🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

npm v12 Ships With Install Scripts Off by Default, Begins De...

npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

socket.dev

I'm reading a bunch of Coruna reports after dinner because I am a cool person who knows how to party. Of particular interest: not only does Coruna not work against iOS in lockdown mode, but if it even detects lockdown mode running, it bails. This is why I talk about lockdown mode so damn much.

Here we go. Free, no-reg versions of favorite stories from my four years at the Washington Post. First, three pieces from our Pulitzer-finalist series on how India's ruling party coerced U.S. tech giants into violating their own policies. www.washingtonpost.com/world/2023/0...

Under India’s pressure, Facebook let propaganda and hate speech thrive

Facebook has retreated from its professed ideals in India under pressure from Prime Minister Narendra Modi’s Bharatiya Janata Party.

washingtonpost.com

OpenAI disrupted new malicious use of ChatGPT... mostly for romance scams and info-ops openai.com/index/disrup...

Disrupting malicious uses of AI

Our latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

openai.com

Cisco said there are no workarounds for the vulnerability and urged customers to apply available patches immediately. The company also recommended reviewing system logs, validating controller integrity, and implementing additional hardening measures where possible. www.csoonline.com/article/4137...

Five Eyes issue emergency directive on exploited Cisco SD-WAN zero-day

The Five Eyes cybersecurity agencies warn that a critical Cisco SD-WAN vulnerability is under active exploitation and should be patched immediately.

csoonline.com

patch ye MongoDB, there's an exploit for a vuln which has been in the product for over a decade that allows the remote, unauth read of any memory - which includes plaintext creds. Somebody posted an exploit on Christmas Day, Merry Christmas! doublepulsar.com/merry-christ...

Merry Christmas Day! Have a MongoDB security incident.

Somebody from Elastic Security decided to post an exploit for CVE-2025–14847 on Christmas Day.

doublepulsar.com

HARDEN YO' N8N - [CVSS 10.0 RCE] Remote Code Execution via Expression Injection m.cje.io/4qhl2JX cc: @networkchuck @danielmiessler @jhaddix

Remote Code Execution via Expression Injection

### Impact n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users dur...

m.cje.io

I may have gone overboard on the Halloween goodies this year #halloween

This report from @interseclab.bsky.social on how a Chinese company is exporting some of the capabilities of "The Great Wall of China" to other autocratic countries is INSANELY INTERESTING: interseclab.org/wp-content/u... *EVERY Page is worth reading* Some interesting tidbits in the thread

Plex was hacked. It included usernames, emails, and hashed passwords. Change your passwords when you can,

tierney cyren@bnb.im · 11mo ago

official (not my email) source, thanks @zunderscore.tv for the link: forums.plex.tv/t/important-...

#ESETResearch has discovered the first known AI-powered ransomware, which we named #PromptLock. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes 1/7

SentinelOne and Beazley Security have discovered a new Windows infostealer used in the wild named PXA Stealer, most likely the work of a Vietnamese-speaking cybercrime group. www.sentinelone.com/labs/ghost-i... labs.beazley.security/articles/gho...

I mean I’ve been urging people to toss their sonicwall devices into a shredder for years now 🤷🏻‍♂️

jon greig@jgreig.bsky.social · last yr.

SonicWall is urging customers to take some VPN devices offline after multiple security firms discovered a campaign of ransomware attacks over the last two weeks SonicWall did not explain if the ransomware gangs are using a zero-day therecord.media/sonicwall-po...

Our team collaborated with our friends at @sentinellabs.bsky.social to identify and disrupt a PXA infostealer campaign that has an intricate and complex delivery chain: labs.beazley.security/articles/gho... Thanks for the fantastic collab SentinelLabs team!

👀 Update from @threatintel.microsoft.com: 'our continued monitoring of exploitation activity by Storm-2603 leading to the deployment of Warlock ransomware' www.microsoft.com/en-us/securi... #Microsoft #SharePoint #cybersecurity #ransomware @gate15.bsky.social @ransomwaresommelier.com @ecrime.ch

Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog

Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers. In addition, we have observed a...

microsoft.com

We’re actively seeing this exploitation as well. Here is my team’s advisory on this vulnerability: labs.beazley.security/advisories/B... Is your have a publicly exposed SharePoint server, its probably already compromised so get ready to do some IR.

🩸& #threatintel | We (GreyNoise) just published a quick note (www.greynoise.io/blo...) regarding CVE-2025-5777 - CitrixBleed 2 1/2

Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public

GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.

greynoise.io

Two high-severity patches are coming to Node.js on Tuesday nodejs.org/en/blog/vuln...

Context: labs.watchtowr.com/pre-auth-sql...

Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257)

Welcome back to yet another day in this parallel universe of security. This time, we’re looking at Fortinet’s FortiWeb Fabric Connector. “What is that?” we hear you say. That's a great question; no o...

labs.watchtowr.com

Worth turning on if you have AT&T. Other carriers (like T-mobile) have similar programs.

Need something positive to do in your life this week? If you don’t have a library card, go get one. Then learn about all the awesome things your local public library has to offer.

This is related to ROP code exec on switch 2

David Buchanan@retr0.id · last yr.

userland ROP on day 1 💪

New, by me: Data broker giant LexisNexis has revealed that its risk solutions unit (think "know your customer," risk assessing, due diligence, and law enforcement assistance) was breached, affecting the personal data and Social Security numbers of at least 364,000 people.

Data broker giant LexisNexis says breach exposed personal information of over 364,000 people | TechCrunch

The data collector said the stolen data includes Social Security numbers.

techcrunch.com

Just the tip of the iceberg from this roll-your-own security protocol. We're about to usher in a golden age of Valhalla-level AI pwnage, and it'll be riding on the coattails of badly designed agents. invariantlabs.ai/blog/mcp-git...

GitHub MCP Exploited: Accessing private repositories via MCP

We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security ...

invariantlabs.ai

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections. My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees. Here’s what I found and why it matters 👉 wietze.github.io/blog/bypassi...

Ubiquiti has released a security update for UniFi Protect Cameras to fix an RCE vulnerability with a severity score of 10/10 Oh boy... community.ui.com/releases/Sec...

New from 404 Media: the Signal clone the Trump administration uses was just hacked. TeleMessage makes a modified version of Signal that archives messages for government agencies, Waltz used it. A hacker got some users' messages, group chats. Hugely significant breach www.404media.co/the-signal-c...

The Signal Clone the Trump Admin Uses Was Hacked

TeleMessage, a company that makes a modified version of Signal that archives messages for government agencies, was hacked.

404media.co