Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Researchers have discovered a new side-channel that they say can be reliably exploited to leak information from web browsers that could then be leveraged to tr…
A security update for webkit2gtk3 addresses 23 vulnerabilities, including issues that could lead to arbitrary JavaScript execution, unexpected crashes, and dat…
Think your WAF has you covered? Think again. This holiday season, unmonitored JavaScript is a critical oversight allowing attackers to steal payment data while…
Cybersecurity researchers are calling attention to a "large-scale campaign" that has been observed compromising legitimate websites with malicious JavaScript i…
A new strain of JavaScript dropper has been observed delivering next-stage payloads like Bumblebee and IcedID.Cybersecurity firm Deep Instinct is tracking the …
An active malware campaign is targeting the Python Package Index (PyPI) and npm repositories for Python and JavaScript with typosquatted and fake modules that …
Another batch of 25 malicious JavaScript libraries have made their way to the official NPM package registry with the goal of stealing Discord tokens and enviro…
Multiple vulnerabilities in WebKitGTK have been identified, leading to process crashes, memory corruption, and potential data leaks; users are urged to upgrade…
Security update
Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-inte…
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-dr…
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript t…
It was discovered that beets, a media library management system, is vulnerable to run arbitrary JavaScript code in the victim browser, exfiltrate viewable data…
Two new Chrome vulnerabilities have surfaced, and despite how often we hear about Chrome in the news, these bugs are not the kind we can afford to brush off. B…
Sender Spoofing via Malformed From Header in Thunderbird. (CVE-2025-3875) Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:…
The Ripple cryptocurrency npm JavaScript library named xrpl.js has been compromised by unknown threat actors as part of a software supply chain attack designed…
Node.js a JavaScript runtime environment was affected by a vulnerability. A memory leak could occur when a remote peer abruptly closes the socket without sendi…
Google recently issued a crucial Chrome update that those using a version of the browser prior to version 132.0.6834.110 should implement immediately. External…
Google recently issued a crucial Chrome update that those using a version of the browser prior to version 132.0.6834.110 should implement immediately. External…
Cybersecurity researchers have detailed an attack that involved a threat actor utilizing a Python-based backdoor to maintain persistent access to compromised e…
The JavaScript downloader malware known as SocGholish (aka FakeUpdates) is being used to deliver a remote access trojan called AsyncRAT as well as a legitimate…
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
A new set of 48 malicious npm packages have been discovered in the npm repository with capabilities to deploy a reverse shell on compromised systems."These pac…
