thehackernews.com resources

thehackernews.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-04-24.

RCE 23 Supply Chain 11 SSRF 8 XSS 4 AI 3 Secrets 3 AuthN 2 Python 2 Bug Bounty 1 JWT 1 Mobile 1 SQLi 1

Date Added	Resource	Excerpt
2026-04-24 2026	LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure SSRF	LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure https://ift.tt/8wBTJAc
2026-04-22 2026	Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens Supply Chain	Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens https://ift.tt/ch1xmSL
2026-04-22 2026	Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain Supply Chain	Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain https://ift.tt/uA7BI5U
2026-04-22 2026	UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours Secrets	UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours
2026-04-22 2026	TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files Supply Chain	TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files
2026-04-22 2026	Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain RCE	Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain
2026-04-22 2026	SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files Python RCE	SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files
2026-04-22 2026	Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure Python RCE	Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure
2026-04-22 2026	Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution Container Escape RCE	Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape https://ift.tt/1Oulkrs
2026-04-21 2026	22 BRIDGE:BREAK Flaws Expose 20000 Lantronix and Silex Serial-to-IP Converters RCE	22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial-to-IP Converters https://ift.tt/DKsAtmp
2026-04-21 2026	Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution AI	Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution https://ift.tt/WhCTNuU
2026-04-19 2026	Compromised IAM Credentials Power Large AWS Crypto Mining Campaign Secrets	Compromised IAM Credentials Power Large AWS Crypto Mining Campaign
2026-04-19 2026	Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 SSRF	Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882
2026-04-17 2026	New Supply Chain Malware Operation Hits npm and PyPI Supply Chain	New Supply Chain Malware Operation Hits npm and PyPI
2026-04-17 2026	Malicious PyPI, npm, Ruby Packages Exposed (The Hacker News)Supply Chain	Malicious PyPI, npm, Ruby Packages Exposed (The Hacker News)
2026-04-17 2026	Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation RCE	Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation https://ift.tt/4T8yCfB
2026-04-16 2026	DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover Mobile	DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover
2026-04-16 2026	ThreatsDay Bulletin: 17-Year-Old Excel RCEDefender 0-DaySonicWall Brute-Force and 15 More Stories RCE	ThreatsDay Bulletin: 17-Year-Old Excel RCE, Defender 0-Day, SonicWall Brute-Force and 15 More Stories https://ift.tt/dqWnwrt
2026-04-16 2026	Cisco Patches Four Critical Identity Services Webex Flaws Enabling Code Execution RCE	Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution https://ift.tt/QVmKiPr
2026-04-15 2026	April Patch Tuesday Fixes Critical Flaws Across SAP Adobe Microsoft Fortinet and More RCE	April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More https://ift.tt/TWG7p4N
2026-04-15 2026	Critical nginx-ui Vulnerability CVE-2026-33032 Allows Unauthenticated Nginx Takeover RCE	Critical nginx-ui Vulnerability CVE-2026-33032 Allows Unauthenticated Nginx Takeover https://ift.tt/3BrM2he
2026-04-15 2026	Microsoft Issues Patches for SharePoint Zero-Day and 168 Other Vulnerabilities RCE	Microsoft Issues Patches for SharePoint Zero-Day and 168 Other Vulnerabilities https://ift.tt/BA4SNeI
2026-04-14 2026	ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers RCE	ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers https://ift.tt/ydRG08z
2026-04-14 2026	CISA Adds 6 Known Exploited Flaws in Fortinet Microsoft and Adobe Software RCE	CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software https://ift.tt/zOKXM5J
2026-04-13 2026	OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident Supply Chain	OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident https://ift.tt/jKE2rut
2026-04-12 2026	Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 RCE	Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 https://ift.tt/Rst8N5U
2026-04-11 2026	Severe Security Flaw Found in jsonwebtoken Library JWT	Severe Security Flaw Found in jsonwebtoken Library
2026-04-11 2026	How Attackers Bypass Synced Passkeys AuthN	How Attackers Bypass Synced Passkeys
2026-04-11 2026	Fortinet FortiGate SAML SSO Bypass Active Attack AuthN	Fortinet FortiGate SAML SSO Bypass Active Attack
2026-04-10 2026	Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers Supply Chain	Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers
2026-04-10 2026	N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust Supply Chain	N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust
2026-04-10 2026	Malicious PyPI and npm Packages Exploiting Dependencies in Supply Chain Attacks Supply Chain	Malicious PyPI and npm Packages Exploiting Dependencies in Supply Chain Attacks
2026-04-10 2026	The State of Secrets Sprawl 2026: 9 Takeaways for CISOs Secrets	The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
2026-04-10 2026	Sneeit WordPress RCE Exploited in the Wild RCE	Sneeit WordPress RCE Exploited in the Wild
2026-04-10 2026	Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025 RCE	Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
2026-04-10 2026	Cisco Patches Zero-Day RCE Exploited by China-Linked APT RCE	Cisco Patches Zero-Day RCE Exploited by China-Linked APT
