Keyv's Signed npm Releases Carried a Credential-Stealing Worm
A compromised maintainer account published Keyv-family packages with valid provenance, an install-time credential stealer, and code that could poison more npm releases.
Read article →Page 8 of 10
Latest Articles
Gitea Org Rendering Exposes Local Files Before Server Execution
Gitea 1.22.1 through 1.27.0 can let an anonymous request read files as the service account, expose the internal token, and plant a Git hook that executes during a clone.
Read article →
Unit 42 Extracted the Master Key Protecting Google's Synced Passkeys
Unit 42 showed three post-compromise paths from Chrome's local passkey state to silent assertions, substituted verification keys, or the master secret protecting synced credentials.
Read article →
INC Exploitation Makes SMA 1000 Hotfixes an Incident Triage Trigger
INC ransomware activity requires SMA 1000 operators to investigate logs and configuration as well as apply the hotfix.
Read article →
Chrome Fixed 1,072 Bugs, Then Changed How Updates Reach Users
Chrome fixed more security bugs in two milestones than in the previous 23 while using AI across discovery, triage and fix preparation.
Read article →
N-central Attacks Reached Customer PCs After the First Fix Fell Short
N-central operators need Hotfix 2 build 2026.3.1.10 and a downstream endpoint hunt because the new release supersedes the first hotfix.
Read article →
Galaxy Links COLDCARD RNG Flaw to Suspected $88.6 Million Theft
An integration error routed wallet entropy through MicroPython's deterministic Yasmarang fallback. Updating prevents new weak seeds, but existing ones still require migration.
Read article →
Adform Served a Script Built to Rewrite Crypto Addresses
A compromised Adform tracking file used browser events, DOM observers and form-field hooks to keep substituting Bitcoin, Ethereum and Tron addresses.
Read article →
Rails Active Storage Exposes Process Secrets Through libvips
A crafted image can reach unsafe libvips operations through Active Storage, exposing files and process credentials that a Rails-only update cannot recover.
Read article →
SourTrade Makes Browsers Assemble a Different Malware File for Each Victim
A ServiceWorker and SharedWorker combine a clean Bun runtime, delivered PE sections, and locally generated bytes before a same-origin download.
Read article →
XCSSET v40 Infects Every Xcode Project on a Compromised Mac
A poisoned build can start a memory-resident loader, re-arm through macOS preferences, and seed more projects, Git hooks, and archives.
Read article →
Certighost Lets a Domain User Impersonate a Domain Controller
A crafted AD CS chase sent the CA to rogue directory services. July updates add a real-DC check, but defenders still need issuance and replication evidence.
Read article →
24,650 Exposed BMCs Disclosed Password Hashes Before Login
IPMI's RAKP exchange exposes material for offline password cracking, leaving defenders with a management-plane incident that host telemetry may miss.
Read article →
XLab Traces 200,000-Device Dysphoria Botnet to UPnP Relays
One variant uses UPnP to open 155 inbound paths, then relays same-port traffic through infected devices that conceal the real command servers.
Read article →
FBI Says Exposed MicroLogix PLCs Disrupted Water Operations
Actors changed controller IP addresses and passwords across at least seven states. Operators need to compare running logic with a trusted baseline and investigate activity on connected devices.
Read article →
Attackers Exploit Arista VeloCloud Orchestrators Without Credentials
On-premises VCO is exposed by default. Arista says defenders must inspect web activity and managed Edge state after patching.
Read article →Showing 110–125 of 152