npm adds 2FA gate exposure and package installation controls for supply chain attacks
Rabi LakshmananMay 23, 2026Software Supply Chain / DevSecOps To improve security in the software supply chain, GitHub has rolled out new controls in npm that allow maintainers to explicitly approve releases before a package is publicly available for installation. This feature, called gradual rollout, is currently generally available on npm. A human maintainer is required […]
Packagist supply chain attack infects 8 packages using Linux malware hosted on GitHub
Rabi LakshmananMay 23, 2026Malware / DevSecOps A new “coordinated” supply chain attack campaign affected eight packages on Packagist that contained malicious code designed to execute Linux binaries retrieved from GitHub release URLs. “The affected packages were all Composer packages, but the malicious code was not added to composer.json,” Socket said. “Instead, it was inserted into […]
Claude Mythos AI finds 10,000 high-severity flaws in widely used software
Rabi LakshmananMay 23, 2026Artificial intelligence/vulnerabilities Anthropic revealed on Friday that Project Glasswing has helped discover more than 10,000 high-severity or high-severity vulnerabilities across some of the world’s most “systemically” critical software since the cybersecurity initiative was launched last month. As part of Project Glasswing, an initiative led by an artificial intelligence (AI) company, approximately 50 […]
Laravel-Lang PHP package compromised to deliver cross-platform credential stealer
Rabi LakshmananMay 23, 2026Supply chain attacks/malware Cybersecurity researchers have warned of a new software supply chain attack campaign targeting multiple PHP packages belonging to Laravel-Lang to provide a comprehensive credential theft framework. Affected packages include: laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions “The timing and pattern of the newly published tags indicate a broader compromise of the Laravel […]
LiteSpeed cPanel plugin CVE-2026-48172 can be exploited to execute scripts as root.
Rabi LakshmananMay 23, 2026Vulnerabilities / Web Security A maximum severity security vulnerability affecting the LiteSpeed user-end cPanel plugin has been exploited in the wild. This flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), is related to an instance of incorrect privilege assignment, which could be exploited by an attacker to execute arbitrary script with elevated privileges. […]
Drupal core SQL injection bug actively exploited and added to CISA KEV
Rabi LakshmananMay 23, 2026Vulnerabilities / Website Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw affecting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), a SQL injection vulnerability that affects all […]
First VPN dismantled in global takedown over use by 25 ransomware groups
Authorities in Europe and North America have announced the retirement of criminal virtual private network (VPN) services used by criminals to hide the origin of ransomware attacks, data theft, scanning, and denial of service attacks. The First VPN Service disruption was led by France and the Netherlands, with several other countries supporting the investigation since […]
Ghostwriter targets Ukrainian government agencies with Prometheus phishing malware
Rabi LakshmananMay 22, 2026Malware/Artificial Intelligence A Belarus-aligned actor known as Ghostwriter (also known as UAC-0057 and UNC1151 National Security and Defense Council of Ukraine) has been observed targeting government agencies in the country using decoys associated with Prometheus, a Ukrainian online learning platform. According to the Computer Emergency Response Team of Ukraine (CERT-UA), this activity […]
Megalodon GitHub attack targets 5,561 repositories with malicious CI/CD workflow
Cybersecurity researchers have revealed details of a new automated campaign called Megalodon that pushed 5,718 malicious commits to 5,561 GitHub repositories within six hours. “The attacker used a one-time-use account and forged author IDs (build-bot, auto-ci, ci-bot, pipeline-bot) to inject a GitHub Actions workflow containing a base64-encoded bash payload, exfiltrating CI secrets, cloud credentials, SSH […]
Making Vulnerable Drivers Exploitable Without Hardware
1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of individual findings, which frequently affect code whose reachability is hardware-gated. […]