The Wire — 2026-05-22

Megalodon: Mass GitHub Repo Backdooring via CI Workflows

In the Megalodon campaign, an attacker pushed 5,718 malicious commits across 5,561 GitHub repos in six hours, forging identities like `build-bot` to inject GitHub Actions workflows. The mass variant (`SysDiag`) triggers on every push and pull request, while the targeted variant (`Optimize-Build`) uses `workflow_dispatch` for on-demand secret exfiltration—including AWS/GCP/Azure credentials, OIDC tokens, and SSH keys—to C2 at 216.126.225.129:8443. The attack spread via compromised Tiledesk npm package versions 2.18.6–2.18.12, originating from the legitimate maintainer's GitHub repo, not the npm account.

Why it matters

For a platform/cloud engineer managing CI/CD and open-source dependencies, this attack demonstrates a critical supply chain vector where compromised GitHub repos inject malicious workflows that can exfiltrate cloud credentials and OIDC tokens, enabling full cloud identity impersonation.

AI/ML / infoq.com

Cloudflare Completes Its Agent Infrastructure Stack with Browser Run Rebuild and Six-Layer Platform

Cloudflare rebuilt Browser Run on its Containers platform, boosting concurrency from 30 to 120 simultaneous browsers and cutting quick-action latency 50% via D1/Queues transactional state instead of Workers KV. This anchors a six-layer stack: Dynamic Workers (V8 isolates) and Sandboxes (Linux containers) for compute; Dynamic Workflows (MIT-licensed, 300 lines) for orchestration; Agent Memory (private beta, 5-channel search) for persistence; and a Stripe commerce protocol for autonomous account creation. The stack surpasses AWS Bedrock (no browser/memory) and Google GKE Sandbox (Kubernetes-centric), offering the most comprehensive managed agent infrastructure outside hyperscalers.

Lines of programming code scrolling up on a dark screen background

Open Source / arstechnica.com

A hacker group is poisoning open source code at an unprecedented scale

TeamPCP has automated supply chain attacks using a self-spreading worm (Mini Shai-Hulud), poisoning over 500 open source tools. They breached GitHub via a poisoned VSCode extension, accessing 3,800 repos of GitHub's own code. The group cycles through developer tools, having also hit OpenAI and Mercor, exploiting a flywheel of credential theft.

AI/ML / dev.to

AI Agent Failure Modes Beyond Hallucination

AI agents fail in structured ways beyond hallucination: tasks like one-shotting (trying to build an entire app in one go), mistaking partial repo activity for completion, and cold-start amnesia in fresh sessions waste context and time. Other patterns include ugly wish-granting (literal, cursed implementation), default-fill slop (mediocre defaults from training), and overengineering, as highlighted by Anthropic, Mario Zechner, and Random Labs. Recognizing these 'jaggedness' patterns helps engineers calibrate expectations and avoid over-hyped dark factory claims.

AI/ML / infoq.com

Discord Rebuilds Database Operations Around Automation to Manage ScyllaDB at Massive Scale

Discord built the Scylla Control Plane (SCP), an orchestration framework that automates complex ScyllaDB cluster management—including rolling upgrades, shadow cluster provisioning, and node recovery—using declarative YAML workflows and SQLite-backed state persistence. The framework enforces safety mechanisms such as AZ-aware concurrency limits and idempotent task retries, replacing fragile Python and shell scripts that required days of manual supervision. This automation lets Discord's small infrastructure team operate hundreds of database nodes with reduced risk and unattended execution, critical for scaling without proportional headcount growth.