GitHub has disabled automatic execution of npm lifecycle scripts following discoveries of malicious exploitation. The platform will no longer automatically run `preinstall`, `install`, and `postinstall` scripts during package installation on GitHub-hosted services. This critical security decision co
Microsoft has confirmed that certain Windows 11 systems are experiencing failures when attempting to install the latest monthly security updates. This issue prevents affected machines from receiving critical patches that address actively exploited vulnerabilities, leaving them exposed to known attac
NSO Group has allegedly violated a court order by continuing to develop and deploy exploits targeting WhatsApp users, despite ongoing litigation and explicit judicial restrictions. The Israeli spyware vendor’s Pegasus software was reportedly used to compromise WhatsApp accounts through zero-click ex
Ivanti has disclosed two critical vulnerabilities in Ivanti Sentry—CVE-2026-10520 and CVE-2026-10523—that enable unauthenticated attackers to achieve remote code execution (RCE). CVE-2026-10520 is an authentication bypass vulnerability with a CVSS score of 9.8, while CVE-2026-10523 is a command inje
Threat actors are leveraging a sophisticated multi-stage ClickFix social engineering technique to deploy MLTBackdoor malware on Windows systems. The attack chain begins with fake CAPTCHA prompts that trick users into executing malicious PowerShell commands, ultimately installing persistent backdoor
Tchap, the French government’s proprietary encrypted messaging application, suffered a significant security breach that exposed sensitive government communications. The platform, designed specifically for state officials and public servants, was compromised through authentication vulnerabilities tha
A critical vulnerability in ServiceNow’s platform has been actively exploited by threat actors to gain unauthorized access to customer instances. The flaw, affecting multiple ServiceNow versions, allows attackers to bypass authentication mechanisms and access sensitive corporate data. Organizations
A critical zero-day vulnerability in Microsoft Windows BitLocker has been discovered that allows attackers with physical or local access to bypass full-disk encryption protections. The flaw exploits weaknesses in the boot process and TPM (Trusted Platform Module) communication, enabling unauthorized
Ivanti has disclosed a maximum severity vulnerability (CVE-2025-22457) in its Sentry product that allows unauthenticated attackers to execute arbitrary code with root privileges. The flaw affects Sentry versions 10.0.2 and earlier, carrying a CVSS score of 10.0. Organizations using Ivanti Sentry mus
Six critical vulnerabilities collectively dubbed “Proto6” have been discovered in protobuf.js, a widely-used JavaScript implementation of Google’s Protocol Buffers. These flaws expose Node.js applications to remote code execution (RCE) and denial-of-service (DoS) attacks. The vulnerabilities stem fr