Information Security News

165 new CVEs on April 2 include a pre-auth RCE chain in Progress ShareFile with 30,000 exposed instances and a CVSS 10.0 SSRF in FastMCP. TP-Link Tapo camera, Convoy KVM, and WordPress plugin flaws round out the batch.

Fake installers with step-by-step SmartScreen bypass instructions have been deploying RATs and crypto miners since late 2023. Elastic Security Labs tracked 27.88 XMR ($9,392) across four wallets. The operation uses a new .NET implant called CNB Bot alongside PureRAT and …

Fourth Chrome zero-day of 2026 targets the Dawn WebGPU layer. CVE-2026-5281 is a use-after-free exploited in the wild as a likely sandbox escape primitive. CISA set an April 15 federal deadline. Same researcher reported three other Dawn/WebGL bugs in two …

88 new CVEs on March 31 include a CVSS 10.0 NocoBase sandbox escape to root RCE, a WordPress Everest Forms Pro RCE, five baserCMS command injections, and SQL injections in Umami and SciTokens. Eleven vulnerabilities scored 9.0 or above.

A CVSS 10.0 sandbox escape in NocoBase's Workflow JavaScript node lets authenticated users reach root RCE through three lines of code. The console object leaks a host-realm Function constructor via prototype chain traversal. Patched in v2.0.28.

A 57 MB source map shipped inside the npm package exposed Claude Code's full TypeScript codebase. System prompts, unreleased features like KAIROS and ULTRAPLAN, internal codenames, and a subsystem called "Undercover Mode" are now public.

A new loader called DeepLoad steals credentials from the moment of infection and reinfected a cleaned host three days after remediation through hidden WMI persistence. ReliaQuest says the obfuscation layer was likely AI-generated.

Hijacked maintainer account pushed two poisoned Axios versions to npm, delivering a cross-platform RAT to macOS, Windows, and Linux. The library has 100 million weekly downloads. Both versions have been removed, but anyone who installed them should assume full compromise.

Three days after LiteLLM, TeamPCP hit the Telnyx Python SDK on PyPI. Malicious versions 4.87.1 and 4.87.2 hid a credential stealer inside WAV audio files. The RSA-4096 key is byte-for-byte identical to the LiteLLM payload.

Attackers breached the European Commission's cloud environment and claim 350 GB stolen from Europa.eu. Segmentation held, but this is the Commission's second breach in 56 days after Ivanti zero-days hit its MDM platform in January.

Eight days after a $10 million bounty, Iran-linked Handala published 300+ emails and photos from FBI Director Patel's Gmail. The FBI called the data "historical." Metadata shows the breach predates the current conflict by months.

One compromised AWS key, 80 million unbacked stablecoins, $23 million extracted in minutes. The Resolv protocol had 18 security audits. None examined whether a single off-chain key could authorize unlimited minting with no on-chain cap.

A scan of 10 million webpages uncovered 1,748 valid API keys in production, including cloud credentials from a G-SIB bank. Stanford researchers found 84% of leaked secrets in JavaScript bundles built by Webpack. The keys had been public for an …

A CVSS 10.0 path traversal in ORY Oathkeeper bypasses all three layers of access control at once. Squid 7.5 patches a heap use-after-free in ICP handling, and a 12-year-old Perl session middleware RCE finally receives a CVE number. Full vulnerability …

Two CVSS 9.4 vulnerabilities turn n8n workflow nodes into remote code execution vectors. AlaSQL sandbox escape in the Merge node and prototype pollution in GSuiteAdmin/XML nodes both allow authenticated attackers to execute arbitrary commands and read stored credentials.