Social media platforms crack down on drone factory recruiting game

A video game about drone warfare may look like an unusual cybersecurity story. But cybersecurity isn't only about malware or stolen passwords. Sometimes it's about understanding how online platforms are used to influence decisions, build trust, and persuade people to share personal information or...

MAL-2026-13659 Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b5dcef9a8613b9de1b3bbd1137a65cdbf087a9a96543602fb3372d7eca978f On require of this package, index.js loads./loader.js which reconstructs C2 hostnames via array-join string concealment...

Malicious code in xdaxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd The tarball contains a working browser-side account-takeover payload gated to run on noviembrenacional.com. When loaded in a logged-in victim's...

MAL-2026-13469 Malicious code in xxdxax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8922341a391ea133f4e6b95d55da2a7ee404c99a9f88f75bdc2698d3f03cc97c The package's main file i.js is an obfuscated browser-side script — its de-obfuscated form is shipped alongside as original.js — that gates execution...

EUVD-2025-210632

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

MAL-2026-12256 Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d1b853fe0164696ce54aa2550929d727c9ea06d42925934efacf57aeae3ff7 On require of the package, index.js loads loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from...

MissClick: Exploiting Digit-Serialized Coordinates to Attack GUI Grounding Models

Recent GUI visual grounding models generate screen coordinates as sequences of digit tokens that are parsed into numerical values and mapped to executable clicks. The security implications of this coordinate generation process have been largely overlooked. We observe that each coordinate digit is...

SUSE CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

Cybersecurity Detection Classification with Reasoning-Enabled Language Models

A major issue in Security Operations Centers SOCs is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models LLMs to emit a triage label directly, but does not train them to reason about whether a...

Fingerprint-Driven Automation: Coupling Reconnaissance with POC Verification

In the field of network security confrontation, reconnaissance is the first and most critical step. Accurate, efficient, and comprehensive reconnaissance can help network security workers more fully understand the target's current state, identify potential weaknesses, and formulate a targeted...

Targeted Quarantine Strategies Mitigate SIS-Model Cyber Epidemics on Complex Networks

The rapid expansion of highly connected and heterogeneous digital infrastructures has fundamentally altered the dynamics of cyber epidemics, making it increasingly important to understand how malware propagates under realistic structural and policy conditions. In this study, we employ an SIS...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

ZIMPAF and RedPhuzz: High-Fidelity Web Application Fuzzing Via Branch, Language Construct, and Function Call Monitoring

We present ZIMPAF, runtime interpreter instrumentation, and RedPhuzz, a fuzzer, to address key limitations of state-of-the-art fuzzers: inefficient instrumentation, the lack of knowledge of the execution environment, and limited web domain knowledge. ZIMPAF implements a novel multi-granular runti...

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

CVE-2023-37507 An information disclosure vulnerability affects HCL DevOps Plan

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...

Exploit for CVE-2026-23550

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It...

Malicious code in @akrai/core (npm)

The @akrai/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

CVE-2024-23575

HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more focused attack...