FlashFeed — news without clickbait, summarized by AI

Full text

Scientists have identified two newfound species of howler monkey in the Amazon rainforest. The discoveries could redraw branches of these primates' evolutionary tree, a new study shows.

The new species were named Alouatta iroi and Alouatta matogrossensis . The adorable creatures have bushy beards, winsome expressions and bright red fur. Their identification raises the number of known howler monkey species to 16, researchers said in a statement .

"Our study shows that the Amazon still holds remarkable biological secrets, even among well-known animals such as howler monkeys," study first author Romina Batista , a biodiversity scientist at the University of Gothenburg in Sweden and the University of Salford in the U.K., said in the statement.

One of the newfound species, A. matogrossensis , is probably on the brink of extinction. The other newfound species faces threats from a planned dam on the Rio Branco River, according to the study.

In addition to identifying the new species, the study, published Oct. 30 in the journal Communications Biology , used genetic evidence to understand when howler monkeys spread out and diversified. The researchers analyzed the genomes of 11 howler monkey species living in South and Central America, combining existing DNA datasets with new genomic information from specimens in Brazilian zoological collections.

The newfound howler monkey species Alouatta iroi , photographed in Guiana. (Image credit: John Trent CC-BY-NC-ND ) Overall, the genetic data confirmed that howler monkeys diverged from close relatives between 19 million and 13.5 million years ago . But the analysis changed the picture of more recent evolution.

For instance, the team argued that the Tapajós red-handed howler ( A. tapajozensis ) and the Amazonian black howler ( A. nigerrima ) are not as closely related as scientists previously thought. The researchers also said that the Trinidad howler ( A. insulanus ), whose status has been unclear, should be confirmed as a separate species.

RELATED STORIES

Orange-lipped monkey that roars and snorts deep in Congo rainforest is new species to science

Scientists name a new cat species for the first time in over a century

Never-before-seen footage captures moment scientists find new, giant anaconda species in Amazon

"This discovery comes at a critical time, as increasing deforestation, climate change and habitat loss threaten many Amazonian species before they are fully understood or even discovered by science," study co-author Jean Boubli , a professor and chair of primate ecology and evolution at the University of Salford in the U.K., said in the statement.

The scientists found that natural barriers such as the Amazon River, the Xingu River and the Branco River drove many howler monkeys to develop separately. Researchers believe that howler monkeys can swim across small waterways, but big rivers block groups from mixing, which led to different traits and species evolving over time. Natural barriers are a common reason why species emerge in the Amazon, the researchers noted in the study.

Primates Quiz: Go ape and test your knowledge on our closest relatives

Full text

TSMC, the juggernaut that produces roughly 90% of the world's most advanced chips, has discovered a data leak said to contain over 46,000 employee records, according to Seeking Alpha .

The company made a Form 6-K filing with the US Securities and Exchange Commission on Thursday, stating: "TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC’s systems have been compromised."

The company says the info has been verified to match data "stored in the system services of a cloud service provider," although said provider is not named. TSMC says it has informed those impacted by the breach and is providing support, and has also engaged with the cloud service vendor, investigating authorities, and a third-party cybersecurity agency to "ascertain the facts and take necessary actions."

Taiwanese outlet United Daily News reports that hackers were allegedly offering the employee records on an underground forum for the princely sum of three bitcoin, in exchange for 6.9 GB worth of private data.

The outlet also says that, "according to information online" (via machine translation), hackers were also selling what appears to be TSMC employee data on other forums, releasing a small sample which is said to contain a vast array of personal details, including national ID numbers, addresses, and banking information.

(Image credit: TSMC) TSMC has confirmed in its statement that the leaked data is unrelated to the company's operations, or customer-related information.

This isn't the first time TSMC has been in the headlines in relation to cybersecurity. Back in 2023, ransomware outfit LockBit attempted to extort the company for $70 million after a claimed hack.

TSMC denied it had been directly hacked , revealing in a statement that IT hardware supplier Kinmax Technology had been the victim of a "cybersecurity incident" instead, which "led to the leak of information pertinent to server initial setup and configuration." Kinmax also released a statement at the time confirming the breach .

Being such a large and wealthy company at the heart of the tech supply chain, it's no surprise that hackers are keen to gain any details on TSMC if they can. In both these cases, it seems that TSMC's own systems remained secure, but an outside party may have let the side down.