2026-04-10 2026	Critical Telnetd Flaw (CVE-2026-32746) Enables Root RCE RCE	Critical Telnetd Flaw (CVE-2026-32746) Enables Root RCE
2026-04-10 2026	Critical n8n Flaws Allow Remote Code Execution and Credential Exposure RCE	Critical n8n Flaws Allow Remote Code Execution and Credential Exposure
2026-04-10 2026	Why React Didn't Kill XSS: The New JavaScript Injection Playbook XSS	Why React Didn't Kill XSS: The New JavaScript Injection Playbook
2026-04-09 2026	ThreatsDay Bulletin: Hybrid P2P Botnet 13-Year Apache RCE ClickFix Node.js RAT & 18 More Stories RCE	ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year Apache RCE, ClickFix Node.js RAT & 18 More Stories https://ift.tt/1At5xBI
2026-04-07 2026	Over 1000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign RCE	Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign https://ift.tt/SmhObxn
2026-04-07 2026	Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12000 Instances Exposed RCE	Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed https://ift.tt/V8MzRY6
2026-04-05 2026	LangChain LangGraph Flaws Expose Files Secrets Databases in Widely Used AI Frameworks AI	LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks https://ift.tt/yaK0pkR
2026-04-05 2026	36 Malicious npm Packages Exploited Redis PostgreSQL to Deploy Persistent Implants Supply Chain	36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants https://ift.tt/Tf7sSuC
2026-04-05 2026	New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation RCE	New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation https://ift.tt/gfiQAwP
2026-04-04 2026	UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack Supply Chain	UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack https://ift.tt/6zp3fF8
2026-04-02 2026	New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries SQLi	New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries https://ift.tt/VzqC9YW
2026-03-26 2026	Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website XSS	Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website https://ift.tt/onyUmWb
2026-03-20 2026	Magento PolyShell Flaw Enables Unauthenticated Uploads RCE and Account Takeover XSS	Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover https://ift.tt/Oxljb9W
2026-02-06 2026	Claude Opus 4.6 Finds 500+ High-Severity Flaws Across Major Open-Source Libraries AI Bug Bounty	Anthropic’s Claude Opus 4.6 identified 500+ unknown high-severity flaws in open-source projects, advancing AI-driven vulnerability detection.
2026-01-21 2026	Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs SSRF	The Chainlit AI framework has vulnerabilities that can lead to data theft through file read and Server-Side Request Forgery (SSRF) bugs. These flaws allow attackers to access sensitive information and potentially compromise the security of the system. It is crucial for users of the Chainlit AI framework to be aware of these vulnerabilities and take necessary precautions to mitigate the risks associated with them.
2025-11-30 2025	CISA Adds Actively Exploited XSS Bug CVE-2021-26829 in OpenPLC ScadaBR to KEV XSS	CISA has included an actively exploited XSS bug, identified as CVE-2021-26829, found in OpenPLC ScadaBR, to the Known Exploited Vulnerabilities (KEV) list. This bug poses a security threat as it is actively being exploited.
2025-09-24 2025	Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials SSRF	Hackers are exploiting a vulnerability in Pandoc, identified as CVE-2025-51591, to target Amazon Web Services (AWS) Instance Metadata Service (IMDS) and steal EC2 Identity and Access Management (IAM) credentials. This security breach allows unauthorized access to sensitive information stored on AWS servers. It is crucial for AWS users to be aware of this threat and take necessary precautions to protect their data and credentials.
2025-07-23 2025	CISA Warns: SysAid Flaws Under Active Attack Enable Remote File Access and SSRF SSRF	The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about active attacks targeting vulnerabilities in SysAid software. These flaws allow attackers to access files remotely and conduct Server-Side Request Forgery (SSRF) attacks. Organizations using SysAid should be vigilant and apply patches to mitigate the risk of exploitation.
2025-03-12 2025	Over 400 IPs Exploiting Multiple SSRF Vulnerabilities in Coordinated Cyber Attack SSRF	A coordinated cyber attack involving over 400 IPs exploiting multiple Server-Side Request Forgery (SSRF) vulnerabilities has been detected. SSRF vulnerabilities allow attackers to manipulate a server into making unauthorized requests, potentially leading to data breaches or server compromise. The attack highlights the importance of addressing and patching vulnerabilities promptly to prevent exploitation. Vigilance and proactive security measures are crucial in defending against such coordinated cyber threats.
2025-02-10 2025	Zimbra Releases Security Updates for SQL Injection Stored XSS and SSRF Vulnerabilities SSRF	Zimbra has issued security updates to address SQL Injection, Stored XSS, and SSRF vulnerabilities. These updates aim to enhance the security of the Zimbra platform and protect users from potential exploitation of these vulnerabilities. Users are advised to promptly apply the updates to safeguard their systems and data from security risks.
2025-02-06 2025	Microsoft SharePoint Connector Flaw Could've Enabled Credential Theft Across Power Platform SSRF	A vulnerability in the Microsoft SharePoint Connector could have allowed attackers to steal credentials across the Power Platform. This flaw posed a security risk by potentially enabling unauthorized access to sensitive information. Microsoft has likely addressed this issue to prevent credential theft and enhance the security of the Power Platform.