Investigating Security Implications of Automatically Generated Code on the Software Supply Chain

In recent years, various software supply chain SSC attacks have posed significant risks to the global community. Severe consequences may arise if developers integrate insecure code snippets that are vulnerable to SSC attacks into their products. Particularly, code generation techniques, such as...

CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning

Today's cyber defenders are overwhelmed by a deluge of security alerts, threat intelligence signals, and shifting business context, creating an urgent need for AI systems to enhance operational security work. While Large Language Models LLMs have the potential to automate and scale Security...

MAL-2025-47513 Malicious code in @bgrc/kyc-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 491ac58a40b45ff06a00ad44a33a15bd95394c8fde64034d150fb31433a18380 The OpenSSF Package Analysis project identified '@bgrc/kyc-theme' @ 9000.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in across-indexer-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8fef241ea15f212acce31cd8bcc9d561a7f8a55c8367d778cca91c189d8a3a7 The OpenSSF Package Analysis project identified 'across-indexer-monorepo' @ 7.1.1 npm as malicious. It is considered malicious because: - The...

Security Evaluation of Android Apps in Budget African Mobile Devices

Android's open-source nature facilitates widespread smartphone accessibility, particularly in price-sensitive markets. System and vendor applications that come pre-installed on budget Android devices frequently operate with elevated privileges, yet they receive limited independent examination. To...

LLM-Based Vulnerability Discovery through the Lens of Code Metrics

Large language models LLMs excel in many tasks of software engineering, yet progress in leveraging them for vulnerability discovery has stalled in recent years. To understand this phenomenon, we investigate LLMs through the lens of classic code metrics. Surprisingly, we find that a classifier...

ChatGPT solves CAPTCHAs if you tell it they’re fake

If you’re seeing fewer or different CAPTCHA puzzles in the near future, that’s not because website owners have agreed that they’re annoying, but it might be because they no longer prove that the visitor is human. For those that forgot what CAPTCHA stands for: Completely Automated Public Turing te...

Exploit for Missing Authorization in Elementor Website_Builder

Отчёт по учебной практике Содержание - 1. Введение1-в...

MAL-2025-47509 Malicious code in syf-api-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a990f780ff2003775ab94c7c9d7b8cf3cf81b631fb625b0a827abd24076e9e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AEAS: Actionable Exploit Assessment System

Security practitioners face growing challenges in exploit assessment, as public vulnerability repositories are increasingly populated with inconsistent and low-quality exploit artifacts. Existing scoring systems, such as CVSS and EPSS, offer limited support for this task. They either rely on...

LLaVul: a Multimodal LLM for Interpretable Vulnerability Reasoning about Source Code

Increasing complexity in software systems places a growing demand on reasoning tools that unlock vulnerabilities manifest in source code. Many current approaches focus on vulnerability analysis as a classifying task, oversimplifying the nuanced and context-dependent real-world scenarios. Even...

Exploit for CVE-2025-2894

Unitree Robot BLE Service Command Injection Analysis !Meme...

Binwalk

This is an implementation of the Binwalk firmware analysis tool in Rust, written for speed and accuracy. Binwalk can identify and optionally extract files and data embedded inside other files, with a focus on firmware analysis. It supports a wide variety of file and data types and can even help...

Design and Development of an Intelligent LLM-Based LDAP Honeypot

Cybersecurity threats continue to increase, with a growing number of previously unknown attacks each year targeting both large corporations and smaller entities. This scenario demands the implementation of advanced security measures, not only to mitigate damage but also to anticipate emerging...

Linux Distros Unpatched Vulnerability : CVE-2025-10585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium...

Security Vulnerabilities in Software Supply Chain for Autonomous Vehicles

The interest in autonomous vehicles AVs for critical missions, including transportation, rescue, surveillance, reconnaissance, and mapping, is growing rapidly due to their significant safety and mobility benefits. AVs consist of complex software systems that leverage artificial intelligence AI,...

MAL-2025-47460 Malicious code in circuit-retained (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71eb6f38e5fe1dce06d13f2ba4d58e8a3addd8b17b529b327d02f34b54472cb5 The OpenSSF Package Analysis project identified 'circuit-retained' @ 10.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in libvirt-python (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2071f9220268a6478afd2c0c3f551190b1ac0eec255abc1d5e1dbc35744e5e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Google Patches Chrome Zero-Day CVE-2025-10585 as Active V8 Exploit Threatens Millions

Google on Wednesday released security updates for the Chrome web browser to address four vulnerabilities, including one that it said has been exploited in the wild. The zero-day vulnerability in question is CVE-2025-10585 , which has been described as a type confusion issue in the V8 JavaScript a...

MAL-2025-47426 Malicious code in playground_root (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb5ac61f295a55d3954f84caefcd0b84187f168266243137208bba3f2e77f4fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...