Microsoft

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...
The Hacker News

148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

JFrog finds 148 npm proxy packages turned student browsers into a DDoS botnet, while a mutable loader lets operators re-arm ...

Hackers backdoor Jscrambler npm package with infostealer malware

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm ...
Bleeping Computer

CISA: Splunk Enterprise flaw actively exploited, patch by Sunday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to secure their systems by Sunday against a critical Splunk Enterprise vulnerability that is being exploited ...
SecurityWeek

Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution. A critical Splunk Enterprise vulnerability is being exploited ...
Mashable

I spent a week using AI tools in my daily life. Here's how it went.

We examine how AI is changing the future of work — and how, in many ways, that future is already here. Every tech company you can think of is jumping on the generative AI bandwagon and touting new ...