CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

September 19, 2026

Ravie LakshmananSep 19, 2026Vulnerability / Linux The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws...

Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root

A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain...

New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

Swati KhandelwalSep 18, 2026Vulnerability / Web Security WordPress today released patches to fix a new set of vulnerabilities in its...

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Ravie LakshmananSep 18, 2026Malware / Cyber Espionage The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan)...

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Ravie LakshmananSep 18, 2026Vulnerability / Cloud Security Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry...

An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.

In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been...

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin...

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Ravie LakshmananSep 18, 2026Malware / Web Security Cybersecurity researchers have discovered a cluster of 13 npm packages that have been...

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer