Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...

CVE-2026-48795

creationtimestamp| type| source ---|---|--- 2026-07-16 00:27:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpy2lqb3e2s...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

PT-2026-60406

The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions against AI Coding Agents

AI coding agents set up projects by reading documentation and installing the dependencies it lists, without verifying their names, sources, or known vulnerabilities. By editing only a README, requirements file, or Makefile, an attacker can redirect the agent to an untrusted registry, a...

PT-2026-60562

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOC GETMACPROP and DLDIOC SETMACPROP ioctls on /dev/dld. drv ioc prop common in usr/src/uts/common/io/dld/dld drv.c copies the dld ioc macprop t ioctl header in once to read its pr...

PT-2026-60569

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as...

Malicious code in syft-acp-uikit (npm)

The syft-acp-uikit package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

libcap security update

2.69-7.1 - Fix TOCTOU race condition in capsetfile CVE-2026-4878 Resolves: RHEL-169302...

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a...

CVE-2026-15445: Improper Neutralization of Special Elements used in an SQL Command

The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2026-67322

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. The issue occurs because approximately 14 HTTP handlers resolve the database path paramete...

PT-2026-60451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified AWS Cognito affected versions not specified Microsoft Entra ID affected versions not specified Description One issue exists in the Linux kernel where the ECSPI is incorrectly configured when a DMA...

libsoup3 security update

3.6.5-11 - Add patches for CVE-2026-4271 and CVE-2026-5119 3.6.5-10 - Add patch for CVE-2026-1761 3.6.5-9 - Fix CVE-2026-0719 3.6.5-8 - Fix CVE-2025-14523 3.6.5-7 - Add patch for CVE-2025-12105 3.6.5-6 - Fix integer overflow in date/time parsing 3.6.5-5 - Bump revision number 3.6.5-4 - Fix severa...

ROS-20260716-73-0005

The vulnerability of Google Chrome’s WebRTC technology is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created web page...

SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3022-1 advisory. Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when ...

MAL-2026-10763 Malicious code in @edgecommons/streamlog-node (npm)

The @edgecommons/streamlog-node package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a...

CVE-2026-33443

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:27+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptrjhnh2e...

CVE-2026-15895

creationtimestamp| type| source ---|---|--- 2026-07-15 20:45:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqplnl5ild2l 2026-08-08 07:36:05+00:00| seen| https://gist.github.com/alon710/990635ffdd01b8358cf96c18cad137b7...

CVE-2026-62353

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user...