IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively. According to JFrog, the information stealer...

CVE-2026-2590

Devolutions Remote Desktop Manager versions 2025.3.30 and earlier (and versions prior to 2026.1.6 ) are vulnerable to a sensitive information exposure flaw. The connection entry component fails to properly enforce the "Disable password saving in vaults" setting. This allows an authenticated user ...