101 Malicious npm Packages Add Developers to WhatsApp Groups
September 30, 2026
OX Security found 101 malicious npm packages in a campaign called PhantomSub that add developers to WhatsApp groups without consent
Application Security
101 Malicious npm Packages Add Developers to WhatsApp Groups
OX Security found 101 malicious npm packages in a campaign called PhantomSub that add developers to WhatsApp groups without consent after installation.
Kiteworks Patches Critical Flaw Found During Precautionary Shutdown
Kiteworks discovered and patched a previously unknown critical flaw during a precautionary shutdown ordered after a federal warning of an imminent attack.
Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks
Apple patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics exploited in extremely sophisticated targeted attacks reported by Meta.
MCP Python SDK Flaw Exposes OAuth Credentials to Malicious Servers
Vulnerability in MCP Python SDK pre-1.30.0 allowed malicious servers to steal OAuth credentials including client secrets and authorization codes.
Over 16,000 Supabase Databases Exposed Due to Misconfiguration
Security researchers found more than 16,000 misconfigured Supabase databases with publicly readable tables exposing PII, passwords, and tokens.
Bitget Attributes $388M Theft to Third-Party Security Product Flaw
Bitget disclosed that attackers exploited a third-party security product vulnerability to steal $388 million on September 24. North Korean actors suspected.
Carbonato Botnet Hijacks Docker Hosts to Deploy Telegram-Controlled AI
Carbonato malware installs Hermes Agent AI framework on exposed Docker daemons, then controls the agent via Telegram with a modified 39-line prompt.
DC Health Agency Exposes 400,000 Medicaid Beneficiary Records Online
Washington D.C. Department of Health Care Finance exposed approximately 400,000 Medicaid beneficiary records through a misconfigured web portal accessible without authentication.
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in May.
Cloudflare Containers Flaw Exposed Leftover Customer Disk Data
Cloudflare disclosed a vulnerability allowing customers to read leftover disk data from other customers' previous containers, violating tenant isolation controls.
Kiteworks Patches Critical Flaw Found During Precautionary Shutdown
September 30, 2026
Kiteworks discovered and patched a previously unknown critical flaw during a precautionary shutdown ordered after a federal warning of an
Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks
September 29, 2026
Apple patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics exploited in extremely sophisticated targeted attacks reported by Meta.
MCP Python SDK Flaw Exposes OAuth Credentials to Malicious Servers
September 29, 2026
Vulnerability in MCP Python SDK pre-1.30.0 allowed malicious servers to steal OAuth credentials including client secrets and authorization codes.
Over 16,000 Supabase Databases Exposed Due to Misconfiguration
September 29, 2026
Security researchers found more than 16,000 misconfigured Supabase databases with publicly readable tables exposing PII, passwords, and tokens.
Bitget Attributes $388M Theft to Third-Party Security Product Flaw
September 29, 2026
Bitget disclosed that attackers exploited a third-party security product vulnerability to steal $388 million on September 24. North Korean actors
Carbonato Botnet Hijacks Docker Hosts to Deploy Telegram-Controlled AI
September 29, 2026
Carbonato malware installs Hermes Agent AI framework on exposed Docker daemons, then controls the agent via Telegram with a modified
DC Health Agency Exposes 400,000 Medicaid Beneficiary Records Online
September 29, 2026
Washington D.C. Department of Health Care Finance exposed approximately 400,000 Medicaid beneficiary records through a misconfigured web portal accessible without
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
September 25, 2026
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in
Cloudflare Containers Flaw Exposed Leftover Customer Disk Data
September 25, 2026
Cloudflare disclosed a vulnerability allowing customers to read leftover disk data from other customers’ previous containers, violating tenant isolation controls.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.