Regardless, I doubt it's the last major data leak I'll be writing about before 2026 is out. This year has been characterised by cybersecurity incidents left, right and centre, and in this every-more-interconnected world, it seems even some of the most security-conscious companies are far from immune.

Full text

As Sam Spratford reports in Publisher’s Weekly , Alibris has inked a deal to make over a million books available on Temu’s massive digital marketplace. It’s not too shocking, as Alibris seems to be chasing a model of breadth and speed; the company partnered with fast fashion brand Shein last year.

Temu already sell books, though they’re mostly craft and hobby titles, many coming from overseas. The deal with Alibris is part of Temu’s Local Seller program, meaning the listings won’t affect the supply chain: books will be sourced, stored, and shipped locally in the US.

Temu (originally a play on “Team Up, Price Down”) has become a shorthand for crappy quality and weird knock-offs. It’s also been dogged by accusations of breaching data privacy and intellectual property, not to mention other bad practices; among other things, a congressional study found a high risk of forced labor in their supply line.

We’ll have to see how it works out, but it seems like expansion to a larger online footprint through consolidation or partnership is the preferred business plan for digital retailers these days. With Goliaths like Amazon out there, I get the logic, but it’s always a little dispiriting to see everything, including used books, getting funneled into the same few buckets.

Full text

Threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories

At least 1,835 repositories executed the payload and had credentials exfiltrated

Authentication tokens, AWS, Azure and Google Cloud credentials, and more, targeted

Cybercriminals were recently seen abusing multiple GitHub features to deploy infostealers and exfiltrate user’s cloud login credentials and other secrets.

Tens of thousands of repositories have already been targeted, and almost 2,000 fell prey to the attack, cybersecurity researchers Aikido said, in a recent report outlining how the attackers used stolen GitHub credentials to abuse GitHub Actions and workflows, two features designed to speed up and automate certain activities.

GitHub is a platform for developers working on open source projects. Each project has its own “repository” - a folder containing source code, configuration files, and other resources. Developers can propose changes to public repositories through a process called “pull request”, after which other developers can review and approve/decline the changes.

GitHub also has an automation service called Actions, that allows developers to automatically execute various tasks, including pull requests. These automated processes are called workflows and can be described as a set of instructions telling GitHub what to do. Here is another vital nugget of information: workflows can access sensitive credentials when required to perform these tasks.

Using compromised accounts

According to Aikido, the threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories. The researchers did not say how the attackers obtained these accounts, or how they were compromised. The pull requests were probes, not actual attacks, and were used so the attackers can see which projects they could modify.

“We're tracking this campaign as wfx-loot based on the threat actor's name for the malware and the term used for stolen secrets,” Aikido said. The pull requests were titled docs: dependency audit notes, and were submitted from branches named wfx-docs.

Of the 60,000+ matching pull requests, more than 10,000 targeted repositories the compromised accounts did not own, but could access. After establishing write access, the attackers used one of three methods to deploy a malicious script: modifying existing GitHub Actions workflows, adding a shell script triggered by an npm installation hook, or creating a new workflow file on a temporary branch.

The payload included roughly 1,500 lines of code that was present in all three scenarios. The code searched the compromised environments for sensitive information such as GitHub Actions secrets, authentication tokens, AWS, Azure and Google Cloud credentials, Docker and Kubernetes configuration files, SSH keys, API keys for AI services such as OpenAI and Anthropic, and developers' shell histories. It also searched for .env files, private keys and credentials belonging to tools such as npm, PyPI, HashiCorp Vault and Terraform.

Stealing credentials

The malware also tried to expand its access, exchanging stolen tokens for cloud sessions, spoofing service accounts, and even creating new credentials. It also modified AWS and Azure configurations to maintain access when victims rotated their compromised credentials.

Aikido says that at least 1,835 repositories executed the payload and had credentials exfiltrated. The attackers subsequently reverted their changes and deleted workflow execution logs, sometimes within a minute, to cover their tracks and make detection that much harder.

The wfx-look campaign apparently spilled into the software supply chain, as Aikido also found compromised PHP packages on Packagist and two affected Go module versions. However, the researchers said this might have been a side-effect of the attackers abusing automated publishing processes, rather than something they planned on doing.

Aikido advises anyone whose repository executed the malicious payload to consider all of their secrets and cloud credentials their workflows can access as compromised, and needing urgent rotation.

Via BleepingComputer