Cybersecurity
353 articles RSS
Unpatched GeoServer Zero-Day Sees Active Exploitation Within Hours of Public Disclosure
An unpatched SQL injection flaw in GeoServer's jsonArrayContains function is already being probed by attackers, watchTowr says, with no CVE or fix yet available.
Lazarus Group Exploited Windows Kernel Zero-Day via Fake Job Offers Before Microsoft's August Patch Tuesday Fix
Check Point traced CVE-2026-68820, a WinSock kernel flaw, to a North Korean campaign deploying the FudModule rootkit against defense contractors before Microsoft patched it.
OpenAI Open-Sources Codex Security CLI, Leaving the Scanner Behind a Gate
OpenAI released the command-line tool and SDK for Codex Security, formerly Aardvark, under Apache-2.0, while the underlying scanner stays limited-beta.
OpenSSH 10.5 Fixes ssh-agent Locking Bypass and Two Other Flaws, Citing AI-Assisted Bug Reports for a Faster Release Cadence
OpenSSH 10.5 patches a locking bypass in ssh-agent and two other flaws, and the project says a surge in AI-assisted vulnerability reports is pushing it toward faster, on-demand security releases.
Six npm Packages Compromised to Pull Malware Command-and-Control Addresses From Ethereum Transactions
Sonatype found six npm packages that decode malware C2 server IPs from Ethereum transaction bytes, using a technique tied to North Korea's Contagious Interview campaign.
Microsoft Expands Bug Bounty Program to Open Source and Third-Party Code, Pays Record $20 Million
Microsoft's bounty program paid over $20 million to 562 researchers this year after expanding scope to cover open-source software and third-party components.
Malicious 'Solidity Pro' VS Code Extensions Steal Crypto Wallets and Developer Credentials via Telegram Exfiltration
Yeeth Security found 'Solidity Pro' VS Code extensions that evolved from a delayed Cloudflare-Worker dropper into a Telegram-based wallet and credential stealer targeting web3 developers.
GitHub Ships an Actions Network Firewall in Technical Preview, Consolidates Months of npm and Actions Supply Chain Hardening
GitHub detailed a technical-preview Actions network firewall and rounded up npm and Actions defaults changed since February, drawing sharp Hacker News debate over delay-based defenses versus package signing.
GitLab Patches 13 Security Flaws, Including CI/CD Pipeline Tampering and a Duo Code Review Prompt-Injection Bug
GitLab's 19.2.1, 19.1.3, and 19.0.5 patch release fixes 13 vulnerabilities, including three high-severity flaws and a prompt-injection bug in Duo Code Review.
Sonatype Tracks 'Flooding Dropper' Campaign Flooding npm With 846 Malicious Packages Across Disposable Accounts
Sonatype is tracking sonatype-2026-005660, a campaign that has published 846 malicious npm packages across throwaway accounts, dropping cross-platform malware with DNS-based fallback delivery.
HashiCorp Patches Critical CVSS 10.0 Cross-Tenant Credential Bug in Terraform MCP Server
A maximum-severity flaw let one user's Terraform token be reused for other users' requests in stateless HTTP mode; two related bugs also patched in version 1.1.0.
Node.js Ships Twice-Delayed July Security Release Patching 11 CVEs as Node 18 and 20 Sit Fully Unpatched
Node.js shipped 11 CVE fixes across three High-severity HTTP/2 and Permission Model bugs on July 29, after two delays, while EOL versions 18 and 20 get nothing upstream.