Red Hat npm Packages Backdoored with Miasma Credential Worm
June 2, 2026
Attackers backdoored 32 Red Hat npm packages with the Miasma worm, stealing CI/CD secrets, cloud keys, and SSH keys across
Application Security
Red Hat npm Packages Backdoored with Miasma Credential Worm
Attackers backdoored 32 Red Hat npm packages with the Miasma worm, stealing CI/CD secrets, cloud keys, and SSH keys across roughly 80,000 weekly downloads.
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
A confused deputy flaw in Meta's AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space Force.
IBM WebSphere CVE-2026-8633: CVSS 9.8 No-Auth RCE Flaw Patched
CVE-2026-8633 is a CVSS 9.8 unauthenticated RCE in IBM WebSphere's Web Server Plug-ins. Patches are available for WebSphere 8.5 and 9.0 and Liberty builds.
IBM WebSphere CVE-2026-8633: CVSS 9.8 No-Auth RCE Flaw Patched
CVE-2026-8633 is a CVSS 9.8 unauthenticated RCE in IBM WebSphere's Web Server Plug-ins. Patches are available for WebSphere 8.5 and 9.0 and Liberty builds.
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
A confused deputy flaw in Meta's AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space Force.
Red Hat npm Packages Backdoored with Miasma Credential Worm
Attackers backdoored 32 Red Hat npm packages with the Miasma worm, stealing CI/CD secrets, cloud keys, and SSH keys across roughly 80,000 weekly downloads.
Malicious npm Package codexui-android Steals OpenAI Tokens at Scale
A malicious npm package named codexui-android harvested OpenAI Codex authentication tokens from developers at roughly 29,000 weekly downloads before removal.
WP Maps Pro Flaw Exploited to Create Unauthorized Admin Accounts
An unauthenticated privilege escalation flaw in WP Maps Pro, a WordPress plugin with 15,000 paid sites, is actively exploited to create unauthorized administrator accounts.
Public Exploit Raises Flowise CVE-2026-40933 RCE to Immediate Risk
Public exploit code for CVE-2026-40933 now targets Flowise, a self-hosted AI chatflow builder, via a one-click malicious import that executes arbitrary code on the server.
Microsoft: 14 npm Packages Linked to Single Actor Stealing AWS Keys
Microsoft attributed 14 malicious npm packages impersonating OpenSearch and Elasticsearch to a single threat actor who stole AWS credentials and CI/CD secrets from developer environments.
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
June 2, 2026
A confused deputy flaw in Meta’s AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space
IBM WebSphere CVE-2026-8633: CVSS 9.8 No-Auth RCE Flaw Patched
June 2, 2026
CVE-2026-8633 is a CVSS 9.8 unauthenticated RCE in IBM WebSphere’s Web Server Plug-ins. Patches are available for WebSphere 8.5 and
IBM WebSphere CVE-2026-8633: CVSS 9.8 No-Auth RCE Flaw Patched
June 2, 2026
CVE-2026-8633 is a CVSS 9.8 unauthenticated RCE in IBM WebSphere’s Web Server Plug-ins. Patches are available for WebSphere 8.5 and
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
June 2, 2026
A confused deputy flaw in Meta’s AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space
Red Hat npm Packages Backdoored with Miasma Credential Worm
June 2, 2026
Attackers backdoored 32 Red Hat npm packages with the Miasma worm, stealing CI/CD secrets, cloud keys, and SSH keys across
Malicious npm Package codexui-android Steals OpenAI Tokens at Scale
June 1, 2026
A malicious npm package named codexui-android harvested OpenAI Codex authentication tokens from developers at roughly 29,000 weekly downloads before removal.
WP Maps Pro Flaw Exploited to Create Unauthorized Admin Accounts
June 1, 2026
An unauthenticated privilege escalation flaw in WP Maps Pro, a WordPress plugin with 15,000 paid sites, is actively exploited to
Public Exploit Raises Flowise CVE-2026-40933 RCE to Immediate Risk
June 1, 2026
Public exploit code for CVE-2026-40933 now targets Flowise, a self-hosted AI chatflow builder, via a one-click malicious import that executes
Microsoft: 14 npm Packages Linked to Single Actor Stealing AWS Keys
June 1, 2026
Microsoft attributed 14 malicious npm packages impersonating OpenSearch and Elasticsearch to a single threat actor who stole AWS credentials and
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.