts after an attacker passed a proposal titled 'AI Agent Takeover'. The proposal slipped through low voter participation and executed eleven hidden `MsgUpdateAdmin` calls to reassign contract ownership before Cosmos Hub validators halted the chain to initiate asset clawbacks.

Optimistic governance models where low turnout defaults to passage allow malicious administrative payload updates to execute unchallenged without requiring majority token acquisitions.

Verified across 1 sources: Hoge Wire


The Big Picture

Runtime Execution Hooks Bypass Package Installation Scanners Attackers are shifting malicious execution out of postinstall scripts and into standard runtime initialization paths, such as modified logging functions. This bypasses static build-time installation checks and triggers credential harvesting directly inside running worker processes.

Process-Local State Breaks High-Availability Invariants Concurrency checks, rate limits, and single-flight delivery logic implemented in application memory fail silently when scaled across multiple replicas. Moving these guards into atomic database transactions or distributed Redis stores is necessary to prevent duplicate actions under load.

Unpinned CI Dependencies Create Passive Re-Infection Vectors Relying on mutable release tags in GitHub Actions allows compromised or resurrected upstream repositories to re-inject malicious code into automated build pipelines without requiring new commits or developer interaction.

What to Expect

2026-11-12 — PostgreSQL 14 reaches End-of-Life (EOL) and will cease receiving security patches.

Every story, researched.

Every story verified across multiple sources before publication.

🔍

Scanned

Across multiple search engines and news databases

405
📖

Read in full

Every article opened, read, and evaluated

120
⭐

Published today

Ranked by importance and verified across sources

6

— The Staff Safety Desk

🎙 Listen as a podcast

Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.

Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste
Overcast
+ button → Add URL → paste
Pocket Casts
Search bar → paste URL
Castro, AntennaPod, Podcast Addict, Castbox, Podverse, Fountain
Look for Add by URL or paste into search

Spotify isn’t supported yet — it only lists shows from its own directory. Let us know if you need it there.