Experimental News Clipping Site

Tag: malicious code

  • Hacker News: Malware found on NPM infecting local package with reverse shell

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell Source: Hacker News Title: Malware found on NPM infecting local package with reverse shell Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses the emergence of sophisticated malware on the npm package repository, specifically through malicious packages like ethers-provider2 and ethers-providerz, which exhibit advanced evasive techniques to compromise legitimate…

  • Hacker News: Whose code am I running in GitHub Actions?

    —

    by

    Kurt Seifried
    in

    Source URL: https://alexwlchan.net/2025/github-actions-audit/ Source: Hacker News Title: Whose code am I running in GitHub Actions? Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a recent security issue with the tj-actions/changed-files GitHub Action, highlighting the risks of mutable Git tags as opposed to immutable commit references in CI/CD processes. It emphasizes the…

  • Hacker News: New Jailbreak Technique Uses Fictional World to Manipulate AI

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.securityweek.com/new-jailbreak-technique-uses-fictional-world-to-manipulate-ai/ Source: Hacker News Title: New Jailbreak Technique Uses Fictional World to Manipulate AI Feedly Summary: Comments AI Summary and Description: Yes Summary: Cato Networks has identified a new LLM jailbreak technique named Immersive World, which enables AI models to assist in malware development by creating a simulated environment. This discovery highlights significant…

  • Alerts: CISA Adds One Known Exploited Vulnerability to Catalog

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/24/cisa-adds-one-known-exploited-vulnerability-catalog Source: Alerts Title: CISA Adds One Known Exploited Vulnerability to Catalog Feedly Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-30154 reviewdog action-setup GitHub Action Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and…

  • Hacker News: Supply Chain Attacks on Linux Distributions

    —

    by

    Kurt Seifried
    in

    Source URL: https://fenrisk.com/supply-chain-attacks Source: Hacker News Title: Supply Chain Attacks on Linux Distributions Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses supply chain attacks on Linux distributions, emphasizing the complexities of compromising these systems through upstream dependencies. The piece highlights recent attacks, notably a backdoor introduced into XZ Utils, and outlines…

  • Alerts: CISA Adds Two Known Exploited Vulnerabilities to Catalog

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/cisa-adds-two-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Two Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent…

  • The Register: Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/03/18/wiz_github_supply_chain/ Source: The Register Title: Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos Feedly Summary: Ad giant’s cloudy arm to pay $30B in security shop deal Wiz security researchers think they’ve found the root cause of the GitHub supply chain attack that unfolded over the weekend, and…