Malicious Go, npm Packages Deliver Cross-Platform Malware, Trigger Remote Data Wipes

Cybersecurity researchers have discovered a set of 11 malicious Go packages that are designed to download additional payloads from remote servers and execute them on both Windows and Linux systems. "At runtime the code silently spawns a shell, pulls a second-stage payload from an interchangeable...

Privacy Risk Predictions Based on Fundamental Understanding of Personal Data and an Evolving Threat Landscape

It is difficult for individuals and organizations to protect personal information without a fundamental understanding of relative privacy risks. By analyzing over 5,000 empirical identity theft and fraud cases, this research identifies which types of personal data are exposed, how frequently...

Gang Wars: Breaking Trust Among Cyber Criminals

Gang Wars: Breaking Trust Among Cyber Criminals By John Fokker and Jambul Tologonov · August 5, 2025 Introduction In the final, unforgettable scene of the film Reservoir Dogs , a group of criminals — once united by a common goal — stand in a Mexican standoff, guns drawn, hearts pounding. Suspicio...

Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools

Large language model LLM agents have demonstrated remarkable capabilities in complex reasoning and decision-making by leveraging external tools. However, this tool-centric paradigm introduces a previously underexplored attack surface: adversaries can manipulate tool metadata -- such as names,...

Celebrating 200 WINtegrations—and the Partners Who Make It Possible

200 integrations strong: How our open ecosystem is redefining cloud security collaboration...

dji-log-parser (>=0.5.0, <=0.5.7) potentially affected by unknown CVE via tsify-next (0.5.6)

tsify-next CARGO version 0.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on tsify-next and may be impacted: - dji-log-parser =0.5.0, =0.5.7 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0048...

Important: Red Hat Security Advisory: 7.1 container image is now available in the Red Hat Ecosystem Catalog.

Updated rhceph-7.1 container image is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support...

Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Data

The Model Context Protocol MCP represents a significant advancement in AI-tool integration, enabling seamless communication between AI agents and external services. However, this connectivity introduces novel attack vectors that remain largely unexplored. This paper demonstrates how unsophisticat...

Important: Red Hat Security Advisory: Updated 8.1 container image is now available: security and bug fix update

Updated rhceph-8.1 container image is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support...

Exploring the Jupyter Ecosystem: an Empirical Study of Bugs and Vulnerabilities

Background. Jupyter notebooks are one of the main tools used by data scientists. Notebooks include features configuration scripts, markdown, images, etc. that make them challenging to analyze compared to traditional software. As a result, existing software engineering models, tools, and studies d...

@ccci/micro-server (>=1.0.57, <=1.0.132), @kevinkidd/aicommit (1.0.3) +10 more potentially affected by CVE-2025-8022 via bun (>=1.0.2, <=1.1.38)

bun NPM version =1.0.2, =1.0.57, =1.0.0, =0.0.0, =1.2.27, =1.2.21, =0.0.2, =0.0.33, =0.0.19-beta.11, =0.0.3, =0.0.4, =0.0.7 Source cves: CVE-2025-8022 Source advisory: OSV:GHSA-4J66-8F4R-3PJX...

10by10-react-app (1.2.1), 192.168.0.172 (4.6.1) +13883 more potentially affected by CVE-2025-7339 via on-headers (>=1.0.0, <=1.0.2)

on-headers NPM version =1.0.0, =1.0.2, =1.0.0, =0.30.0, =0.2.0, =0.0.28, =4.11.0, =4.11.46 and more Source cves: CVE-2025-7339 Source advisory: OSV:GHSA-76C9-3JPH-RJ3Q...

@_lan/uni-libs (0.0.3), @acegroup/cli-templates-vue3-element-admin (1.0.0) +694 more potentially affected by CVE-2025-53892 via @intlify/core-base (>=9.0.0, <=9.14.4)

@intlify/core-base NPM version =9.0.0, =0.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.0-next.5436b378dff7e64898bb7046afa2d5d574255b54, =0.0.0-next.0d1cf82f9dfbe1d3e7ec5644f85f97a43c8c2334, =0.7.0-beta.15, =0.7.0-beta.15, =0.0.23, =0.0.6-alpha-2.5, =1.0.0, =0.1.87, =0.3.2 and more Source cves: CVE-2025-538...

aoer-plotty-rs (>=0.3.0, <=0.4.1), d3_delaunay_rs (>=0.10.0, <=0.11.2) +46 more potentially affected by unknown CVE via i_tree (>=0.2.0, <=0.9.0)

itree CARGO version =0.2.0, =0.3.0, =0.10.0, =0.10.5, =0.1.0, =0.29.0, =0.0.2, =0.2.0, =0.7.0, =0.1.0, =0.1.1 - geodatafusion 0.1.0-dev - geograph 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0165...

We Urgently Need Privilege Management in MCP: a Measurement of API Usage in MCP Ecosystems

The Model Context Protocol MCP has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad...

eth-utils (>=0.1.1, <=0.2.0), evm (>=0.17.3, <=0.36.0) +25 more potentially affected by CVE-2025-53359 via ethereum (>=0.4.2, <=0.12.0)

ethereum CARGO version =0.4.2, =0.1.1, =0.17.3, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - ovr-evm-precompile-ed25519 2.0.0 - ovr-evm-precompile-modexp 2.0.0 - ovr-evm-precompile-sha3fips 2.0.0 - ovr-evm-test-vector-support 1.0.0 and more Source cves: CVE-2025-53359 Source advisory: OSV:GHSA-3W94-VQ2X-V5WR...

@devsoutinho/alfred-currency-converter (>=2.0.0, <=2.1.1), @felixcatto/ui (>=0.0.14, <=0.0.32) +13 more potentially affected by CVE-2025-45143 via string-math (1.2.2)

string-math NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on string-math and may be impacted: - @devsoutinho/alfred-currency-converter =2.0.0, =0.0.14, =0.4.0-beta.2, =1.5.12, =0.1.47, =0.0.32, =2.0.0, =4.0.0, =1.0.0, =1.2.0, =1.0.8,...

GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them

The GitHub Advisory Database Advisory DB is a vital resource for developers, providing a comprehensive list of known security vulnerabilities and malware affecting open source packages. This post analyzes trends in the Advisory DB, highlighting the growth in reviewed advisories, ecosystem coverag...

Important: Red Hat Security Advisory: New RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.

A new container image for Red Hat Ceph Storage 8.1 is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities,...

CVE-2025-52488

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been...