Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
A new piece of JavaScript malware has been observed attempting to steal users' online banking account credentials as part of a campaign that has targeted more …
Researchers have spotted frequent occurrences of JavaScript obfuscation in regular sites that hackers have also…JavaScript Obfuscation Now Often Used By Hacker…
Researchers have discovered a new side-channel that they say can be reliably exploited to leak information from web browsers that could then be leveraged to tr…
They have demonstrated that users could open up their router's traffic as a result of visiting a web page loaded with malicious javascript. The researchers sai…
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to D…
A security update for webkit2gtk3 addresses 23 vulnerabilities, including issues that could lead to arbitrary JavaScript execution, unexpected crashes, and dat…
CiviCRM could be made to run malicious JavaScript in the user's browser if it received specially crafted input.
This update provides new upstream snapshots of openQA and os-autoinst, with various fixes and enhancements. Please see upstream changelogs for details. They al…
Think your WAF has you covered? Think again. This holiday season, unmonitored JavaScript is a critical oversight allowing attackers to steal payment data while…
Cybersecurity researchers are calling attention to a "large-scale campaign" that has been observed compromising legitimate websites with malicious JavaScript i…
Cybersecurity researchers have discovered a new campaign that employs malicious JavaScript injections to redirect site visitors on mobile devices to a Chinese …
A new strain of JavaScript dropper has been observed delivering next-stage payloads like Bumblebee and IcedID.Cybersecurity firm Deep Instinct is tracking the …
An active malware campaign is targeting the Python Package Index (PyPI) and npm repositories for Python and JavaScript with typosquatted and fake modules that …
Several security issues were fixed in SpiderMonkey JavaScript Library.
Another batch of 25 malicious JavaScript libraries have made their way to the official NPM package registry with the goal of stealing Discord tokens and enviro…
A new malware loader is active in the wild, targeting users with RATs and infostealers.…New RATDispenser JavaScript Loader Delivers Infostealers To Pilfer Pass…
Threat actors have been found using a previously undocumented JavaScript malware strain that functions as a loader to distribute an array of remote access Troj…
Researchers have presented a dedicated browser extension, 'TruffleHog,' that can facilitate bug bounty hunters. The…TruffleHog - Now a Browser Extension That D…
While Rowhammer attacks are nothing new, another exploitation of the bug has arrived. Dubbed SMASH,…New JavaScript-based SMASH Attack Confirms Rowhammer Bug As…
Update to 3.62.0 evolution-data-server Bug Fixes: I#660 - GOA EWS: Do not require OABUrl in autodiscover I#662 - EBackend: Document how OAuth2 sources should a…
Multiple vulnerabilities in WebKitGTK have been identified, leading to process crashes, memory corruption, and potential data leaks; users are urged to upgrade…
Security update
0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018
0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018
