Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Fedora 43 openQA Critical CVE-2025-13465 Prototype Pollution Advisory
This update provides new upstream snapshots of openQA and os-autoinst, with various fixes and enhancements. Please see upstream changelogs for details. They al…
Debian 11: SOGo Important XSS Issue DLA-4386-1 CVE-2025-63498
The SOGo groupware server is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter, allowing arbitrary JavaScript to be executed when a user vi…
Google Issues Security Fix for Actively Exploited Chrome V8 Zero-Day Vulnerability
Google on Monday released security updates for its Chrome browser to address two security flaws, including one that has come under active exploitation in the w…
Debian LTS: Angular.js Critical ReDoS Issues DLA-4242-1 CVE-2022-25844
angular.js a popular JavaScript framework was affected by multiple vulnerabilities. CVE-2022-25844
Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update
Google has released security updates to address a vulnerability in its Chrome browser for which an exploit exists in the wild.The zero-day vulnerability, track…
New Chrome Security Vulnerabilities Require Urgent Action
Two new Chrome vulnerabilities have surfaced, and despite how often we hear about Chrome in the news, these bugs are not the kind we can afford to brush off. B…
Mageia 2025-0168: thunderbird
Sender Spoofing via Malformed From Header in Thunderbird. (CVE-2025-3875) Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:…
Debian 11 Bullseye: DLA-4152-1 critical: nodejs out-of-bounds issue
Node.js a popular server side javascript engine was affected by a vulnerability on 32bits architecture. Build processes for libuv and Node.js for 32-bit system…
Debian LTS: DLA-4067-1: nodejs Security Advisory Updates
Node.js a JavaScript runtime environment was affected by a vulnerability. A memory leak could occur when a remote peer abruptly closes the socket without sendi…
Google Releases Chrome Update Mitigating Severe Code Execution Vulns
Google recently issued a crucial Chrome update that those using a version of the browser prior to version 132.0.6834.110 should implement immediately. External…
Don't Delay: Google Releases Chrome Update Addressing Serious Security Vulns
Google recently issued a crucial Chrome update that those using a version of the browser prior to version 132.0.6834.110 should implement immediately. External…
CISA Adds Five-Year-Old jQuery XSS Flaw to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday placed a now-patched security flaw impacting the popular jQuery JavaScript library…
Python-Based Malware Powers RansomHub Ransomware to Exploit Network Flaws
Cybersecurity researchers have detailed an attack that involved a threat actor utilizing a Python-based backdoor to maintain persistent access to compromised e…
Debian LTS: DLA-4013-1: node-mocha Security Advisory Updates
mocha a javascript test framework was affected by two vulnerabilities in nanoid component.
Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities
Apple has released security updates for iOS, iPadOS, macOS, visionOS, and its Safari web browser to address two zero-day flaws that have come under active expl…
Malicious NPM Packages Target Roblox Users with Data-Stealing Malware
A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer ma…
Debian LTS: DLA-3956-1: smarty3 Security Advisory Updates
Multiple vulnerabilties were discovered for smarty3, a widely-used PHP templating engine, which potentially allows an attacker to perform an XSS (e.g JavaScrip…
Chrome Update Mitigates Critical Type Confusion Vulnerabilities
Google recently rolled out a critical security update for its widely-used Chrome web browser, addressing several critical vulnerabilities, most notably two hig…
WordPress LiteSpeed Cache Plugin Security Flaw Exposes Sites to XSS Attacks
A new high-severity security flaw has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable malicious actors to execute arbitrary JavaSc…
Google Warns of CVE-2024-7965 Chrome Security Flaw Under Active Exploitation
Google has revealed that a security flaw that was patched as part of a software update rolled out last week to its Chrome browser has come under active exploit…
SocGholish Malware Exploits BOINC Project for Covert Cyberattacks
The JavaScript downloader malware known as SocGholish (aka FakeUpdates) is being used to deliver a remote access trojan called AsyncRAT as well as a legitimate…
DarkGate Malware Exploits Samba File Shares in Short-Lived Campaign
Cybersecurity researchers have shed light on a short-lived DarkGate malware campaign that leveraged Samba file shares to initiate the infections.Palo Alto Netw…
Mageia 2024-0256: python-js2py Security Advisory Updates
CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code References: - https://bugs.mageia.org/show_bug.cgi?id=33354
Mageia 2024-0231: thunderbird Security Advisory Updates
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…