Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.

...

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.

...

Linux Distros Unpatched Vulnerability : CVE-2024-9026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through...

U.S. Treasury Sanctions DPRK IT-Worker Scheme, Exposing $600K Crypto Transfers and $1M+ Profits

The U.S. Department of the Treasury's Office of Foreign Assets Control OFAC announced a fresh round of sanctions against two individuals and two entities for their role in the North Korean remote information technology IT worker scheme to generate illicit revenue for the regime's weapons of mass...

US Government Seeks Medical Records of Trans Youth

Plus: Google wants billions of Chrome users to install an emergency fix, Kristi Noem is on the move, and North Korean IT workers are everywhere...

Linux Distros Unpatched Vulnerability : CVE-2023-5870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum worker...

Malicious code in oxygen-workers-types (npm)

The package oxygen-workers-types was found to contain malicious code...

MAL-2025-28629 Malicious code in oxygen-workers-types (npm)

The package oxygen-workers-types was found to contain malicious code...

BIT-LIBPHP-2024-9026 PHP-FPM logs from children may be altered

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

BIT-LIBPHP-2022-4900 Potential buffer overflow in php_cli_server_startup_workers

A vulnerability was found in PHP where setting the environment variable PHPCLISERVERWORKERS to a large value leads to a heap buffer overflow...

BIT-LIBPHP-2021-21703 PHP-FPM memory access in root process leading to privilege escalation

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the...

Linux Distros Unpatched Vulnerability : CVE-2022-45417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited ...

Linux Distros Unpatched Vulnerability : CVE-2019-17008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects...

CVE-2025-55152

CVE-2025-55152 affects the oak middleware (Deno/native HTTP stack) with vulnerable versions 17.1.5 and earlier. Public records describe a Regular Expression Denial of Service / DoS: using specially crafted values in the headers x-forwarded-proto or x-forwarded-for can cause substantial slowdown o...

CVE-2025-55152 oak: ReDoS in x-forwarded-proto and x-forwarded-for headers

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers...

Linux Distros Unpatched Vulnerability : CVE-2020-15652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content...

Linux Distros Unpatched Vulnerability : CVE-2024-4769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses...

Linux Distros Unpatched Vulnerability : CVE-2023-32208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Service workers could reveal script base URL due to dynamic import. This vulnerability affects Firefox 113. CVE-2023-32208 Note that Nessus relies on the presen...

U.S. Sanctions North Korean Andariel Hacker Behind Fraudulent IT Worker Scheme

The U.S. Department of the Treasury's Office of Foreign Assets Control OFAC on Tuesday sanctioned a member of a North Korean hacking group called Andariel for their role in the infamous remote information technology IT worker scheme. The Treasury said Song Kum Hyok, a 38-year-old North Korean...

Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations

Since 2024, Microsoft Threat Intelligence has observed remote information technology IT workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the Democratic People’s Republic of Korea DPRK. Among the changes...