appsec.fyi · Sources

news.risky.biz

5 curated AppSec resources from news.risky.biz across 2 topics on appsec.fyi.

news.risky.biz

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-27.

Supply Chain 4 RCE 1
Date Added Resource Excerpt
2026-07-27 2026A JSON RCE bug is about to rock the Java worldRCEA critical Remote Code Execution (RCE) vulnerability has been discovered in a popular Java JSON processing library. This bug, identified as a JSON RCE, poses a significant threat to applications that utilize this library for parsing JSON data. The vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to data breaches or system compromise. Developers are urged to update their dependencies to a patched version as soon as possible to mitigate this risk. The exact payout amount for this bug bounty is not specified in the provided content.
2026-06-15 2026Arch Linux supply chain attack spreads to 1900 AUR packagesSupply ChainAnalysis of the Arch Linux supply chain attack details how over 1,900 AUR packages were compromised, injecting a rootkit and credentials harvester. Attackers exploited an AUR mechanism to "adopt" orphaned packages, then modified installation procedures to include malicious npm packages or Bun scripts. The malware targets browser credentials, developer secrets, and access keys. This incident highlights vulnerabilities in community-driven package repositories and the evolving tactics of supply chain attacks.
2026-06-08 2026RubyGems adds dependency cooldown to counter supply chain attacksSupply ChainLibrary with support for dependency cooldowns, a feature designed to mitigate supply chain attacks by delaying the installation of newly released packages. This functionality, now integrated into RubyGems, mirrors similar implementations in the JavaScript (npm) and Python (pip, uv) ecosystems, as well as tools like Deno, Yarn, and Bun. Dependency cooldowns require packages to be a specified age (e.g., 7 days) before installation, providing time for security teams and maintainers to detect malicious versions. While disabled by default, this feature allows developers to enforce a delay, preventing immediate installation of potentially compromised code.
2026-05-13 2026Risky Bulletin: RubyGems disables sign-ups after attack on staffSupply ChainNewsletter summarizing recent application security incidents, including the RubyGems supply chain attack involving malicious packages targeting developers, the TanStack framework's compromise affecting hundreds of npm libraries with a self-propagating worm, and Skoda's web store vulnerability exposing customer data. It also touches on the Nitrogen ransomware group claiming responsibility for a Foxconn hack, West Pharmaceutical experiencing a ransomware attack, and Vodafone source code leaks by Lapsus$.
2026-05-06 2026Extremely targeted supply chain attack hits DAEMON ToolsSupply ChainLibrary for detecting and analyzing supply chain attacks, exemplified by the compromise of DAEMON Tools installers, which included a backdoor and a second-stage QUIC RAT payload. This incident, similar to past attacks on Notepad++ and CCleaner, highlights the targeting of high-value systems by Chinese-speaking threat actors for espionage. The library helps in identifying system data collection, remote server uploads, and targeted second-stage payload deployment.