GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement

Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package dependency chain. These attacks are especially concerning for the Go language ecosystem, which is extensively...

On the Security Risks of ML-Based Malware Detection Systems: a Survey

Malware presents a persistent threat to user privacy and data integrity. To combat this, machine learning-based ML-based malware detection MD systems have been developed. However, these systems have increasingly been attacked in recent years, undermining their effectiveness in practice. While the...

Optimal Allocation of Privacy Budget on Hierarchical Data Release

Releasing useful information from datasets with hierarchical structures while preserving individual privacy presents a significant challenge. Standard privacy-preserving mechanisms, and in particular Differential Privacy, often require careful allocation of a finite privacy budget across differen...

MAL-2025-3804 Malicious code in pog-ui-landings-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 958b647cd78bfe4822d3c9b88bb93606783f6f5c4f46fb06c118181cc545fe5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0688

CVE-2025-0688 affects the WordPress plugin Spiritual Gifts Survey (and S.H.A.P.E. survey) versions ≤ 0.9.10. The vulnerability arises because a parameter is not sanitized/escaped before being echoed in the page, producing a reflected XSS. Exploitation could impact unauthenticated users and is des...

MAL-2025-3803 Malicious code in @tribal-worldwide-london/fa-api-service (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7abb29beb3adf2fde080d372cbc17b456eb664ce599ea06f814aec289841241 Any computer that has this package installed or running should be considered...

MAL-2025-3948 Malicious code in developer-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 13d76633d0e28457718da249adad23171e53973864ef3e53406c78ced005d3af The OpenSSF Package Analysis project identified 'developer-bridge' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-3956 Malicious code in qlkube-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3dbf8b78dfd8c62a064365429aad674f445926ed19a43a3ac031b864d3fe2c1 The OpenSSF Package Analysis project identified 'qlkube-docs' @ 3.0.0 npm as malicious. It is considered malicious because: - The package execut...

AutoPentest: Enhancing Vulnerability Management with Autonomous LLM Agents

A recent area of increasing research is the use of Large Language Models LLMs in penetration testing, which promises to reduce costs and thus allow for higher frequency. We conduct a review of related work, identifying best practices and common evaluation issues. We then present AutoPentest, an...

MAL-2025-3786 Malicious code in volkswagen-onehub-components-raj (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c6a188821a8fcc9aba3c1c6731edb7d72a5fb18997b43678070ad3234057f807 The OpenSSF Package Analysis project identified...

Malicious code in webpack-cli-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6923a0b0ac00b6df0f50acbb796a23891fbe7d857f5f130a62b03f3a7cea9da8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3784 Malicious code in webpack-cli-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6923a0b0ac00b6df0f50acbb796a23891fbe7d857f5f130a62b03f3a7cea9da8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3783 Malicious code in webpack-cli-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21ddac203965243a9f1a0fac7e0e5e5217dec4667917b4d23c3dc0e7780d3176 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Securing P4 Programs by Information Flow Control

Software-Defined Networking SDN has transformed network architectures by decoupling the control and data-planes, enabling fine-grained control over packet processing and forwarding. P4, a language designed for programming data-plane devices, allows developers to define custom packet processing...

PT-2025-29032

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a flaw within the fbdev core and fbcvt functionality that could lead to a kernel oops due to a division by zero error. This occurs in the fb cvt hperiod...

Security and Privacy Measurement on Chinese Consumer IoT Traffic Based on Device Lifecycle

In recent years, consumer Internet of Things IoT devices have become widely used in daily life. With the popularity of devices, related security and privacy risks arise at the same time as they collect user-related data and transmit it to various service providers. Although China accounts for a...

Defining a new methodology for modeling and tracking compartmentalized threats

In the evolving cyberthreat landscape, Cisco Talos is witnessing a significant shift towards compartmentalized attack kill chains, where distinct stages -- such as initial compromise and subsequent exploitation -- are executed by multiple threat actors. This trend complicates traditional threat...

Modeling Interdependent Cybersecurity Threats Using Bayesian Networks: a Case Study on In-Vehicle Infotainment Systems

Cybersecurity threats are increasingly marked by interdependence, uncertainty, and evolving complexity challenges that traditional assessment methods such as CVSS, STRIDE, and attack trees fail to adequately capture. This paper reviews the application of Bayesian Networks BNs in cybersecurity ris...

Siemens VersiCharge AC Series EV Chargers

SUMMARY VersiCharge AC Series EV Chargers contain two vulnerabilities that could allow an attacker to gain control of the chargers through default Modbus port or execute arbitrary code by manipulating the M0 firmware. Siemens has released new versions for several affected products and recommends...

Lightweight Hybrid Block-Stream Cryptographic Algorithm for the Internet of Things

In this thesis, a novel lightweight hybrid encryption algorithm named SEPAR is proposed, featuring a 16-bit block length and a 128-bit initialization vector. The algorithm is designed specifically for application in Internet of Things IoT technology devices. The design concept of this algorithm i...