Top stories.
- Target employees say leaked source code is real.
- CISA warns of actively exploited Gogs zero-day.
- Researchers identify large-scale Magecart operation.
Target employees say leaked source code is real.
Multiple current and former Target employees have confirmed the legitimacy of stolen source code being offered for sale by criminal threat actors, BleepingComputer reports. The employees recognized internal platform names, proprietary project identifiers, and elements of Target’s technology stack, including its customized CI/CD tooling.
Shortly after BleepingComputer contacted Target about the alleged leak, the company sent an internal memo to employees notifying them of a rapid security change that restricted access to its internal Git server to corporate networks or VPN only.
The source of the leak is unclear, but researchers at Hudson Rock say they identified a Target employee's workstation that was infected with infostealer malware in late September 2025. This workstation had "extensive access to internal services," including IAM, Confluence, wiki, and Jira. Hudson Rock told BleepingComputer, "It's especially relevant because, despite tens of infected Target employees we've seen, almost none had IAM credentials and none had wiki access, except for one other case."
CISA warns of actively exploited Gogs zero-day.
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered Federal agencies to lock down or stop using the self-hosted Git service Gogs, due to an unpatched high-severity flaw that was disclosed in December, the Register reports. The flaw, tracked as CVE-2025-8110, is a "path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution."
The vulnerability was discovered by researchers at Wiz, who identified more than 700 compromised Gogs instances exposed to the Internet. Attackers have been exploiting the flaw since at least July 2025, and a patch has not been released. CISA has ordered Federal civilian agencies to apply mitigations or discontinue use of Gogs by February 2nd.
Researchers identify large-scale Magecart operation.
Silent Push has published a report on a new Magecart credit card skimming campaign, which has been running since the beginning of 2022. The campaign uses malicious JavaScript to skim information from checkout pages tied to major payment networks, including American Express, Diners Club, Discover, JCB Co., Ltd., Mastercard, and UnionPay. The researchers note, "Enterprise organizations that are clients of these payment providers are the most likely to be impacted."
