X to Retire Twitter.com, Users Must Re-Register Security Keys by Nov 10

X formerly Twitter is asking users with security keys to re-enroll by Nov 10 as it moves logins from twitter.com to x.com for continued 2FA access...

How Attackers Bypass Synced Passkeys

TLDR Even if you take nothing else away from this piece, if your organization is evaluating passkey deployments, it is insecure to deploy synced passkeys. Synced passkeys inherit the risk of the cloud accounts and recovery processes that protect them, which creates material enterprise exposure...

EUVD-2017-9447

Malware in sbrugna...

EUVD-2017-9453

Malware in sbrugna...

EUVD-2005-1371

Malware in sbrugna...

EUVD-2017-9458

Malware in sbrugna...

kernel: security/keys: fix slab-out-of-bounds in key_task_permission

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in keytaskpermission KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in kuidval include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uideq include/linux/uidgid.h:63...

How to set up two-factor authentication (2FA) on your Facebook account

While two-factor authentication 2FA is not completely fool-proof, it is one of the best ways to protect your accounts from hackers. It adds an extra step when logging in, which is a small extra effort for you, but it dramatically boosts your security. With 2FA, you’ll be asked for a special login...

EUVD-2025-0212

Malicious code in bioql PyPI...

EUVD-2023-45616

Malicious code in bioql PyPI...

EUVD-2022-28653

Malicious code in bioql PyPI...

Securing MCP Servers with Spring AI

Model Context Protocol, or MCP for short, has taken over the AI world. If you've been following our blog, you've probably read the introduction to the topic, Connect Your AI to Everything: Spring AI's MCP Boot Starters. The security aspects of MCP have been evolving fast, and the latest version o...

PT-2025-37941

Name of the Vulnerable Software and Affected Versions Control-M/Agent versions 9.0.18 through 9.0.20 Description Files with overly permissive permissions were identified, potentially exposing keys and passwords related to SSL files, keystores, and policies. An attacker with local access to the...

Craft CMS 4.x < 4.13.8 / 5.x < 5.5.8 RCE (GHSA-x684-96hh-833x)

The version of Craft CMS installed on the remote host is 4.x prior to 4.13.8 or 5.x prior to 5.5.8. It is, therefore, affected by a remote code execution vulnerability: - A remote code execution RCE vulnerability affects Craft 4 and 5 installs where your security key has already been compromised...

MAL-2025-6341 Malicious code in react-stylizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 812122411d8ab81ce837c1af7272056e2f1dd88b413f290021a615d5ad03524e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6297 Malicious code in nonexistentgibberish (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b9dd1765a9029e224c537d8a52266bd425b43b63409e96f9d07755edf7ce3d7 Any computer that has this package installed or running should be considered...

MAL-2025-6159 Malicious code in fathom-fox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac1e7b59b9f2a49b04dac133e2367b50305f8105cbc53e45be4db10e1107daf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6016 Malicious code in vite-postcss-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0637d37f1a6fc3f427c6a79a64570aa5d30ae202fb9a5a98031c38b4dbc27ed0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5876 Malicious code in @gdstudio/web-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c2d2be9daa1f2aeccfe95af90300246eb3665a5675beeb7193abacde6d16cce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5939 Malicious code in nextjs-package-purify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0991599608fe8c26ceb79529ca2da64d1dff01f67c36d2cccd92ff994f41fb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...