EUVD-2025-198722

Malicious code in @ensdomains/vite-plugin-i18next-loader npm...

EUVD-2025-198742

Malicious code in @ensdomains/test-utils npm...

EUVD-2025-198743

Malicious code in @ensdomains/renewal-widget npm...

Malicious code in @ensdomains/hackathon-registrar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e716a8dcc9bc434bac11136dafe767da2dd4e8996c9ae25b809b63a2e5eb6d7b The package @ensdomains/hackathon-registrar was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198748

Malicious code in @ensdomains/thorin npm...

EUVD-2025-198752

Malicious code in @ensdomains/ens-avatar npm...

EUVD-2025-198793

Malicious code in @ensdomains/curvearithmetics npm...

EUVD-2025-198794

Malicious code in @ensdomains/dnsprovejs npm...

EUVD-2025-198797

Malicious code in @ensdomains/unicode-confusables npm...

MAL-2025-190725 Malicious code in @ensdomains/ccip-read-worker-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57b104a492d5893772494de67a98f0114e695a8d24e0444d12d0963029fc4b32 The package @ensdomains/ccip-read-worker-viem was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198656

Malicious code in @ensdomains/eth-ens-namehash npm...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Malicious code in @ensdomains/cypress-metamask (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19427e64315a085f7001dff6a896730aa4cce33cf679f6a2da0a8bc61e96fb58 The package @ensdomains/cypress-metamask was found to contain malicious code. Source: ghsa-malware...

CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat

CTM360 has identified a rapidly expanding WhatsApp account-hacking campaign targeting users worldwide via a network of deceptive authentication portals and impersonation pages. The campaign, internally dubbed HackOnChat, abuses WhatsApp's familiar web interface, using social engineering tactics t...

CVE-2025-63828

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...

PT-2025-47370

Name of the Vulnerable Software and Affected Versions Backdrop CMS version 1.32.1 Description A Host Header Injection flaw exists in Backdrop CMS. This issue allows attackers to manipulate the Host header within password reset requests. Successful exploitation can lead to redirection to malicious...

Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data

A Russian-speaking threat behind an ongoing, mass phishing campaign has registered more than 4,300 domain names since the start of the year. The activity, per Netcraft security researcher Andrew Brandt, is designed to target customers of the hospitality industry, specifically hotel guests who may...

1 million victims, 17,500 fake sites: Google takes on toll-fee scammers

A Phishing-as-a-Service PhaaS platform based in China, known as “Lighthouse,” is the subject of a new Google lawsuit. Lighthouse enables smishing SMS phishing campaigns, and if you’re in the US there is a good chance you've seen their texts about a small amount you supposedly owe in toll fees...

Operation Endgame Dismantles Rhadamanthys, Venom RAT, and Elysium Botnet in Global Crackdown

Malware families like Rhadamanthys Stealer, Venom RAT, and the Elysium botnet have been disrupted as part of a coordinated law enforcement operation led by Europol and Eurojust. The activity, which took place between November 10 and 13, 2025, marks Please remove image compression the latest phase...

Siemens SIMATIC S7-1500 Missing Encryption of Sensitive Data (CVE-2022-27779)

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...